In the latest edition of its CIO Compass, Sopra Steria Next broadens the debate on AI sovereignty: it is not only about where data and models reside, but also about who controls the decisions they produce.
PARIS, Oct. 21, 2026 /PRNewswire/ — Large organisations have spent a decade governing their data. They have given little or no thought to governing decision-making. Yet generative and agentic AI no longer simply makes recommendations: it prioritises, triggers and executes. In the latest edition of its CIO Compass, ‘AI is nothing without control and purpose’, Sopra Steria Next, the consulting arm of Sopra Steria, offers CIOs a nine-dimension framework for governing not only data, but also automated decisions and their consequences.
- Fewer than 20% of AI-influenced or AI-executed decisions have an identified business owner, explicit rules and formal accountability.
- Fewer than 25% of AI-driven decisions in production can be traced and replayed end-to-end.
- An automated decision failure can affect 10 to 100 times more operations, customers or revenues than a traditional IT incident.
What is AI sovereignty?
It is not just a matter of knowing where data is hosted and where models run. It also covers the ability to demonstrate, at any moment, who controls, explains and arbitrates automated decisions. Vendor dependency has shifted from infrastructure to cognition, and that dependency is harder to reverse. With this publication, Sopra Steria Next calls on CIOs to make explicit a five-layer ‘sovereignty stack’, spanning data, models, platforms, APIs and decisions, with one question per layer: who operates it? Who can replace it? Who is accountable?
‘The new question we now have to ask concerns decisions that AI has already taken without anyone being accountable for them,’ says Valérie Thiblet, Partner Data & AI, Sopra Steria Next. ‘A system that cannot be stopped in real time is not governed: it is merely observed. And what cannot be governed cannot be industrialised.’
The document identifies several breaking points for IT departments: the rise of Shadow AI, which erodes traceability and cost control before leaders are even aware of it; model governance, still treated as an optional layer; and the AI Act, where the main risk will not be deliberate non-compliance but accidental non-compliance through lack of preparation.
