In the latest edition of its CIO Compass, Sopra Steria Next broadens the debate on AI sovereignty: it is not only about where data and models reside, but also about who controls the decisions they produce.

Paris, 20 October 2026 – Large organisations have spent a decade governing their data. They have given little or no thought to governing decision-making. Yet generative and agentic AI no longer simply makes recommendations: it prioritises, triggers and executes. In the latest edition of its CIO Compass, 'AI is nothing without control and purpose', Sopra Steria Next, the consulting arm of Sopra Steria, offers CIOs a nine-dimension framework for governing not only data, but also automated decisions and their consequences.

Key figures* from the report:

Fewer than 20% of AI-influenced or AI-executed decisions have an identified business owner, explicit rules and formal accountability.
Fewer than 25% of AI-driven decisions in production can be traced and replayed end-to-end.
An automated decision failure can affect 10 to 100 times more operations, customers or revenues than a traditional IT incident.

What is AI sovereignty?

It is not just a matter of knowing where data is hosted and where models run. It also covers the ability to demonstrate, at any moment, who controls, explains and arbitrates automated decisions. Vendor dependency has shifted from infrastructure to cognition, and that dependency is harder to reverse. With this publication, Sopra Steria Next calls on CIOs to make explicit a five-layer 'sovereignty stack', spanning data, models, platforms, APIs and decisions, with one question per layer: who operates it? Who can replace it? Who is accountable?

'The new question we now have to ask concerns decisions that AI has already taken without anyone being accountable for them,' says Valérie Thiblet, Partner Data & AI, Sopra Steria Next. 'A system that cannot be stopped in real time is not governed: it is merely observed. And what cannot be governed cannot be industrialised.'

The document identifies several breaking points for IT departments: the rise of Shadow AI, which erodes traceability and cost control before leaders are even aware of it; model governance, still treated as an optional layer; and the AI Act, where the main risk will not be deliberate non-compliance but accidental non-compliance through lack of preparation. As a member of the AI Pact, Sopra Steria applied the regulation to its own activities ahead of schedule and now supports several major European clients, notably in banking and logistics, with their compliance programmes.

With this publication, Sopra Steria Next uses the CIO Compass to put forward a nine-dimension framework for assessing current capabilities and building a Data & AI strategy, and highlights a role set to become a fixture of organisation charts: the Chief Data & AI Officer, who arbitrates between speed and control, innovation and sovereignty, compliance and performance. It is not a consensus-seeking role. It exists to make accountability explicit.

'AI is nothing without control and purpose' is available to download here.

Key takeaways

Sopra Steria Next publishes 'AI is nothing without control and purpose', the latest edition of its CIO Compass series, focusing on the governance of data, decisions and sovereign AI.
With this report, Sopra Steria Next stresses that AI sovereignty is not just about hosting. It also covers control over decisions: who explains them, who arbitrates them and who answers for them. Vendor dependency has shifted from infrastructure to cognition.
Sopra Steria Next offers a nine-dimension framework for assessing current capabilities and building a governable Data & AI strategy, from pilot to deployment.