Sovereign AI Dependency Persists Even Among Global Tech Leaders

Key Takeaways

Forrester’s Global Sovereignty Forecast, covering 2025 through 2030, concludes that no nation is on a realistic path to full technology independence, and that the practical question facing governments and enterprises alike is not whether to depend on external AI providers but how to manage that dependency deliberately [1][2]. Even the two highest-scoring countries in Forrester’s index, China and the United States, register technology sovereignty scores of 82 percent and 79 percent respectively, while the twelve other economies assessed average only 39 percent in 2025 and are forecast to improve by just one percentage point, to 40 percent, by 2030 [2][3]. For security and risk leaders, we read this forecast as reinforcing a pattern CSA’s own research has been tracking since mid-2026: enterprise AI concentration risk and national AI sovereignty risk appear to be two facets of the same structural dynamic, and organizations that wait for governments to resolve it risk being exposed regardless of where they are headquartered [4][5].

Background

Forrester published its Global Sovereignty Forecast in July 2026, the product of an index that scores fourteen countries across nine dimensions of technological capability: government AI investment, cloud sovereignty, technology workforce availability, AI model development, data center capacity relative to technology spending, data center autonomy, semiconductor production, software creation, and rare earths processing [1][2]. The index was built to answer a question that has moved rapidly from academic policy circles into corporate boardrooms over the past two years, namely how exposed a country, and by extension the enterprises operating within it, is to disruption in a foreign-controlled technology supply chain. Forrester principal analyst Dario Maisto, who led the research, frames the finding bluntly: “Tech sovereignty is concentrated in the hands of a few global leaders, creating an uneven competitive advantage for some countries” [2].

The scores themselves illustrate how narrow the field of genuine leaders is. China leads the index at 82 percent and the United States follows at 79 percent, reflecting both countries’ end-to-end strength across cloud infrastructure, frontier AI model development, semiconductor design and fabrication, domestic tech talent pools, and data center capacity [1][3]. Every other country in the study trails by a wide margin, and Forrester’s own coverage of the report frames the takeaway plainly: most nations risk becoming, in effect, permanent AI dependents of the United States or China, with the twelve non-leading countries averaging only 39 percent sovereignty in 2025 and barely moving by 2030 [3]. The table below shows how that trajectory plays out for the strongest of the remaining economies, each still rising only a few percentage points over the five-year window.

South Korea and Japan, the strongest of this group, are driven substantially by semiconductor investment, while the United Kingdom and Italy trail further still, remaining in the high twenties to low thirties throughout the forecast window [3].

Semiconductor production is one dimension where the forecast shows meaningful convergence, and it illustrates why capital investment alone cannot buy sovereignty on a short timeline. As the table below shows, the United States and South Korea are projected to follow an identical path from 45 percent to 79 percent sovereignty in semiconductors by 2030, while Japan, China, and India start from further behind and close only part of the gap [2].

These gains are real, but they still leave the chip supply chain concentrated among a handful of firms and jurisdictions, a vulnerability CSA’s own research has separately documented in the context of enterprise AI infrastructure, where approximately 63 percent of global cloud spending sits with three hyperscale providers and foundation models trace back to an even smaller set of developers [4].

Forrester’s recommended response is not a call for nations, or enterprises, to attempt self-sufficiency. Instead, the report advises organizations to ask three structuring questions: which workloads would create unacceptable risk if externally controlled, where single-provider or single-jurisdiction dependencies exist today, and what viable alternatives would exist if those dependencies became problematic [1]. Maisto and Forrester VP and principal analyst Martha Bennett recommend that enterprises pursue hybrid architectures, evaluate sovereign cloud offerings, invest in open-source alternatives where feasible, and build multivendor strategies rather than betting on any single geopolitical outcome [1].

Security Analysis

The Forrester forecast, while measuring a different unit of analysis, national capability rather than enterprise vendor dependence, points toward a conclusion consistent with the structural risk picture CSA’s AI Safety Initiative has been building over the preceding several months through its own research into hyperscaler and frontier-model concentration. Both bodies of work describe related dimensions of the same concentrated technology market, one from a national vantage point and one from an enterprise vantage point.

One of the most direct security implications is that vendor and jurisdiction selection has become an increasingly geopolitical decision, not merely a procurement one. Maisto notes that increased dependence on foreign AI vendors creates “a problem for data appropriability and IP defensibility,” and that choosing a model or provider now functions as an implicit political signal, since “by choosing one model or the other, an organization might signal political closeness” to Washington or Beijing [3]. He further warns that vendor choices will increasingly be shaped by the prospect of retaliatory measures, where a country restricts access to its technology in response to a rival’s procurement decisions elsewhere [3]. Enterprises operating across borders, and particularly multinationals with government or regulated-sector customers, now have to model geopolitical retaliation risk alongside the more conventional vendor-outage and data-breach risks that have historically dominated third-party risk assessments.

This dynamic compounds the concentration risk CSA has already documented at the enterprise layer. Three cloud providers, Amazon Web Services, Microsoft Azure, and Google Cloud, controlled approximately 63 percent of global cloud infrastructure spending in early 2026, while the foundation models running on top of that infrastructure trace to an even narrower set of developers, principally OpenAI, Anthropic, Google DeepMind, and Meta AI [4]. Forrester’s country-level dependency data helps explain part of why that narrow provider base is unlikely to widen quickly: building a domestic government-backed alternative requires sustained investment across at least nine interdependent capability dimensions simultaneously, from workforce training to data center construction to semiconductor fabrication, though commercial dynamics specific to the enterprise cloud and model markets, such as capital costs and network effects, also play a role. Even well-resourced governments are seeing only marginal aggregate improvement over a five-year window [2][3]. For a chief information security officer, this suggests that the assumption that “the market will diversify and reduce our single-vendor exposure” should not be treated as a safe planning premise for 2030, let alone 2027.

The regulatory dimension adds further complexity. CSA’s analysis of the European Union’s proposed Cloud and AI Development Act (CADA) documents how the EU is responding to precisely the dependency gap Forrester quantifies, by building a four-tier sovereignty assurance framework tied to public-sector procurement mandates, with the strictest tier requiring EU ownership, EU-citizen personnel in privileged roles, and freedom from third-country legal compulsion such as the U.S. CLOUD Act [5]. The EU’s own numbers underline the scale of the gap CADA is trying to close: non-EU hyperscalers control roughly 80 percent of professional cloud spending in the bloc, and the EU-headquartered share of its own cloud market fell from approximately 29 percent in 2017 to about 15 percent as of the source’s publication [5]. Forrester’s forecast that Germany, France, and Spain will only reach 35 to 36 percent overall technology sovereignty by 2030 is consistent with the trajectory that appears to be motivating Brussels’ shift toward procurement law rather than reliance on market forces [3][5]. Security and compliance leaders operating in or selling into the EU should read the Forrester forecast and CADA’s tiering mechanism as two views of a single, multi-year sovereignty compliance obligation rather than as separate initiatives.

Finally, the forecast has implications for operational resilience planning that extend beyond geopolitics into everyday availability risk. A market this concentrated is also a market where a single provider’s outage, policy change, or export-control designation has outsized blast radius. CSA’s research into hyperscaler concentration has already cataloged multiple multi-hour cloud outages in 2025 alone, underscoring how a market this concentrated carries outsized blast radius when a single provider is disrupted [4]. Because Forrester’s data shows most nations lack a credible domestic fallback across cloud, compute, and model layers simultaneously, enterprises in those countries should not assume that a national “Plan B” will exist if their primary provider becomes unavailable or is withdrawn for regulatory reasons; the contingency planning burden falls almost entirely on the enterprise itself.

Recommendations

Immediate Actions

Security and risk leaders should begin by mapping which AI and cloud workloads depend on a single provider headquartered in a single jurisdiction, distinguishing workloads where that concentration is merely inconvenient from those where it would be unacceptable if disrupted, following the same triage logic Forrester recommends at the national level [1]. Organizations with government, defense, financial services, or critical-infrastructure customers should specifically flag any AI workload whose disruption could trigger contractual, regulatory, or national-security consequences, since these are the workloads most likely to draw sovereignty-related scrutiny from regulators in the near term. Compliance teams operating in the EU should also begin tracking CADA’s legislative progress now, since sovereignty risk assessment obligations are expected to phase in within roughly a year of the act’s enactment [5].

Short-Term Mitigations

Enterprises should treat multivendor and multi-jurisdiction architecture as a resilience investment rather than a redundant cost, building in abstraction layers, portable data formats, and tested exit paths that allow a workload to move between providers or regions without a ground-up rebuild. Forrester’s recommendation to evaluate sovereign cloud offerings and open-source alternatives should be paired with the due-diligence discipline CSA’s own research has documented: “sovereign cloud” and similar marketing claims should be validated against concrete criteria, such as ownership structure, key custody, personnel citizenship, and freedom from third-country legal process, rather than accepted at face value [4][5]. Contract renegotiation cycles are a practical point at which to insert these requirements, since most enterprises will touch their major cloud and AI vendor agreements at least once before 2030.

Strategic Considerations

Over a multi-year horizon, boards and executive leadership should accept Forrester’s central conclusion as a planning premise rather than a temporary condition: for all but a small number of countries, meaningful reduction in foreign AI dependency is not achievable within this decade, and strategy should be built around managing that dependency rather than eliminating it [1][3]. This argues for elevating AI vendor concentration risk to the same governance tier as other systemic third-party risks, with regular board-level reporting, documented contingency plans for provider loss or export-control action, and explicit consideration of how geopolitical retaliation risk factors into vendor selection for regulated or government-facing business lines. Organizations should also expect this pressure to intensify rather than ease, as more jurisdictions follow the EU’s lead in converting sovereignty concerns into binding procurement law.

CSA Resource Alignment

This forecast connects directly to CSA’s own body of research on AI concentration risk, published over the months immediately preceding this note. CSA’s “AI Developer Ecosystem Concentration: Critical Infrastructure’s Hidden Risk” documents the enterprise-side mirror of Forrester’s national sovereignty data, quantifying how approximately 63 percent of global cloud infrastructure spending and the large majority of frontier model development sit with a small number of U.S.-headquartered organizations, and framing that concentration as a systemic risk requiring board-level attention rather than a routine vendor-management matter [4]. Readers of this research note should treat that paper as the enterprise-risk counterpart to Forrester’s country-level scoring: Forrester explains why so few nations can offer a credible alternative, and CSA’s concentration research explains what that means for any single enterprise’s resilience planning.

CSA’s “EU Tech Sovereignty: Cloud Concentration Risk and the Compliance Cascade” provides the clearest existing CSA guidance on the regulatory response to the dependency gap Forrester measures, walking through the EU’s proposed Cloud and AI Development Act, its four-tier sovereignty assurance framework, and how it interacts with the existing GDPR, NIS2, DORA, and EU AI Act obligations that multinational enterprises already carry [5]. Organizations operating in or selling into Europe should read this note as pre-compliance planning guidance for a regulatory regime that Forrester’s forecast suggests will only become more consequential as the EU’s underlying sovereignty scores improve slowly over the coming five years.

Finally, organizations building or maturing governance programs in response to these findings should anchor that work in CSA’s AI Controls Matrix (AICM) v1.1, which provides 247 vendor-neutral control objectives across 18 security domains, including AI supply chain security and shared responsibility between model providers, cloud service providers, and AI customers [6]. AICM’s shared-responsibility model gives security teams a structured way to document exactly which sovereignty and concentration risks are contractually owned by a provider and which remain the enterprise’s own, a distinction Forrester’s forecast makes clear will not be resolved by market forces alone in the near term.

References

[1] Maisto, Dario. “What You Need To Know From Forrester’s Global Sovereignty Forecast, 2025 To 2030.” Forrester Blogs, July 2026.

[2] Forrester. “Forrester Global Sovereignty Forecast: Despite Rising Geopolitical Tensions, Technology Sovereignty Will Advance Slowly Through 2030.” Forrester Press Newsroom, July 2026.

[3] The Deep View. “Most Nations Risk Becoming AI Dependents.” The Deep View, July 2026.

[4] Cloud Security Alliance AI Safety Initiative. “AI Developer Ecosystem Concentration: Critical Infrastructure’s Hidden Risk.” CSA Lab Space, May 2026.

[5] Cloud Security Alliance AI Safety Initiative. “EU Tech Sovereignty: Cloud Concentration Risk and the Compliance Cascade.” CSA Lab Space, June 2026.

[6] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, June 2026.