To find out, xorlab surveyed 100 European CISOs. The Digital Sovereignty Report 2026 reveals their view and the gap between ambition and reality:
-
89% of CISOs consider digital sovereignty important,
but only 46% actively treat it as a high priority. -
96% use at least one U.S.-based service provider,
while 39% prefer to avoid them where possible. -
20% of CISOs are planning to reduce their dependence
on U.S. based providers over the next two years.
It’s easy to assume that becoming more sovereign means abandoning all global providers altogether. In practice, that is neither realistic nor necessary. Digital sovereignty starts with manageable steps: understanding dependencies, identifying and controlling data access and assessing credible alternatives where necessary.
What else did the 100 European CISOs reveal?
Where is their most sensitive data processed? How often do organisations bypass their own sovereignty requirements? How quickly do they expect disruption if U.S. based service providers suddenly stop serving Europe?
Find out in part one of the Digital Sovereignty Report 2026
