Improving sovereignty is not a one time project. It is a continuous optimization exercise under economic constraints, while technology itself keeps changing the available options. The Sovereignty Calculus provides a framework for navigating that problem.

The Triangle: Risk, Cost & Capability

Digital sovereignty is optimized across three dimensions at the same time:

• Risk captures exposure across six sovereignty risks: cyber vulnerability, operational disruption, loss of expertise, regulatory exposure, kill switch exposure, and vendor lock in.
• Cost captures five economic variables: investment, marginal cost, run cost, cost of change, and opportunity cost.
• Capability captures five dimensions of the technology environment: service portfolio, service performance, integration, scale, and frontier adoption.

The point of the triangle is that in practice these dimensions are not optimized in isolation. A solution may be secure and cheap, but useless if it cannot deliver the required capability. Likewise, maximum capability may create unacceptable risk or cost.

Strategic Requirements: Where You Want to Be

Strategic Requirements define the target position in the triangle. They determine how much risk, cost and capability matter for a specific organization. Size, public interest, global reach, business volatility, proximity to the technology supply chain and the competitive importance of technology all shape that target.

A retailer with thin margins may prioritize flexibility and cost. A critical public institution may tolerate much higher cost in exchange for lower kill switch or regulatory risk. There is therefore no universal optimal sovereignty position.

Technical Maturity: How Well You Can Move

Technical Maturity determines how easily an organization can move toward its desired position. A mature organization can migrate, redesign, insource, or change providers with comparatively little cost and disruption. A less mature organization may struggle to move at all.

Technical maturity can be understood through three abilities:

• Run: the ability to keep existing systems operational, reliable, and efficient at low cost and risk.
• Change: the ability to modify systems, deliver new capabilities, and migrate between technologies within the current technology generation quickly and with limited disruption.
• Adoption: the ability to recognize emerging platform shifts and adapt technology, processes, and business models accordingly.

The Calculus is Reality

The Sovereignty Calculus does not prescribe one ideal technology strategy. It describes the logic already visible in real technology decisions: different actors arrive at different answers because their strategic requirements, technical maturity, risks, costs, and capability needs differ.

• 37signals is a software company running mature, predictable SaaS products. Its strategic requirement was efficient operation of a relatively stable technology environment, making cost and sovereignty risk more important than access to the broad capabilities of a hyperscaler. Its high technical maturity allowed it to leave the public cloud and substantially lower infrastructure costs. In return, it accepted lower potential capability, particularly in service breadth, elasticity, and frontier adoption, capabilities its business did not require.
• DeepL is an AI company competing globally in machine translation and language technology. The rise of LLMs shifted the technological baseline, making access to massive compute, rapid scaling, and frontier infrastructure increasingly important. Its strategic requirements therefore pushed capability higher in the Calculus. DeepL expanded beyond its European infrastructure to AWS to achieve global scale, low latency, and real time performance, accepting greater vendor dependency, regulatory exposure, and kill switch exposure in return.
• Parloa is an AI company building conversational agents for global enterprises. Its strategic requirements prioritize international growth and frontier capability, while its high technical maturity allows its platform to evolve as AI workloads and the technological baseline change. Rather than using that maturity primarily to minimize dependency, Parloa accepts greater kill switch exposure and external dependency to access the technologies and infrastructure needed to compete and scale globally.
• Sennheiser is a global audio technology company increasingly connecting its physical products with digital services. For cloud based capabilities such as centralized device management, its strategic requirements prioritize global availability, scalability, and speed of delivery over owning every layer of the underlying infrastructure. Sennheiser therefore uses cloud based capabilities for parts of its digital portfolio, accepting greater external dependency rather than recreating those capabilities internally.
• The German Chancellery needs to move a limited number of sensitive physical documents securely between offices. Its narrow strategic requirements prioritize lowest possible risk, while requiring only very limited technological capability. Its pneumatic tube system meets exactly that profile, moving around 1,000 documents per month across 36 stations for roughly €15,000 annually and being retained specifically for sensitive documents that cannot be transmitted electronically or by courier. In return, it accepts extremely limited capability, which is irrelevant because the use case requires little more than highly secure document transport.

These are not contradictory strategies. They are different positions in the same triangle. Technical maturity expands the positions available, while strategic requirements determine which of those positions actually make sense.

The Calculus Applies In Macro, too

As the first chapter showed, the global technology stack keeps expanding, with new layers building on everything that came before. Since its emergence, nations have faced essentially the same Calculus as organizations: they balance sovereignty risks against the cost and capabilities of the global stack, based on their strategic requirements and technical maturity. Different countries have arrived at very different positions.

• Europe largely chose to consume rather than replicating large parts of the global technology stack, relying heavily on US software and cloud platforms and Asian semiconductor supply chains. This created substantial dependencies, but also avoided enormous investments while giving European companies and consumers access to world leading technological capabilities.
• China pursued broader technological risk mitigation investing heavily in replicating large parts of the US led technology stack, from social media and cloud infrastructure to software and AI. This required enormous investment and meant accepting weaker capabilities while domestic alternatives catch up, but it reduced exposure to foreign regulation, export controls and potential denial of access.
• Taiwan followed a another sovereignty strategy concentrating its resources and technical maturity on a narrow but extraordinarily valuable part of the tech stack: advanced semiconductor manufacturing. Companies such as TSMC became indispensable nodes in a global supply mesh while Taiwan continued sourcing technologies, equipment, software, materials and markets internationally combining a very specific way of risk mitigation with hugely profitable business models.
• The United States has prioritized maintaining technological leadership, including through the current AI platform shift. That means accepting extraordinary investment requirements to lead the AI frontier and the strategic leverage that comes with controlling it. Stargate alone targets $500 billion of US AI infrastructure investment, explicitly framed around securing American AI leadership and strategic capability.

These strategies look fundamentally different because their strategic requirements and their capital endowments are different. Yet all follow the thought model of Sovereignty Calculus, making different trade offs between risk, cost, and capability in pursuit of different strategic goals.

But how can organizations turn this Calculus into practical sovereignty improvements without making mitigation prohibitively expensive? See the next chapter.