Organizations are investing heavily in AI and digital sovereignty. New Nordic data suggests many are still missing some of the conditions those investments depend on.
Years ago, I watched a steering committee approve a blockchain pilot. The business case was compelling, but its central premise had never been tested.
The use case concerned automated payments to well-drilling suppliers. The company processed thousands of paper invoices each year. Matching them was manual, and payment disputes could drag on for months. Smart contracts promised to settle invoices automatically once delivery had been confirmed. The logic was sound, and the potential savings were real.
The committee did exactly what a steering committee is trained to do. It asked what the pilot would cost.
It asked how long it would take. It asked what happened if it failed, and who owned the vendor relationship. Every question received a competent answer.
Then the project started, and the assumptions underneath the business case began to surface.
Would the drilling suppliers participate? Was delivery confirmation captured in a form a smart contract could act on? Could the commercial terms be expressed as code at all, when every well had its own negotiated variations and nobody had documented them?
The list went on. None of these were technology problems; they were problems with the premise. The use case never scaled, and the pilot was eventually shelved.
The Premise Problem
Every investment decision rests on two layers, but governance processes often interrogate only one of them.
The first is the business case: cost, timeline, expected return and risk of failure. Boards and steering committees are extremely good at this. Decades of financial discipline have produced people who can dismantle a spreadsheet in minutes.
The second is the technical premise: the conditions that must hold in your own environment before the business case means anything. The data must exist and be accessible. Counterparties must be willing to participate. The process being automated must be stable enough to encode.
A weak business case may still produce a poor return. A weak premise is more serious because it can prevent the intended outcome from happening at all.
I call this the premise problem, and it is not a failure of intelligence. Nobody in that steering committee was out of their depth. They asked their questions well. The question that would have stopped the project early was simply not on anyone's list, because it was not anyone's job.
The Problem, Measured
Until recently, I could only argue this from experience. New Nordic survey data makes the pattern easier to see.
Vivicta’s new Nordic Digital Sovereignty Survey covered 320 senior decision makers in Norway, Sweden and Finland. It found that 70 percent expect sovereignty investment to increase over the next twelve months.
In the same population, only 29 percent strongly agree that they have sufficient control over their critical data, and only 46 percent have a formal sovereignty strategy in place.
Figure 1. The sovereignty premise gap: investment ambition is moving faster than strategic and operational control.
Read those three figures together and the premise problem becomes visible at regional scale: a large majority is preparing to spend, while a much smaller group strongly agrees that it controls the critical data on which that spending depends.
Sovereignty investment presumes that you know where your critical data sits, who can reach it, and which contractual and jurisdictional claims apply. The survey suggests that many organisations are still unsure about those basics. In that case, the investment is not yet fully grounded. It is a bet on an assumption that may not have been tested.
How the Dependencies Got There
The survey also asked what stands in the way. The leading barrier, named by 28 percent, is dependence on cloud services and third-party providers.
Those dependencies are cumulative. Each decision passed governance with a business case, while its assumptions about portability, exit and control often received less scrutiny.
Today’s sovereignty barriers are the accumulated residue of yesterday’s untested premises. Organisations now working to regain control are absorbing the consequences of decisions that appeared sound when they were made.
Governance that only evaluates returns will keep producing constraints it never chose.
Why This Has Become More Expensive
Technology decisions have moved higher on board agendas in recent years. AI investment now demands senior oversight. Security and resilience regulation has increased directors’ accountability. The energy transition adds technology dependencies that may last for decades.
Board composition has not always kept pace. Most boards I encounter have formidable finance, legal and operational depth, with technology expertise concentrated in one director or adviser. They can take a business case apart, but they often lack a repeatable mechanism for testing the assumptions beneath it.
AI sharpens the premise problem. More than a quarter of survey respondents, 27 percent, name AI, data usage and decision-making control as a primary sovereignty concern. Yet AI investment cases still rely on premises about data access, data quality and model governance that are frequently assumed rather than verified.
Why the Doubt Does Not Surface
There is usually someone who knows. An architect, an operations lead, someone who has seen the estate up close and can tell the premise does not hold. That person is rarely in the room. When they are, they face an asymmetry that makes speaking up irrational.
The proposal arrives armed with vendor analysis, consultant validation and an internal sponsor who has already staked their reputation on it.
The objection arrives alone, carried by one person’s judgement.
That judgement is difficult to benchmark. Raised once, it reads as diligence. Raised twice, it can read as obstruction.
Organisations become better at approving than at pausing. Nobody designs them that way. It happens because only one side is expected to carry the burden of proof.
Evidence usually arrives with the yes. The person saying not yet is often taking a career risk.
What Actually Closes the Gap
I do not think the answer is simply to add more technologists to boards. A single domain expert can create deference rather than scrutiny: others lean on the specialist, while the specialist still brings their own assumptions and blind spots.
What closes the gap is a clear premise test led by someone who is not invested in getting the proposal approved. Before approval, ask three questions:
- What has to be true in our environment for this to work? Not in general. In our estate, with our data, our counterparties, our operating constraints.
- Who has verified each of those conditions, and how? Vendor assertion is not verification. Neither is a reference customer in a different industry.
- What would we expect to see in the first ninety days if the premise were wrong? If nobody can answer this, the programme has no early exit.
Figure 2. A simple premise test: establish the conditions, verify them independently and define an early exit signal.
None of these require technical depth to ask. They require someone whose role is to ask them, and whose incentives are not attached to the answer.
The Real Question
Blockchain is a useful example now because the hype cycle has moved on and its failed pilots can be discussed with greater distance.
The uncomfortable part is that the same governance pattern is now being applied to AI and sovereignty at considerably greater scale in boardrooms across the Nordics. Seventy percent expect sovereignty investment to increase, while only 29 percent strongly agree that they have sufficient control over their critical data.
There is a simpler question for the board or executive committee. Are we testing whether these investments can work, or only whether they would be valuable if they did?
Have you seen an investment approved on a premise that failed in the first few months of delivery? What signal could have helped the organisation pause earlier?
These findings come from The State of Digital Sovereignty in the Nordics, published by Vivicta this week.