Digital sovereignty sounds great until you try ditching your suppliers

Capgemini found 59% of large organizations view complete digital sovereignty as unrealistic, while 86% have significant exposure to foreign or externally controlled technology supply chains and only 14% have end-to-end visibility into ecosystem dependencies. Provider lock-in is substantial: 36% said replacing a critical vendor would take more than a year and 10% have no viable alternative. AI is the top sovereignty concern for 75% of respondents, but contingency planning remains weak, with only 42% of organizations that experienced disruptions having recovery plans in place.

Analysis

This is directionally constructive for hyperscalers rather than for “sovereign cloud” challengers: customers are signaling that multi-cloud, contractual controls, workload portability and recovery layers are more economical than wholesale repatriation. MSFT, AMZN and GOOGL should retain sticky regulated-enterprise workloads, while the incremental spend flows to architecture, identity, backup and observability rather than wholesale infrastructure replacement. The margin implication is favorable for cloud platforms because resilience features and managed security services carry higher attach rates than core compute.

The underappreciated bottleneck is not data residency but application and dependency mapping. That favors PANW, CRWD, ZS, ORCL and IBM/Red Hat where the product set addresses identity, policy enforcement, workload portability or hybrid control planes. European regional providers such as OVH Groupe (OVH.PA) may win selective public-sector and highly regulated workloads, but their addressable opportunity is capped if buyers continue to accept foreign infrastructure with localized controls; this argues against extrapolating sovereignty rhetoric into a broad hyperscaler-displacement thesis.

For CAP, the survey is better interpreted as consulting pipeline evidence than an investable near-term earnings catalyst. Advisory demand can convert over 6-18 months into cloud modernization, cyber-resilience and AI-governance engagements, but clients facing lengthy vendor migration cycles may initially buy assessments and contingency plans rather than large implementation programs. The thesis is falsified if European enterprise IT budgets tighten materially or if CAP fails to show acceleration in its cloud/cyber/AI bookings and utilization; absent those datapoints, there is no reason to chase the stock on survey publicity alone.

Key Decisions for Investors

• No standalone CAP trade on this release; place CAP on a 1-2 quarter watchlist for disclosed growth in cloud, cybersecurity and AI transformation bookings, plus utilization and pricing. Upgrade only if these indicators improve without a corresponding deterioration in discretionary consulting demand.
• Overweight PANW and CRWD versus broad IT services over 6-12 months: resilience mandates tend to create recurring platform spend in identity, endpoint and cloud-security controls before they create large migration projects. Key risk: security-budget consolidation or weaker net-new ARR guidance; use earnings-driven entries rather than immediate momentum buying.
• Pair-trade watch: long MSFT or AMZN / short a basket of smaller sovereign-cloud infrastructure vendors, including OVH.PA where liquid and mandate-permitted, over 6-18 months. The spread works if enterprises adopt localized controls on incumbent platforms rather than fully replacing them; exit if European procurement rules begin requiring domestic ownership rather than residency and operational control.
• Monitor ORCL and IBM for upside revisions to hybrid-cloud and regulated-AI demand over the next two earnings cycles. Initiate only after management quantifies incremental sovereign/resilience bookings; without that disclosure, the theme remains strategically plausible but not sufficiently measurable for a new position.