Drupal AI・6 min read # The digital sovereignty questionnaire ![Digital sovereignty ](/sites/default/files/2026-09/Digital-sovereignty-in-2026_-Knowing-what-must-stay-under-your-control.png) Table of contents - [What it measures, and why this layer](#what-it-measures-and-why-this-layer) - [The eight dimensions of the self-assessment form (questionnaire)](#the-eight-dimensions-of-the-self-assessment-form-questionnaire) - [How it is scored, in full](#how-it-is-scored-in-full) - [What this assessment will not tell you](#what-this-assessment-will-not-tell-you) - [Why the lowest link, not the average](#why-the-lowest-link-not-the-average) - [What to do with your score](#what-to-do-with-your-score) - [It takes 10 minutes](#it-takes-10-minutes) This is a ten-minute, 16-question self-check that scores how much real control your organization has over its data and its AI-enabled workflows. It **runs entirely in your browser and saves nothing anywhere. If you would rather just take it than read about it first, start here.** [Take the questionnaire](/digital-sovereignty-assessment) The rest of this piece explains what it measures, how it is scored, and why that scoring is a fair metric rather than a flattering one. If that matters to you before you spend ten minutes on it or keep reading. ## What it measures, and why this layer Most conversations about digital sovereignty are really about infrastructure. Where the data sits, which jurisdiction reaches it, whether a vendor can be compelled to hand it over. A lot of organizations have done serious work on those questions over the past few years. Residency is mapped, regions are named, contracts are in place. The ground floor is largely built. Once that is handled, it stops being the thing that determines whether you are actually in control. **The deciding factor moves up a layer, to the data and the AI-enabled workflows running on top of the infrastructure. That layer is far less measured, because it is newer and because the tools most teams own were built for the floor below it.** The reason it moved is AI. When a model touches your data, runs inference on your behalf, and takes actions inside a workflow, control stops being a question of storage and becomes a question of governance. Can you control which models reach your data, and what they may do with it? **If a provider changes its pricing or terms overnight, do your critical workflows keep running? When an AI-supported process produces a wrong output, can you trace which steps produced it and correct it? As machines take on more of the work, do your people still shape the outcomes, or are they signing off on output they cannot explain?** A team can map residency to the data centre and still lose control entirely the first time an AI agent writes to a system nobody is watching. That is the part the questionnaire is built to surface. [Take the questionnaire](/digital-sovereignty-assessment) ## The eight dimensions of the self-assessment form (questionnaire) The questionnaire runs 16 questions across 8 dimensions, two questions each. The dimensions split into two tiers. **Tier 1: the accepted ground.** Data residency and jurisdiction, operational and environmental control, technology choice and lock-in, and AI execution control. This is the infrastructure layer, the part most organizations have already invested in. **Tier 2: the frontier.** Data and content governance and readiness, workflow sovereignty, governance and evidence and observability, and human accountability and oversight. This is the data and workflow layer, the one that decides control in 2026. The approach takes its cue from the EU Cloud Sovereignty Framework, which scores sovereignty on a five-point scale across eight objectives rather than treating it as a yes or no. Where that framework focuses on how much EU jurisdictional control a cloud service offers, this questionnaire adapts the same idea into a broader question of how much governed, provable control you hold over your data and workflows, wherever they run. ## How it is scored, in full The scoring is published here in full, because a metric you cannot inspect is not one you should trust. Red Hat set that bar when it open-sourced the criteria behind its own sovereignty assessment, and it is the right bar. Here is exactly how this one works, with nothing held back. Every question is answered on the same 0 to 4 scale, and a score means the same thing on every question: - **0, No control.** The capability sits entirely outside your organization, with no visibility and no recourse. - **1, Contractual only.** Control exists on paper through vendor terms, but not in your own hands. - **2, Partial and inconsistent.** Some control exists, but it is uneven across teams and hard to prove. - **3, Governed and repeatable.** Control is deliberate, consistent, documented, and inspectable. - **4, Owned and portable.** Full operational control, evidenced, with the freedom to switch or exit without breaking critical operations. From those answers, the result is built in four steps: Each dimension score is the average of its two questions, rounded to the nearest level. Your overall level is the average of the eight dimension scores, rounded. The result then shows your single lowest dimension, flagged as the priority gap. And it shows the distance between your Tier 1 average and your Tier 2 average. There is no hidden weighting and no proprietary index doing quiet work in the background. The whole metric is those four moves on a transparent scale. ## What this assessment will not tell you A short self-check earns trust by being clear about its limits, so here are the honest ones. It is self-scored, which means it reflects how you read your own organization, and self-assessment tends to run optimistic, so treat a strong score as a prompt to verify rather than proof. It is a snapshot of 16 questions, not an audit, and it covers the data and workflow layer by design rather than the full sovereignty picture. The official EU framework also weighs supply-chain origin and environmental sustainability, which this assessment leaves aside to stay focused on the layer where AI is changing the questions fastest. It will point you to where your control is thinnest. It will not, on its own, tell you how to fix it. That is the starting point for a real conversation, not a substitute for one. ## Why the lowest link, not the average One scoring choice is worth explaining, because it is deliberate and it is what makes the metric fair rather than flattering. **The result leads with your lowest dimension, not your average.** It would be easy to average everything and let a respectable number stand in for control. Sovereignty does not behave that way. **The weakest critical link sets your real position, because the one workflow you cannot trace is the one that fails you under pressure. An average lets a few strong areas hide that link. Leading with the lowest dimension refuses to.** The Tier 1 versus Tier 2 distance is the second deliberate signal. The expectation built into the tool, based on where the industry has spent its attention, is that most organizations will score higher on Tier 1 and lower on Tier 2, because the infrastructure layer has had years of tooling, while the data and workflow layer is still new ground. The assessment is designed to reveal whether that pattern holds for you rather than to assert that it does. Where it does, the size of the gap is the clearest read you will get on where your real exposure sits. You also get a radar chart across all eight dimensions and a plain-language overall level, from Exposed through Partial and Governed up to Sovereign. The radar and the tier split are built to be shown to other people, so the result is something you can put in front of a leadership team or a board, not just a number for your own reference. ## What to do with your score A score is only useful if it points somewhere, so the result is built to be read as a starting position rather than a verdict. **Your lowest dimension is where to look first. It caps how much control you actually have, regardless of how strong the rest looks, so it is the most defensible place to spend the next unit of effort.** The Tier 1 versus Tier 2 gap tells you which kind of effort: a large gap usually means your next investment belongs in the data and workflow layer rather than in more infrastructure tooling you may already have covered. **From there, it becomes a roadmap question:** which gaps to close first and what each one takes. That is the work we do with clients at QED42, and if the data and workflow layer is where your gap sits, it is worth a conversation. Nothing about the questionnaire requires that. You can take the result, share it internally, and act on it on your own. ## It takes 10 minutes The form is private by design. Everything runs locally in your browser, and nothing is stored, sent, or saved. Add your organization and role for a little context on the result, or skip both fields and just see where you stand. [Take the digital sovereignty questionnaire](/digital-sovereignty-assessment) Written by Priyanka Jeph Content Design Lead