Sovereignty by design: Building resilient enterprises in a connected world

Last week, I received a call informing me that a service software solution used in a geo-strategically sensitive area had been disrupted. The immediate result: the company’s factories came to a standstill across the entire territory. Having been engaged for several years on resilience and CSR topics, I’d like to pause and reflect on the notion of sovereignty.

Within companies, four complementary dimensions emerge, together forming the true foundation of stability. These are strategic autonomy, resilience, security and control. In this article, I aim to define the objectives and potential of Sovereignty, while looking at it as a cumulative result of the above-mentioned dimensions.

Let’s dive in.

Sovereignty: A capability

One essential point worth recalling is that sovereignty is not a rejection of global interdependencies. Some of its key abilities are as follows:

• Identify critical dependencies
• Differentiate levels of control based on the sensitivity of assets like data, technologies, infrastructures, and supply chains
• Maintain a continuum of options for replacement or reconfiguration

End-to-end, managed sovereignty is a pragmatic, concrete approach, far from ideological postures. It consists of identifying weak points and, accordingly, putting in place mechanisms for continuity and adaptation.

How strategic autonomy contributes to stability

The European Union (EU) no longer speaks solely of independence, but of open strategic autonomy. The nuance matters. The European vision is therefore built around a watchword: do not isolate ourselves, but do not be subjected.

In a context shaped by extraterritorial laws, the rise of cyber threats, and the acceleration of AI, the challenges are clear:

• Secured sensitive data
• Diversified supply chains
• Hosting under European jurisdiction
• Dependency on local, controlled infrastructures
• Compliance with regulatory requirements

From this perspective, digital sovereignty becomes a driver of collective power and a factor of economic stability. Resilience lies at its core.

Decoding sovereignty as a security requirement

If capability helps identify dependencies, and strategic autonomy aims to avoid being subjected to them, security is about controlling the risks:

• Protection of critical and strategic data
• Controlled access and technological dependencies
• Embedded cybersecurity from the design stage of information systems

The logic promoted by the EU — particularly through strengthened cybersecurity requirements — is as follows: It is no longer only about defending against an attack, but about reducing structural vulnerabilities that could paralyze operations, expose sensitive assets or, de facto, shift decision-making power.

The capacity for control

Sovereignty is fully realized when there is control. It is no longer only about knowing one’s vulnerabilities, but about having effective governance over technological choices, strategic partners, and data flows.

This requires dynamic mapping of dependencies, legal control of operating environments, genuine contractual reversibility, and a decision-making capability aligned with long-term strategy. In a context where certain technical decisions can create a lasting dependency, such as vendor lock-in or hosting outside a controlled jurisdiction, the risk is no longer only operational. It becomes strategic.