One third of sovereignty claims come with no proof

Analysis ran across 233 public communications from 60 large European companies. Most are selling the story faster than they can prove it.

In June, I surmised that the sovereignty story most companies tell would likely not survive scrutiny. It turns out that my smart colleagues at Kekst CNC independently verified my hunch.

Their (or rather our!) analysis spanned 233 public communications from 60 large European companies in sectors where sovereignty has moved from slogan to selection criterion: technology and telecoms, defence, finance and healthcare. Press releases, annual reports, earnings decks, owned content. Of those, 197 crossed the threshold for an explicit sovereignty position.

Three insights stand out.

The talking has outrun the proving

Sovereignty messaging is rocketing as communications explicitly built around it rose more than sixfold between the pre-2024 period and the years since. Mentions in top-tier English-language media climbed almost 50% in the twelve months to April 2026.

However, the evidence did not keep up. Only 64% of the communications carry a clear, directly supporting proof point. Read it the other way. About one in three sovereignty claims lands with nothing behind it a stakeholder can verify. That is the risk the research names: sovereignty washing, the promotion of a sovereign capability that the audience perceives as unrealised, or realised only in part.

The gap is uneven. Technology leads on substantiation at 69%, which figures, since it has the most concrete things to point at. Finance and healthcare sit at 60%. Defence comes last at 51%. There is an irony in that. Defence and aerospace have been running strategic-autonomy arguments for decades, longer than anyone. Yet when the argument crosses into the digital domain, the proof in the communications is thinnest of all.

Obviously this story measures the story, not the machinery. A missing proof point means a company did not show its working, not that the working does not exist. For a communicator that distinction is the whole job. The operational truth may be sound. The communication is where the reputation is won or lost, and right now the communication is running ahead of what it can prove.

Digital sovereignty is evolving into a distinct category of reputation

risk. As stakeholder expectations rise and definitions remain fluid,

the organizations that succeed will be those that can match narrative

with demonstrable action.

Companies prove what they sell, not how they run

The second finding is the one I find most telling, because it maps onto the question I said mattered most in June. Where does your data live, and who can compel access to it?

Where supporting evidence exists at all, 81% of it relates to products, partnerships and commercial offerings. Only 19% touches internal operations: governance, certifications, infrastructure, the actual controls. Companies are fluent in what they sell you. They go quiet on how they run themselves.

That is the softer half of the sovereignty story, and it is the half a regulator, a journalist or an unhappy customer presses on first. It also collides with an awkward market fact the research does not dodge. Several companies cite a US hyperscaler in the same breath as their sovereignty claim. That is not washing on its own. American hyperscalers still hold roughly seventy per cent of the European cloud market, so the dependence is near-universal. It is the pragmatic dependence I described from the stage, and it holds up only when a company is candid about the control it retains rather than the independence it implies.

Nobody agrees what the word means

The third finding is that the vocabulary is still molten. Digital sovereignty is the umbrella, used 127 times in the dataset. Underneath it sit strategic autonomy, cloud sovereignty, compliance, European industrial capacity, data sovereignty, cybersecurity, and the fast-rising newcomer, AI sovereignty. They are used together, often interchangeably, frequently to mean whatever the speaker needs them to mean that morning.

An unsettled language is convenient. It lets a company sound sovereign without committing to a definition anyone can hold it to. That convenience has a shelf life. Sovereignty is multidimensional, and every state bends it to its own ends, a point I laboured in June. Companies are doing the same. The flexibility that shields you while the terms are vague turns into a liability the moment the terms are fixed.

And they are being fixed. The EU’s CADA assurance framework is one sign of sovereignty claims becoming testable in practice. The machine now reads your communications literally, repeats its account of you to every buyer and regulator who asks, and grades none of it on charm. A vague claim was survivable when the only audience was a distracted human. It will not survive a standard, a framework, and a system that quotes you back to yourself.

Four moves for heads of comms

None of this argues for silence. Silence is a position too, and usually a delaying one.

1. Audit the gap before anyone else does. Take your last year of sovereignty messaging and mark each claim against the evidence sitting behind it. Which ones would wilt under a regulator’s letter, an investigative call or a procurement questionnaire? That list is your risk register. Better you write it than a journalist.

2. Prove how you run, not just what you sell. The under-evidenced 19% is where scrutiny lands first. Move proof into the operational layer: where the data lives, which sub-processors touch it, what the governance and controls actually are. A product claim is easy to make and easy to check. The operational claim is the one that earns trust, and the one most companies are still ducking.

3. Fix your definition before a framework fixes it for you. State what you mean by sovereignty in your own context, and name the layer you are committing to, whether that is data residency, jurisdictional control or operational autonomy. Each is a different promise with a different defence. Vague language buys you room today and costs you credibility the moment CADA or the next standard makes the terms testable.

4. Write for the auditor and the machine. Anchor every claim in something verifiable, because those are the details a regulator, an investor and a generative model all reach for first. And do not oversell. Sovereignty is a journey for almost everyone. Progress is a more credible story than perfection, and a far safer one than a fortress you cannot actually hold.

The story that survives scrutiny

I ended in June on ownership. Someone always owns the thing, and someone always tells the story of who owns it, and your only choice is whether that someone is you. The research adds a line to it. The next phase of this debate belongs to the companies that can demonstrate the story. Declaring it will no longer be enough.

Make sure yours survives the scrutiny. It is coming either way.

Read the report here. Get in touch for a chat.