Digital sovereignty occupies a prominent place on the European agenda. Geopolitical tensions, new legislation – such as NIS2, DORA, and the Cyber Resilience Act – and the growing awareness of technological dependencies have firmly placed this issue among the priorities of many boards of directors. 86% of European respondents are aware of the risks associated with technology or data being subject to foreign legislation. At the same time, only half have translated that awareness into active policies that are actually being implemented. As a result, the gap between knowing and acting has become a risk in itself.
Spain breaks this European trend as 56% of organisations are actively implementing policies to strengthen their digital sovereignty, reducing technological dependencies and laying the groundwork for a safer and more strategic adoption of artificial intelligence. This is revealed by the study «Tech Reality Check 2026», produced by the business and IT transformation service provider Conclusion after surveying 1,058 IT managers from four European countries (Germany, the Netherlands, Portugal, and Spain). This is the highest percentage among the four countries analysed.
Furthermore, 54% of Spanish companies have largely integrated jurisdictional risks into their policies, which also represents the highest percentage among the surveyed countries. 70% have complete visibility of their critical digital dependencies, a figure comparable to that of Germany (71%). Spain thus combines high awareness with a high degree of execution, a combination that is less frequently found in other surveyed countries.
Knowledge Integration
Spain is also the only surveyed country where a majority (56%) rejects the claim that critical systems operate on technology that is only understood by a few people within the organisation. In the Netherlands (68%) and Germany (67%), this risk of knowledge concentration is widely recognised. In Spain, therefore, digital sovereignty is not limited solely to the choice of suppliers or jurisdictional issues, but also involves a broader integration of technological knowledge throughout the organisation.