Digital Sovereignty, AI, and the IT Map

CIOs, security directors, and procurement teams are reevaluating technology suppliers for reasons that have nothing to do with pricing or redundancy—and everything to do with location.

To limit exposure to geopolitical risks, a growing number of businesses are exploring ways to purchase software and hardware within their own national borders or trade blocs like the European Union.

Mimicking the larger global trend toward reshoring and nearshoring, these organizations hope to bolster resilience by procuring critical technologies like LLMs, semiconductors, and productivity software from domestic or regional suppliers. Welcome to the era of digital sovereignty.

A recent Capgemini study found that 93 percent of organizations have discussed digital sovereignty at the board level. But the reality of the global tech industry—where certain capabilities are delivered by a small number of vendors in one or two geographic regions—makes a complete digital reshoring unrealistic. Accordingly, two-thirds of respondents told Capgemini they’re prioritizing selective ownership of certain technologies and relying on trusted partnerships, rather than pursuing full ownership of the tech stack.

Finding a strategic balance means understanding the provenance of hundreds or potentially thousands of technology contractors, vendors, and third parties—the providers behind everything from AI assistants to servers to videoconferencing apps.

Businesses that use an IT map powered by geographic information system (GIS) technology have a head start in understanding the origins of their tech stack.

How Does an IT Map Support Digital Sovereignty?

In the past, security and risk teams consulted IT maps to see how physical threats like floods or fires might impact servers, switches, data centers, and other key tech elements.

Now, geopolitical tension has become its own technology risk, with business leaders concerned about data privacy and security, overconcentration of digital supply chains, and even kill switches that foreign entities could use to disable critical technologies.

Earlier this year, France announced that its public sector would be transitioning from American videoconferencing platforms to a homegrown tool. Meanwhile, the US government banned Chinese AI platform DeepSeek from federal agencies out of concerns about data access, tracking, and malware threats.

For multinational businesses in finance, health care, utilities, and other sectors thinking about digital sovereignty, IT maps can track not only where a piece of hardware or software has been placed into service, but also where its provider is based.

Company leaders can then query the IT map to discover geographic concentrations of suppliers. A business leader might use the AI prompt, “Show me the countries where we source most of our software,” or request a map of all the technology vendors added in the previous year.

The map might reveal cloud computing services hosted in the US, data storage products manufactured by Chinese providers, and AI chips produced in Taiwan.

A Picture of IT Risk That Extends Beyond Tier 1 Suppliers

At many Fortune 500 firms, GIS technology is already an integral part of security, resilience, and supply chain planning. Location analysis helps brands uncover areas where supply chain partners are exposed to natural disasters or engaged in practices that pose reputational harm, like forced labor or deforestation.

Often, those risks aren’t visible among Tier 1 suppliers. GIS provides deeper transparency by mapping connections between vendors, subcontractors, and even raw material suppliers. Now, as companies attempt to divine their reliance on foreign technologies, location technology will be key to establishing that visibility.

A US-based cloud service, for example, may rely on engineering teams in India or data storage facilities in Brazil, raising questions of who can access data and which laws govern compliance.

For companies working to enhance resilience, GIS is helping trace the tech stack, revealing which dependencies are within tolerance and which raise red flags, enriching the company’s understanding of risk.