In the face of growing technological dependencies, digital sovereignty is becoming a key issue of control, resilience, and business continuity for organizations. Bertrand Merlier, Solution Architect and AI Expert at Sopra Steria Switzerland, explains the main challenges and practical levers for action.
Digital Sovereignty: A Purely Political Topic or a Necessity for Every Organization?
Bertrand Merlier: Digital sovereignty has emerged as a major strategic issue in a geopolitical context marked by increasing tensions and growing competition over data, infrastructure, and critical technologies. In Europe and Switzerland alike, the dependence of many organizations on foreign providers raises questions of control, security, and resilience. Faced with these challenges, organizations must strike a balance between innovation, regulatory compliance, and risk management.
Public authorities have taken up the issue. In December 2025, the Swiss Federal Council made digital sovereignty a priority within its Digital Switzerland Strategy 2026, setting guidelines for the federal administration and confirming the Swiss Government Cloud initiative. During the Swiss Cyber Security Days in February 2026, Federal Chancellor Viktor Rossi summed up the concept with the following statement: “Sovereign is the one who understands their dependencies.” Not the one who isolates themselves, but the one who creates options and reduces dependencies where it makes sense.
Question: Digital sovereignty has clearly become part of public discourse. Beyond political and strategic decisions, does it apply to all organizations?
Bertrand Merlier: The Chancellor’s definition closely aligns with our vision at Sopra Steria. Digital sovereignty is not an absolute necessity for everyone, nor does every organization require the same level of sovereignty. However, every organization must ask itself the question.
The objective is clear: maintain the ability to operate independently where necessary, protect what is strategic, and focus not only on sovereignty but also on digital resilience.
One important point needs clarification, as confusion is common: sovereignty and resilience are two distinct concepts. Sovereignty is about control: who decides, who operates, and under which legal framework. Resilience is about continuity: the ability to withstand disruptions and recover. While they often reinforce one another, they can also conflict. Bringing a service back in-house without sufficient expertise, or abandoning redundancy provided by a third party, may increase sovereignty and control but reduce resilience by weakening business continuity.
Sovereignty and resilience must therefore be addressed together and balanced carefully.
As a result, the answers and decisions are unique to each public or private organization, as they stem from a combination of strategic, operational, legal, and political constraints.
Question: Sovereignty is clearly a multi-faceted subject. How can organizations approach it in practical terms?
Bertrand Merlier: Behind the concept of sovereignty lie four complementary dimensions. Examining them individually is essential to understanding the challenges, assessing risks and positioning, and defining priorities.
Strategic Sovereignty
Strategic sovereignty refers to an organization's ability to control the resources required to preserve its decision-making and operational autonomy. The key challenge is to define what sovereignty means for the organization, identify existing risks, and determine which risks are acceptable and which require mitigation plans.
A good example is a public organization whose role requires uninterrupted service delivery to citizens. It must ensure that services remain operational and adaptable regardless of a supplier’s commercial decisions, the legal framework under which that supplier operates, or external political decisions.
Data Sovereignty
At the heart of digital challenges, data sovereignty concerns control over data collection, storage, access, and usage processes.
Organizations may legitimately choose to rely on external service providers, provided they clearly understand what is being delegated. The fundamental questions are: where is sensitive data stored, and who defines access, sharing, and usage rules?
For example, when dealing with employee HR records or citizens’ medical data, organizations must assess who administers accounts, who controls encryption keys, and under which legal jurisdiction the service provider operates.
Technical Sovereignty
Technical sovereignty is the ability of an organization to maintain control over its digital infrastructure, platforms, and applications. It also depends on the ability to change providers, technologies, or environments without excessive dependency, thereby preserving autonomy and freedom of choice.
Assessing this dimension requires mapping exposure by identifying components, internal competencies, outsourced services, contractual arrangements, applicable legal frameworks, and exit conditions.
A common example is a business-critical application operated by a single provider, relying on proprietary data formats and offering no access to technical logs. The organization must determine whether the level of sovereignty associated with this activity is sufficient.
Operational Sovereignty
Operational sovereignty is the ability of an organization to maintain continuity, control, and efficiency in activities deemed essential, regardless of suppliers, partners, or technology providers. This remains true even in the event of technological dependency or external disruption.
For instance, an organization using cloud services can retain operational sovereignty if it maintains key internal skills and governance roles, has fallback procedures in case of service failures, and preserves the ability to replace these services when necessary.
Question: There are clearly many factors to analyze and potentially complex decisions to make. How can organizations implement an effective approach?
Bertrand Merlier: This is not an initiative that can be built overnight. It is a genuine transformation project that must be managed from initial assessment to implementation. The key is understanding what to prioritize and how to maintain control over decisions in the long term.
Sopra Steria proposes a three-step approach.
Define Priorities
Gain a clear understanding of the most strategic processes, data, and systems, as well as the areas where autonomy is essential.
A useful deliverable is a critical asset register validated jointly by business stakeholders and IT teams.
Assess Risks and Dependencies
Identify factors that may threaten compliance, operations, or autonomy, and understand where dependencies exist: technologies, suppliers, data, and third-party ecosystems.
A matrix combining dependency levels, business impact, and replacement lead times helps highlight priorities and supports objective decision-making between control and continuity.
Build a Roadmap
Sequence initiatives according to urgency while accounting for long-term regulatory requirements.
A clear roadmap distinguishes contractual measures, architectural evolutions, and broader transformation efforts. It is also the stage where external expertise can provide valuable benchmarks and accelerate progress.
This approach must be supported by clear governance that defines responsibilities and ensures long-term project oversight.
Question: What about Artificial Intelligence?
Bertrand Merlier: AI revisits all four dimensions, often at a faster pace and sometimes involving the most sensitive data.
The key questions are: how much control do we have over decision-making logic, legal compliance, and the infrastructure hosting AI workloads?
Establishing an AI governance framework while use cases are still limited helps avoid creating new dependencies within a few months after having reduced them elsewhere.
With this objective in mind, we developed AI Backbone, our AI platform that decouples business use cases from the underlying model provider. A developed use case remains operational even if the underlying model evolves or changes. This is reversibility applied to the most dynamic layer of the information system.
Question: Should organizations in Switzerland wait until public sovereign offerings mature further, or can they take action now?
Bertrand Merlier: Our recommendation is clear: organizations can and should start today, at the scale that suits them. No external program can replace the analysis each organization must conduct for itself. Sound governance will naturally incorporate external developments and emerging opportunities throughout the process.
Sovereign digital offerings are indeed developing rapidly in both Switzerland and Europe. The Swiss Government Cloud, intended for public administrations, will deliver its first operational services in 2027 and is already planned through 2032. In Europe, several initiatives, including those supported by Sopra Steria as a key player in cybersecurity, defense, data, and trusted AI, are helping shape the ecosystem, including Gaia-X, Digital Europe, and the European Sovereign Tech Industry Alliance (ESTIA).
One final piece of good news: the measures that strengthen sovereignty and resilience, such as open standards, proven reversibility mechanisms, up-to-date documentation, and modular architectures, are also the very elements that make organizations easier to modernize. Sovereignty is not a protection cost; it is an opportunity that creates the foundation for agility, innovation, and long-term sustainability.