Digital sovereignty in Saudi Arabia is no longer just about where data is stored. It is now about who controls the infrastructure, models, operations, keys, and digital supply chains when conditions change.
That question dominated an IBM roundtable on digital sovereignty in the Kingdom, as Saudi Arabia accelerates the digital agenda of Vision 2030 and raises its ambitions in artificial intelligence, cloud infrastructure, operational resilience, and governance.
A gap between awareness and readiness
IBM says Saudi market findings show that 90% of Saudi executives believe AI sovereignty should be part of their business strategy in 2026. But the discussion pointed to a much lower level of actual readiness, with participants saying only “two to three out of every 10” clients in the Kingdom are adequately prepared.
Ayman AlRashed, IBM’s regional vice president in Saudi Arabia, said the debate is no longer theoretical or something to postpone. It is “a discussion happening today,” he said.
The gap, he said, is not about awareness. It is about the distance between believing sovereignty belongs in strategy and having the ability to execute it. Many organizations, he added, still approach sovereignty in traditional terms, asking “where is the data?” and “where is the computing?” even as the issue has become far wider.
A Saudi study by the IBM Institute for Business Value found that 63% of Saudi leaders are concerned about reliance on specific regions for computing resources, above the global average. Another 85% believe geopolitical and economic issues threaten technology investments.
At the same time, 73% of Saudi leaders believe that geopolitical volatility could create new business opportunities in 2026 if organizations adapt.
Sovereignty is not just location
During the session, attended by Asharq Al-Awsat, Sabine Holl, IBM’s vice president of technical sales and chief technology officer for the Middle East and Africa, said sovereignty has moved from a regulatory demand to a strategic priority.
Holl said the debate began with data sovereignty, whether data was located inside or outside the country. But recent events, including data center outages and geopolitical tensions, have shown that location alone does not guarantee control.
Digital sovereignty, she said, is now tied to control over data, infrastructure and technology development.
IBM divides the concept into four pillars: operational sovereignty, data sovereignty, technology sovereignty and AI sovereignty. In that sense, sovereignty is no longer merely compliance with local data-residency rules. It is the continuing ability to know who can access systems, who manages the environment, where models run and how an organization can prove compliance when needed.
Holl put it plainly: Sovereignty is not just about location.
The question, she said, is not only whether data is stored in a local data center. It is who can control it, under which identity it can be decrypted and whether the organization has a recovery and operating plan if a regional outage or sudden crisis hits.
AI complicates the equation
AI makes the issue harder. Models and agents do not simply store or read data. They can access multiple sources, interpret information, suggest decisions or take action inside an organization’s systems.
That changes the sovereignty question. Does an organization control only where its data sits, or does it also control what AI does with that data?
That explains IBM’s focus on what it calls a new operating model for AI. The company says organizations advancing in AI are not merely deploying more tools. They are redesigning how they work. IBM says the model rests on four connected systems: agents, data, automation and hybrid.
In this context, IBM announced the next generation of Watsonx Orchestrate to coordinate and manage AI agents across different environments, along with capabilities linked to real-time data through Confluent, watsonx.data, IBM Concert for intelligent operations and IBM Sovereign Core for operational sovereignty.
During the session, Asharq Al-Awsat asked whether sovereignty becomes harder when agents enter enterprise workflows, because data is no longer only stored, but also used, interpreted and acted upon.
Holl said organizations now face a reality in which agents are spreading “everywhere,” inside their own environments and on other platforms, making “supervision” and auditability essential. She said part of IBM’s operating model includes what she described as an “agent control layer” to manage and monitor those agents.
From cloud to operational sovereignty
IBM sees a hybrid cloud strategy as central to building sovereignty.
Holl said cloud changed how sovereignty is viewed, especially in the Middle East and Africa, where laws and requirements on data access and use emerged early. That helped shape IBM’s hybrid cloud strategy, she said, so that the benefits of cloud are not limited to public environments, but can also apply to private clouds and on-premises systems.
The “promise of cloud,” built on the idea that everything would move to the cloud, has not fully materialized, Holl said. Many organizations still operate across hybrid and multi-cloud environments without sufficient transparency or clear audit and control capabilities.
If an organization cannot answer “at the push of a button” where systems are running, who controls them and whether they comply with requirements, then it is not truly sovereign, she said.
IBM calls this “sovereignty by design.”
Holl said an existing environment cannot simply be patched later to become sovereign. She compared it to a small boat on a lake, saying it cannot simply be repaired into a ship capable of crossing an ocean and facing a storm.
In practice, that means sovereignty must be built into the architecture from the start, through portability, choice, open platforms, recovery plans and control over keys and identities.
Turning sovereignty into operations
IBM says IBM Sovereign Core is designed to operationalize and verify digital sovereignty, rather than just a written policy.
The company describes it as a platform that helps governments, organizations and service providers build AI-ready sovereign environments, with the ability to prove control and compliance across hybrid settings.
Dinesh Nirmal, senior vice president, products, software at IBM, said AI has made sovereignty “a runtime requirement, not a policy statement.”
AlRashed said that as AI becomes part of institutional and national strategies, organizations need to innovate “without compromising operational authority, trust or regulatory requirements.”
The platform includes a customer-managed control layer, identity services, encryption, data within sovereign boundaries, continuous compliance monitoring, automated audit evidence, prebuilt regulatory frameworks and controlled deployment of AI models, inference and agents within defined sovereign limits.
It also relies on open technologies, including Red Hat OpenShift and Red Hat AI, and supports a partner ecosystem that includes AMD, Dell, Mistral, MongoDB and Palo Alto Networks.
Holl said the point is not that every organization must build a local server or chip. It is that organizations must be able to choose and move between components and environments when conditions change.
Shortages of graphics processing units, memory and chips could become a sovereignty risk, she said, if an organization is locked into one supplier or an architecture it cannot replace.
Resilience is part of sovereignty
A key theme in the discussion was that sovereignty cannot be separated from operational resilience. An organization that cannot recover from an outage, cyberattack or geopolitical crisis does not, in practice, have the control it believes it has.
Holl said some backup and disaster recovery strategies failed because they were not seriously tested or treated as an operational necessity rather than a useful option.
In Saudi Arabia, the issue is gaining weight as digital transformation expands across sensitive sectors, including government, energy, finance, telecommunications and health care.
Participants said some entities, especially government bodies, are no longer just waiting for policies to be completed. They are moving practically to shift workloads to sovereign providers, or to ensure that those managing environments are located inside the Kingdom.
Sovereignty and human skills
The discussion was not limited to technology. AlRashed linked digital sovereignty to people, saying AI cannot deliver value without skills and trust in systems.
“Human skills are the currency of the AI economy,” he said. Some organizations, he added, deploy AI but fail to achieve the expected value because users lack the confidence or ability to benefit from it.
That adds another layer to the Saudi debate. Sovereignty is not only about who owns the data center or cloud platform. It is also about who operates it, who understands the risks, who can prove compliance and who can change course when rules, markets or threats shift.
In IBM’s 2026 trends report, 88% of Saudi executives said agentic AI helps them make better, faster decisions during disruption.
But that optimism creates a parallel challenge. The more agents can support decisions or carry out tasks, the greater the need for clear governance, auditing, lifecycle management for models and agents and the ability to stop or adjust what is not working as required.
A Saudi model taking shape
Saudi Arabia appears to occupy a distinct place in this debate. Holl described it as an example of a market building local data centers and working with global cloud providers to bring technology into the country, allowing innovation within local regulatory frameworks.
At the same time, the figures show that concern about external dependence on computing, chips and global providers is greater than the global average.
The debate, then, is not about choosing between full isolation and full openness. It is about building a model that balances access to global innovation with local control, the ability to prove compliance and the operation of AI within clear boundaries.
In this context, digital sovereignty becomes part of the operating architecture of the digital economy, not just a legal clause or regulatory requirement.
As AI moves from pilots to operations, and from models to agents, the question raised by the session becomes more urgent for Saudi organizations: Do they merely have data inside their borders, or do they have full control over what happens to that data, who uses it, how models and agents operate on it and what happens when conditions change?
