3rd Party Risk Management
,
Artificial Intelligence & Machine Learning
,
Cyberwarfare / Nation-State Attacks
Experts on How CIOs Can Avoid ‘Geopolitical Lock-In’ in AI, Cloud and Supply Chains
It’s not surprising in today’s world to wake up to news of dramatic changes in the geopolitical climate, of protests erupting overnight that could destabilize governments, or of nation-state actors launching cyberattacks. Geopolitical instability is a part of reality in 2026, and the stakes are high for CIOs who must rely on global supply chains to develop IT, artificial intelligence, cloud and cybersecurity strategies.
See Also: Proof of Concept: Bot or Buyer? Identity Crisis in Retail
Assumptions of stability that underpinned IT strategy no longer hold, according to experts, and CIOs need to take a more strategic, risk-aware role when it comes to navigating this uncertain landscape. AI acceleration, cloud concentration and global digital supply chains must be approached strategically and with a plan for what happens when international systems create risk or threaten operations.
“The world has changed immeasurably over the last five years,” said Sean Joyce, global cybersecurity and privacy leader at PwC U.S. “We’ve gone from talking about the balkanization of the internet to a time where your IT strategy, and specifically your technology strategy, really has to take into consideration the geopolitical risk your organization is facing – especially for multinationals.”
While tech leaders knew AI would usher in innovation, opportunity and corresponding risk, many regulators expected to help develop frameworks and guardrails to manage those risks, said JoAnn Stonier, president at The Cantellus Group, an AI and emerging technologies consulting firm. “What we didn’t know is that the table that the game board was going to be on might also be rocky too,” Stonier said.
In this climate, CIOs need to think differently about how they’re making technology investments, and geopolitical risk should be added to the decision matrix. They need to ask big questions including: Can their technology vendors, platforms and ecosystems survive political upheaval, sanctions, tariffs or government mandates?
“Geopolitical risk is no longer a peripheral concern. It is a fundamental pillar of the investment business case,” said William Dixon, senior associate fellow for cyber and international security at British think tank Royal United Services Institute. “The risk isn’t the security or technology of the platforms themselves – but the potential for a technology provider to be ‘geopolitically de-platformed’ due to trade concerns or shifting alliances, as we have seen with very recent events.”
For example, Grok, the chatbot developed by Elon Musk’s xAI and rolled out within the X platform, has recently drawn the ire of multiple governments after repeated failures to block the spread of non-consensual sexualized deepfakes. Indonesia and Malaysia both temporarily banned the platform last week, and the United Kingdom, France, India and Ireland are all considering banning or restricting Grok.
Investment decisions should therefore prioritize organizational agility – and the ability to pivot between ecosystems – ensuring that the speed of innovation doesn’t create a “locked-in” vulnerability to state-level friction, Dixon said.
Joyce also cautions that CIOs could have to choose between two competing spheres in the IT and AI ecosystem developing around China and the United States.
“You’re going to see, I think a battle for dominance leveraging the technology stack that’s happening. And by that I mean cloud providers obviously from the west, you have cloud providers like Amazon, Microsoft and Google. From the east, you have Alibaba, Tencent and Baidu,” Joyce said. “We’re also seeing this with foundational models.”
In recent years, governments have taken action against Chinese companies over privacy and national security concerns. Last year, several Asian countries banned or restricted the DeepSeek AI chatbot, developed by a Chinese company, over fears that user data could be collected and stored in China and accessed by the government under China’s National Intelligence Law. In 2019, the U.S. placed Huawei on the Commerce Department’s Entity List, effectively banning it by restricting companies from supplying it without licenses.
“It’s going to be incredibly important that they’re taking a look at what parts of the world are they operating in, what is the kind of technology that they can leverage and use,” Joyce said. Taken in conjunction with data governance and regulatory fluctuations, “I think their lives have become much more complicated and much more strategic.”
To that end, tech strategy leaders need to interrogate if infrastructure or platforms could be compromised and make plans for scenarios in which key providers become unavailable overnight. What happens if your cloud provider becomes geopolitically untenable?
“Concentration risk in semiconductors and hyperscalers have become a single point of failure for the modern enterprise,” Dixon said. He recommends that CIOs audit their tech stacks for these “geopolitical single-points-of-failure,” and move toward hybrid or multi-region architectures with vendor diversity.
Joyce, a long-time advocate of moving to cloud, citing security and scalability benefits, now echoes Dixon’s sentiment. “I would just say now that I am very concerned about the concentration risk,” he said.
Matt Kelly, chief technology officer and vice president of standards and technology at the Global Electronics Association, said that dual or even multiple sourcing has become a strategic imperative for CIOs, even if it increases cost.
“You need to have multiple sources. It’s now the cost of doing business,” Kelly said. “Competitive advantage is not just based on that lowest cost source, but it’s now switching to highest confidence sourcing.”
As data sovereignty laws, regional regulations and political alliances evolve, particularly for organizations operating across multiple jurisdictions, CIOs need to rethink data architecture and governance. Where data is processed and stored matters.
“CIOs can no longer rely on a ‘one-size-fits-all’ global policy,” Dixon said. “Organizations must design architectures that allow for territorial ring-fencing, enabling them to comply with local mandate-driven actions without dismantling their entire global data ecosystem. Governance should be built around the reality that data is now a sovereign resource, not just a corporate asset.”
The growing complexity of data processing – and where that data is processed in an AI-driven world – also creates security implications for intellectual property, Stonier said. If the safety of information and IP is paramount for an organization to continue to operate in certain jurisdictions, CIOs need to have plans in place for safety-first data transfer and processing, in addition to plans for what happens if conflict arises with providers.
She recommends CIOs ask themselves make contingency plans before conflicts arise.
“What are your non-negotiables on data sovereignty, both for storage and processing? How do you define AI governance, and what are the minimum standards on security, privacy, sharing of IP and open data?” Stonier said. “I think that maybe a year ago, you could have had a range, or you were still discovering. Now, I think you need to know.”