AI may have shifted from experiment to enterprise priority, but many UK businesses now face a difficult follow-up question: who controls the data that makes those systems work?
New IDC research, commissioned by Expereo, suggests that digital sovereignty is becoming a more prominent concern for organizations managing AI, cloud, and connectivity across increasingly complex environments. According to the UK findings, 50% of UK enterprises want greater control over sensitive and strategic data, while 56% of UK technology leaders worry that AI could create new security risks.
The findings do not suggest that organizations are retreating from AI. Instead, they point to a shift in how technology leaders view the foundations required to scale it. Data location, cross-border transfers, network resilience, security controls, and visibility into traffic flows now sit closer together in enterprise decision-making.
TL;DR
- Data control is rising: Half of UK enterprises surveyed want greater control over sensitive and strategic data.
- AI adds urgency: Security concerns remain a major barrier to adoption, and 56% of UK technology leaders say AI may create new security risks.
- Infrastructure matters: IDC’s global research links AI outcomes to data quality, skills, governance, and network performance, not models alone.
Why Is Digital Sovereignty Becoming an AI Issue for UK Businesses?
Digital sovereignty is becoming an AI issue because organizations need to know how sensitive data moves through cloud, network, and AI environments before they can manage its security, compliance, and operational risk. For UK businesses, that challenge extends beyond where data is stored. It also includes the providers, jurisdictions, and connections involved in processing and moving it.
IDC’s research frames digital sovereignty as a global priority shaped by the need to retain control over sensitive data amid regulatory complexity and geopolitical risk. Across the global respondent base, 33% of organizations described digital sovereignty as a high or top priority.
The UK findings supplied by Expereo show a similar direction of travel. Alongside the 50% of enterprises seeking greater control over sensitive and strategic data, 29% of UK organizations now view digital sovereignty as a top or high priority. A further 27% rank it among the leading drivers of technology investment.
That matters for customer experience leaders because AI programs increasingly depend on data drawn from multiple business systems. Customer interaction data may move between contact center platforms, CRM tools, knowledge bases, cloud infrastructure, analytics environments, and AI services. Each connection can create a governance question.
In practice, sovereignty does not require every organization to keep all data within one country or avoid cloud services. It requires leaders to understand their obligations, map data flows, and decide which controls fit the information, services, and jurisdictions involved.
WHAT IS DIGITAL SOVEREIGNTY?
- Control: The ability to understand and govern how data, applications, and infrastructure operate.
- Compliance: Meeting regulatory and contractual obligations across the jurisdictions where an organization operates.
- Resilience: Reducing exposure to disruptions, provider dependencies, and risks associated with complex cross-border operations.
What Is Driving the UK’s Push for Greater Data Control?
UK organizations are placing greater emphasis on data control because AI introduces new security, compliance, and operational questions at the same time as cloud environments become more distributed. The research points to a combination of internal risk management and external pressure from customers, partners, and regulators.
Security and privacy concerns remain a substantial obstacle to AI adoption. In IDC’s global Technology Leaders Survey, 58% of organizations cited security concerns as a barrier to AI adoption, just behind cost at 59%. The UK release adds that 56% of technology leaders worry AI could create new security risks for their business.
Those concerns reflect a real enterprise tension. AI can improve productivity, quality of work, and customer experience, but it can also broaden the volume of data in motion, introduce new dependencies, and create additional routes for sensitive information to be exposed or misused.
The commercial dimension is also growing. Expereo’s UK findings show that 26% of businesses say customer or partner demands to localize data are influencing their approach to digital sovereignty. That suggests the issue is no longer confined to internal legal and technology teams. It can affect supplier selection, customer trust, and the ability to win or retain business.
IDC’s global analysis also shows regional differences. Enterprises in APAC place the highest priority on digital sovereignty globally at 38%, compared with 31% in Europe and 30% in the US. IDC characterizes Europe’s approach as predominantly regulation-led, with GDPR and data residency rules shaping infrastructure, cloud, and vendor decisions.
Can Businesses Scale AI Without Stronger Security and Governance?
Businesses can deploy AI without mature governance and security foundations, but IDC’s research suggests they are less likely to produce reliable value at scale. Organizations need clear ownership, high-quality data, appropriate skills, cost visibility, and resilient infrastructure if they want AI investments to move beyond isolated experiments.
IDC found that AI use is widespread, but maturity remains limited. Across the survey sample, 62% of organizations described their AI use as limited, while 25% reported extensive use and 5% described their use as transformative. The research does not establish causation, but it does show that more advanced adoption aligns with more optimistic business expectations.
The research also highlights a gap between activity and outcomes. Nearly 60% of organizations globally reported positive AI ROI, according to IDC’s Global AI & Network Performance Survey. However, the report warns that aggressive investment without the right foundations can amplify inefficiencies rather than close the ROI gap.
For organizations where AI underperformed expectations, poor data quality was the most commonly cited factor at 51%, followed by costs exceeding ROI at 47% and AI underperformance at 46%. Inadequate network performance affected 26% of respondents in this group.
By contrast, organizations where AI exceeded expectations cited AI performance, strong in-house skills, network performance, high-quality training data, and project management as contributing factors. The findings reinforce a familiar lesson for CX leaders: an AI experience is only as dependable as the data, workflows, people, and infrastructure behind it.
WHY AI ROI CAN STALL
- Data quality: AI systems cannot deliver reliable output if the underlying data is incomplete, inconsistent, or poorly governed.
- Skills and accountability: Enterprises need people who can manage data, security, implementation, and business outcomes.
- Infrastructure readiness: Distributed AI workloads need dependable, secure connectivity and the visibility to identify potential weak points.
Why Does Network Visibility Matter for Digital Sovereignty?
Network visibility matters because it helps organizations understand how data travels between cloud services, users, applications, and jurisdictions. It cannot solve every sovereignty problem, but it can support informed decisions about routing, security, resilience, and compliance in complex enterprise environments.
Expereo argues that digital sovereignty increasingly depends on visibility into data movement, not only data storage. The company’s position reflects the growing importance of distributed infrastructure as enterprises combine public cloud services, private environments, SaaS platforms, remote workforces, and AI tools.
Ben Elms, CEO of Expereo, said: