The AI overconfidence gap is a proof problem for CxOs who sign vendor AI deals. IBM’s Digital Sovereignty Index, Proof, Not Promises, finds that an average of 82% of respondents are very or extremely confident they can evidence sovereign control, while only 26% reach the Leading tier, and AI-related issues are the top sovereignty challenge at 44%. Buyers should require proof of accountability, traceability, intervention, and switching.
Updated November 11, 2026
Key Takeaways
- 82% of respondents are very or extremely confident they can evidence control; 26% Leading.
- AI-related issues were the most common sovereignty challenge, at 44%.
- 94% faced at least one sovereignty challenge; 81% affected had to provide formal evidence of control.
- Leading tier: 52% resolved their most testing challenge without material disruption.
What does the AI overconfidence gap mean for CxOs?
IBM’s November 11, 2026 release, carried by Cision PR Newswire, surveyed 2,003 senior decision-makers in the United States, United Kingdom, Germany, France, Saudi Arabia, India, and Japan. Of enterprises surveyed, 94% faced at least one sovereignty challenge in the last three years, and 81% of those affected had to provide formal evidence of control to regulators, customers, auditors, or internal stakeholders.
Jonathan Adashek, IBM Senior Vice President and Chief Global Affairs Officer, said: “The next step is not simply more governance or regulation. It is stronger evidence that the governance works: testing exit capabilities, understanding critical dependencies and focusing efforts where a loss of control would have the greatest impact.”
Which proofs belong in an AI contract?
The Index measures reported evidence of control across six dimensions of AI, technology, operations, and data. Read as a buyer’s checklist, not an IBM clause form:
- Responsibility: prove who was accountable.
- Traceability: show exactly what happened.
- Constraint: prove controls were working.
- Intervention: show how the organization responded and recovered.
- Legitimacy: explain and justify decisions under scrutiny.
- Exit: prove you could change provider or recover operations.
AI-related issues, including incorrect outputs, explainability problems, model or provider failures, and governance concerns, were the most common challenge at 44%. They ranked ahead of formal audit or regulatory events (38%), significant provider changes (35%), data-access or transfer issues (33%), and government restrictions (30%). Emmanuel Frenehard, Chief Digital Officer at Sanofi, said digital sovereignty “is not a compliance checkbox, it’s a business reality.”
How do tested organizations compare?
Only 33% of respondents test their ability to demonstrate sovereignty continuously or as part of regular governance. Confidence and that testing rate are separate findings. The Index measures reported evidence of control across the six dimensions.
| Evidence standard | Share |
|---|---|
| Very or extremely confident they can evidence control | 82% |
| Leading Digital Sovereignty tier | 26% |
| Test continuously or in regular governance | 33% |
| Leading enterprises testing regularly or continuously | 63% |
| Still establishing evidence, same testing cadence | 29% |
| Earliest stage, testing regularly or continuously | 9% |
| Leading tier, no material disruption | 52% |
| Establishing enterprises, same outcome | 22% |
Leading enterprises were more than twice as likely to resolve their most testing challenge without material disruption (52% versus 22% of establishing enterprises). Barriers included manual or time-consuming evidence collection (56%); fragmented evidence, dependence on third parties for records, and legacy systems or inconsistent standards (each 53%); and untested controls, recovery, or exit arrangements (50%).
What do the UK figures measure?
Technology Magazine does not report the same global split. It finds 84% of UK leaders express confidence in AI accountability, while only 22% have demonstrated that control through audits, regulatory reviews, or operational testing. AI scored 70 out of 100, behind data (81), operations (80), and foundational technology (79).
The UK ranked third at 77, behind India (79) and the United States (78), above a global average of 74. Leon Butler, CEO of IBM UK and Ireland, said: “Real digital sovereignty means having the freedom to adapt, respond and change course without losing control.” He urged “sovereign-by-design strategies that embed openness, interoperability and flexibility from the outset.”
Across surveyed markets, the magazine reports that only 32% of executives can provide strong evidence that their governance works under real-world pressure. UK respondents meet the Leading standard at 32%, versus 26% globally, and 39% regularly stress-test, versus 33%. The contracting point matches AI supplier due diligence and any review of whether to block external AI agents.
Frequently asked questions
What is the AI overconfidence gap?
IBM’s Digital Sovereignty Index describes an overconfidence gap: an average of 82% of respondents are very or extremely confident they can evidence sovereign control, but only 26% reached the Leading tier.
How often have enterprises already had to prove control?
Of enterprises surveyed, 94% faced at least one sovereignty challenge in the last three years, and 81% of those affected had to provide formal evidence of control to regulators, customers, auditors, or internal stakeholders.
Why is AI the main sovereignty stress test?
AI-related issues, including incorrect outputs, explainability problems, model or provider failures, and governance concerns, were the most common sovereignty challenge at 44%, ahead of formal audit or regulatory events, provider changes, data-access issues, and government restrictions.
Does stronger proof change disruption outcomes?
Enterprises in the Leading tier were more than twice as likely to resolve their most testing sovereignty challenge without material disruption, at 52%, compared with 22% of establishing enterprises.
