AI is not just changing job descriptions; it is actively rewiring how work is coordinated, controlled, and created, and it is doing so on multiple fronts at once, inside the same organization.

AI Is Transforming Work on Multiple Fronts Simultaneously

Some of our IDC Future of Work predictions bring this into sharp focus: by 2027, 40% of current job roles in large organizations will be redefined or eliminated, accelerated by GenAI adoption. At the same time, by 2030, around 70% of new job roles in Europe are expected to be directly enabled by AI technology. This is not a neat “old jobs out, new jobs in” swap. It is a systemic reconfiguration of how value flows through the enterprise. Yet most leadership frameworks still present AI scenarios as if they were mutually exclusive: automate to cut headcount, augment to boost productivity, redesign work for agility, or push toward autonomous operations.

When Automation, Augmentation, and Autonomy Collide

On the ground, those dynamics do not arrive one by one; they collide. In the same business unit, you may be cutting FTEs as routine tasks are automated and taken over by “digital colleagues,” while simultaneously hiring AI orchestrators, prompt engineers, and automation product owners to keep up with demand for AI-adjacent skills. You may be tearing up long-standing workflows as agentic systems reshape a significant share of knowledge work, at the same time as parts of your operation drift toward near-autonomous execution, powered by employees building personal agents and conversational workflows that quietly absorb whole segments of the process. These are not options on a slide; they are concurrent forces acting on the same organizational fabric. Treating them like menu choices is not workforce planning. It is misdiagnosing an organizational phase transition, a fundamental shift in the underlying architecture of how work happens.

From Role-Based Models to Capability-Based Architectures

The uncomfortable truth is that many leaders are still planning for roles, new and “to be eliminated,” while AI is reshaping the landscape at the level of capabilities and architecture. You can see the tension in three simple signals. A clear majority of European organizations have already deployed or are piloting automation to offset chronic labor shortages. A growing share of executives openly discusses replacing positions with automation, and many plan to substitute a measurable portion of their workforce with “digital colleagues.” Meanwhile, by the end of this year, a meaningful slice of frustrated knowledge workers with no formal development background will be building their own agentic workflows to change how they work, regardless of what HR’s role catalog says. When people can spin up an agent in a week, any static role taxonomy you publish today is out of date tomorrow. The center of gravity moves from “what roles do we have?” to “what capabilities can we compose, and how fluidly can we recombine them as AI matures?”

Why Traditional Role Models No Longer Hold

Role-centric models allow for some seriously wrong assumptions: that tasks are stable enough to bundle into jobs, that jobs are stable enough to plan around for three to five years, and that hierarchies are stable enough to govern how value flows. Agentic AI quietly breaks all three. Tasks fragment, recombine, and migrate between humans and machines in near real time. Work starts to look less like a tidy org chart and more like a living graph of capabilities, human, machine, and hybrid. In that context, planning headcount against static job descriptions is like trying to architect a cloud-native platform using only server rack diagrams.

Architecture Determines the ROI of AI

However, IDC’s Future of Work research also shows that when enterprises invest in digital adoption and automated learning technologies, they can unlock substantial productivity gains. The pattern across these findings is consistent: it is the architecture that determines the yield of AI, not just the tools themselves. If your workflows are fragmented, AI struggles to “see” the end-to-end journey it needs to transform. When critical data is locked in legacy systems, it cannot provide the rich, contextual recommendations you were promised. When governance is tuned for stability rather than experimentation, it throttles the learning cycles AI needs to be useful. Layer on top the reality that many organizations openly acknowledge they lack the capability support to implement automation effectively, and a clear picture emerges.

AI Amplifies Existing Organizational Weaknesses

In that environment, throwing more AI at the problem does not fix anything. It amplifies what is already there. Bad processes simply run faster. Poor decisions scale further. Shadow automation blooms in the gaps, as frustrated employees script around the constraints of the operating model. AI becomes an accelerant, not a cure.

Reframing the Strategic Question for Leaders

This is why the strategic question has to change. Instead of asking, “Which jobs will we automate?”, leaders need to ask, “Is our organization structurally able to absorb intelligence at scale?” Answering that requires moving from headcount planning to capability mapping, designing work around the interplay between human strengths, judgment, domain expertise, relationship-building, and machine strengths such as pattern recognition, generation, and orchestration. It means treating architecture as a product: standardizing interfaces, workflows, and data contracts so AI can plug into work without bespoke integration every single time. It means tracking how many workflows, decisions, and customer journeys are genuinely enhanced by AI, not just how many licenses have been bought. And it means steering reduction, augmentation, redesign, and autonomy as one coherent portfolio of change, not four disconnected projects.

Conclusion: The Real Stress Test Is Your Operating Model

AI is already changing jobs. The real test is whether your operating model can evolve quickly enough to harness that change, or whether AI will simply accelerate you toward the limits of the system you already have.

If you would like more information, drop your details in here.

Meike Escherich - Associate Research Director, European Future of Work - IDC

Meike Escherich is an associate research director with IDC's European Future of Work practice, based in the UK. In this role, she provides coverage of key technology trends across the Future of Work, specializing in how to enable and foster teamwork in a flexible work environment. Her research looks at how technologies influence workers' skills and behaviors, organizational culture, worker experience and how the workspace itself is enabling the future enterprise.

AI adoption is accelerating across EMEA, yet many organizations struggle to translate investment into measurable business value. This blog explores the structural challenges behind stalled AI initiatives and what differentiates organizations that successfully scale.

AI Adoption in EMEA: High Investment, Limited Business Value

AI adoption across EMEA has progressed significantly over the past 12–18 months, with organizations moving beyond experimentation into broader deployment phases. However, progress remains uneven.

IDC research shows that a substantial share of organizations are slowing down, scaling back, or refocusing their AI initiatives. This reflects a shift in priorities rather than a decline in interest. As macroeconomic pressures, regulatory complexity, and competing IT investments intensify, organizations are increasingly challenged to execute AI initiatives while demonstrating measurable business outcomes.

Why AI Projects Fail: The Execution Gap

The challenges that limit AI impact are consistent across industries, but particularly pronounced in EMEA.

According to IDC research, organizations continue to face difficulty in quantifying and demonstrating AI-driven ROI, alongside competition for resources and increasing regulatory uncertainty. According to IDC research, only 9% of EMEA organizations have been able to deliver measurable business outcomes from most of their AI-related projects over the past two years (Source: IDC Future Enterprise and Resiliency Survey, Wave 1, March 2026), At the same time, resistance to process change remains a persistent barrier, especially where AI requires cross-functional alignment and new ways of working.

These factors rarely cause projects to fail outright. Instead, they contribute to a gradual loss of momentum, where initiatives remain in pilot phases or are scaled selectively without broader organizational impact.

AI ROI: Why Proving Business Value Remains So Difficult

A central issue in AI adoption is the ability to measure value consistently.

IDC research highlights that AI impact extends beyond direct cost reduction to include indirect benefits such as productivity gains, revenue enablement, and risk mitigation. This makes it difficult to capture value using traditional ROI models.

As a result, many organizations lack a standardized approach to evaluating AI initiatives. This leads to fragmented decision-making, where use cases are assessed in isolation and scaling decisions are not consistently aligned with business priorities.

Without a clear framework for value measurement, AI initiatives often struggle to move beyond experimentation.

Scaling Enterprise AI: Why Moving Beyond Pilots Is So Hard

Scaling AI requires more than successful use cases. It requires integration into core business processes and operating models.

IDC research indicates that organizations face increasing challenges when moving from pilot to scale, particularly in relation to budget allocation, operational complexity, and governance requirements. While initial projects are often funded as innovation initiatives, scaling requires sustained investment in infrastructure, data, and ongoing operations.

This transition exposes structural gaps. Organizations that lack alignment between business strategy, data architecture, and execution models often struggle to scale beyond isolated successes.

AI Governance and Regulation in EMEA: Barrier or Opportunity?

Regulation is a defining factor for AI and broader technology adoption in EMEA.

According to IDC research, regulatory requirements around data protection, AI, and cybersecurity are significantly shaping how organizations approach AI deployment. While compliance increases operational and infrastructure costs, it is also driving more structured approaches to governance.

At the same time, organizations report benefits such as improved resilience, stronger ESG performance, and increased customer trust. This suggests that regulation is not only a constraint, but also a catalyst for more sustainable and trusted AI adoption.

Organizations that integrate governance early are better positioned to scale AI effectively.

AI and Workforce Transformation: Why the Human Factor Matters

AI transformation is not purely a technology challenge. It is fundamentally an organizational one.

IDC research emphasizes the importance of aligning AI initiatives with workforce capabilities, culture, and leadership. This includes reskilling, change management, and building trust in AI-driven processes.

Organizations that fail to address these elements often encounter slower adoption and limited impact. In contrast, those that integrate the human factor into their AI strategy are better positioned to realize long-term value.

The Evolving Role of the CIO in AI-Driven Organizations

As AI becomes central to business strategy, the role of the CIO continues to expand.

IDC research shows that digital leaders are increasingly expected to drive business value, support growth, and strengthen resilience. For instance, 42% of EMEA C-Suite leaders expect their CIO role to lead digital and AI transformation with a major focus on specifically creating new revenue streams (Source: IDC Worldwide C-Suite Tech Survey, September 2025). This requires a shift from a technology-centric role to a more strategic position aligned with business outcomes.

CIOs and digital leaders are therefore playing a critical role in connecting AI initiatives with measurable impact and ensuring alignment across the organization.

From AI Strategy to Execution: What Differentiates Leading Organizations

The current phase of AI adoption in EMEA is defined by execution.

Organizations that successfully scale AI tend to take a more structured approach, linking initiatives to business objectives, embedding governance early, and aligning technology with organizational change.

However, many organizations are still in transition. Key questions remain:

  • How can AI ROI be measured consistently across different use cases?
  • Which frameworks support scaling AI at the enterprise level?
  • What changes are required to align workforce and operating models?

How should the role of digital leaders evolve to effectively support AI-fueled business transformation? These questions will be explored in more detail in the upcoming webinar.

Drawing on insights from the IDC EMEA Digital Leader Playbook, the session will provide a practical perspective on how organizations across the region are approaching AI strategy and value realization.

Join the Discussion

For organizations seeking to move from AI experimentation to measurable business impact, understanding these dynamics is critical.

Register for the upcoming IDC webinar on May 28 to gain deeper insight into how leading organizations in EMEA are turning AI into real business value.

Martina Longo - Research Manager, Digital Business - IDC

Martina Longo is a research manager in the IDC Digital Business Research Group. In her role she advises ICT players on how European organizations create business value using digital technologies. She also leads IDC European Digital Native Business research, focused on those enterprises born in a modern technological world in a mix of start-ups, scaleups, and more mature digital natives. Within the European Digital Business Research, the European Digital Native Business, Start-ups and Scale-ups theme advises technology suppliers on the market dynamics and segmentation, business priorities, tech buying patterns and go to market approaches (sell to/sell with) needed to engage digital native organizations in Europe.

Hannover Messe 2026 ran from April 20 to 24 in Hannover, Germany, and it delivered. Under the theme “Think Tech Forward”, the show brought together over 130,000 visitors from more than 150 countries, 4,000 exhibitors, and 300+ start-ups across industrial automation, software, and hardware.

Brazil was this year’s partner country, and the event itself got a makeover: a new hall layout, a revamped thematic structure, and a brand-new Defense Production Park zone, reflecting just how much the scope of industrial technology has shifted.

Here are the Top 10 things I’m taking home, and yes, I’m happy to be challenged on any of them.

The user attention battle is quietly beginning

My deepest feeling coming out from the #HMI26 floor was to be the witness of the first deployments of the armies fighting for who controls the factory of the next decade. Most demos at Hannover Messe 2026 I was exposed to started with a chat box prompting the users. The question is how many of them can co-exist in a factory setup. My answer is as little as possible. The battle for the factory UI has hence started. It can turn out this way: one system as the front-end workers actually use, the others as solid back-end.

Context is the new competitive asset. Whoever owns it, then owns the process. And physics-aware data fabrics are the competitive moat

The differentiating capability in industrial AI is not model quality, but it is contextual depth. A physics-aware industrial data fabric that connects real-life physics, process history, sensor telemetry, operational and operator knowledge provides more competitive advantage than any algorithm running on top of it. Hopefully, manufacturers will define a technology journey built around data first, then context, then impact, but I fear the need to rush the deployment of industrial AI apps may result in missed opportunities in building the critical industrial model foundation.

MES stands for “Must Evolve Soon”

This application is the spine of the plant (because it acts as both the system of engagement and the system of record). But process flexibility is now its hardest test… Why? First, top-down. Advanced Planning and Scheduling applications are seeing accelerated adoption, driven by a new generation of algorithms capable of delivering real-time, context-rich, executable plans. As APS systems push dynamic re-sequencing into execution, MES must evolve fast enough to receive and act on what APS produces, or risk being seen as the weakest link. To this, it directly follows… the bottom-up pressure. Unstructured production cells (i.e. multifunctional robots, wireless machines, AMR-driven object routing) are going to be gradually replacing fixed lines. Customer requests are shifting toward rapid configuration, faster changeovers, and multifunctional automation. MES must evolve to accommodate less deterministic workflows, or lighter tools will fill the gap.

Forget upskilling. The connected worker is all about context generation and retention

The ability to bring anybody “to speed” has been so far one of the typical selling points for connected frontline worker platforms so far. But this is barely scratching the surface. The combination of AI-first vision systems, IIoT, RFID, RTLS, and mobile or wearable devices creates an ultra-visible data substrate that makes the factory transparent. On top of it, the layer of human-process interaction managed through connected worker platforms enables unprecedented levels of visibility on how people interact with process execution steps. This is truly the best material for AI-driven process improvement. This data gold mine is not just in the machine data. It is the analysis of what happens between the worker and the process.

The industrial metaverse is developing as a hyper-contextual decision-making environment

The exponential growth in data availability, combined with falling costs of modelling and representation, is unlocking use cases that were economically impossible two years ago. Hence, we can say that the “VCR” moment has arrived. Now we have the full capability to “zoom in and zoom out” and as well as “fast forwarding” the process for continous multi-scenario process planning and simulation, as well as “rewind” or playback the process for traceability and analysis.

Right-size AI now or face the potential consequences

The differentiating capability will be the agentic continuum, i.e. the unbroken intelligent chain across production execution. But building that chain responsibly requires confronting infrastructure and cost realities that vendor marketing may be now underplaying. Right-sizing AI and matching model scale and infrastructure to actual operational demand is a business continuity decision. The question is not “what is the most powerful model?” but “ do we need AI at all for this, and if the answer is “yes”, then “what is the appropriate model for this decision/process automation, in this operating environment?”

Manufacturing runs on deterministic sequences. Agentic AI is inherently non-deterministic. Reconciling these two realities is the governance challenge

Two distinct scenarios define the governance challenge. In the first, the desired output is well understood, and users can accept or reject an AI result without a care in the world about inspecting the internal process. In the second, the correct answer is uncertain, and full transparency into how the model generated its output is required before the result can be trusted. The challenge is how to gradually hand over large bits of process control to an agentic software layer that is stochastic in nature. Most manufacturing companies today are only comfortable approving small, incremental AI-driven changes, not because AI is incapable of more, but because the accountability and auditability frameworks for automating larger decisions do not yet exist.

So what?

What does this mean in practice? Three implications stand out.

Survive to Scale: Link the technology curve to the organisation curve

Technology is advancing faster than most organisations can absorb. The strategic risk for many manufacturers is not deploying too slowly, but it is scaling before the organisational substrate is ready.

Bring in the Naysayers: Organisational buy-in requires involving sceptics early, not convincing them late

There is a very nice saying that goes more or less as “Don’t let people saying that it can’t be done disturb the people who are already doing it.” But in this new venture, bringing the contrarians will be important. Creatin forums where sceptics stress-test plans with the utmost ferocity (before the market does it!) will be key.

Complexity demands simplicity: Focus on fundamental problems, not exhaustive use-case catalogues

Technology is evolving faster than any list can stay current. Vendors and manufacturers alike should resist chasing every new capability appearing on the horizon, and rather concentrate on first principle-based, core solutions that foster data integration for autonomy and decision-making improvement.

For a deeper look into Lorenzo’s research, visit our website. If any of these perspectives challenge your thinking or connect to your priorities, we would be glad to continue the discussion via our contact form.

Lorenzo Veronesi - Associate Research Director, IDC Manufacturing Insights - IDC

Lorenzo Veronesi is an associate research director for IDC Manufacturing Insights EMEA. In this role, Veronesi leads the Worldwide Smart Manufacturing research program and supports all the IDC MI research services for EMEA, by looking at Digital Transformation drivers in multiple manufacturing industry sub-verticals. He is also often involved in consulting projects across the world for end-users, IT vendors and public authorities. During the last decade his research has focused across key processes such as manufacturing operations management, supply chain management, and product lifecycle management in multiple manufacturing verticals, including - among others - automotive, aerospace, machinery, high-tech, chemicals, CPG, and fashion. Before joining IDC, Veronesi worked as analyst in multiple projects including research in the industrial logistics sector and as advisor for public authorities in Italy. Veronesi holds an MSc Degree in Regional Science at the London School of Economics and Political Science and has graduated cum laude at the Bocconi University in Milan.

Why scaling AI and proving ROI are now the real challenge for European organizations.

What comes next is far less straightforward.

For some time, the European AI narrative was fairly comfortable: lots of enthusiasm, plenty of pilots, and just enough regulatory drama to keep things interesting. Companies could experiment broadly, point to a few wins, and call it a strategy.

IDC’s recent research, based on a survey of 200+ European organizations conducted in late 2025, tells a story that is a tad inconvenient for anyone still in “innovation exploration” mode: more than half of European companies report that over 50% of their AI projects have already delivered measurable business outcomes. This is no longer a single pilot result; it is becoming a pattern. And patterns have a tendency to change expectations.

Europe is past the “AI is interesting” phase, but not quite at “AI is effortless” either. Most organizations are somewhere in the messy middle: proof points, momentum, but still unable to explain why that momentum is not turning into something more systematic. Nearly 9 in 10 say their ability to scale AI has improved. And yet, a large portion is operating with what you might call partial discipline. They are moving forward, but without the playbooks, governance structures, and execution models that make scaling feel less like controlled improvisation.

The technology was never the hard part of AI scaling
European organizations are not struggling to build AI. They are struggling to absorb it. When asked what most prevents them from realizing the full potential of their AI investments, the top answers were competition with other transformation priorities, regulatory uncertainty, resistance to process change, difficulty proving ROI, and budget pressure. None of these are technology problems. The blockers are organizational, political, and structural. Throwing more engineering at them will not help.

This is, in fact, a sign of progress. Europe’s AI constraints have shifted from technical feasibility to enterprise commitment, which means the technology has largely done its job. The hard part now is everything surrounding it: sponsorship that survives the next budget cycle, processes redesigned after years of inertia, and ROI demonstrated clearly enough to compete with every other initiative in the budget allocation process. AI is now being tested as a business program, and business programs depend on organizational discipline.

But can organizations measure AI ROI and business impact?

European organizations are no longer just tracking model performance or project completion. Operational efficiency, user adoption, business KPIs, and financial outcomes are all on the scorecard now. This removes a certain flexibility that AI teams might have previously enjoyed. A technically elegant deployment that nobody uses is no longer a qualified success. It is simply not a success.

The encouraging news is that many organizations are starting to respond, with a clear move toward formal business metrics and ROI logic built in from the start.

The gap is widening

Europe’s AI market is entering a separation phase. This is the point where the gap between organizations that can operationalize AI and those still generating isolated use cases starts to widen. The organizations pulling ahead are building the necessary connective tissue: prioritization discipline, outcome measurement, and governance that works at speed. Meanwhile, those still in exploration risk producing impressive narratives about their AI journey while actual business outcomes remain limited.

For enterprise leaders, IDC research is clear about what separates the scalers from the stragglers:

  • Stop treating AI as a project portfolio. Projects create motion; systems create lasting value.
  • Build measurement in from day one, not just as good practice, but because organizations that cannot prove value will lose internal budget competition to those that can.
  • Treat governance as a speed advantage. Organizations that build compliance into reusable controls will move faster, not slower, than those handling it case by case.

For vendors and service providers, the message is equally clear: more features are not the answer to executive skepticism. Proof of business impact is becoming a primary buying criterion. The ability to show how value will be measured, attributed, and reviewed matters more than model benchmarks.

Want to go deeper?
These dynamics are part of a broader shift shaping IT investment across EMEA in 2026. In our recent webcast, IDC analysts explored where growth is materialising, how AI maturity is evolving from pilots to scaled deployment, and what separates organisations that are successfully operationalising AI from those that are not.

If you missed it, the session is now available on demand. Watch it here and get the full data-driven perspective for your strategy.

Ewa Zborowska - Research Director, AI, Europe - IDC

Ewa Zborowska is an experienced technology professional with 25 years of expertise in the European IT industry. Since 2003, she has been a member of the IDC team, based in Warsaw, researching IT services markets. In 2018, she joined the European team with a specific emphasis on cloud and AI. Ewa is currently the lead analyst for IDC’s European Artificial Intelligence Innovations and Strategies CIS.

Digital sovereignty is moving from concept to strategic requirement. As organisations focus on managing IT risk, control, and compliance, expectations towards providers are rising. This blog explores why the “sovereign” label is no longer enough and what it takes to meet these new demands. 

Many technology providers in Europe today claim to offer “sovereign” solutions. 

But ask a simple follow-up question, what exactly makes them sovereign, and the answers quickly become less clear. 

At the same time, demand for digital sovereignty is increasing. Over the past 15 months, geopolitical and economic uncertainties have pushed the topic higher up the agenda. When asked about digital sovereignty, almost 50% of organisations globally say their interest has increased compared to the previous year. 

But focusing on geopolitics alone misses the bigger shift. 

Why digital sovereignty expectations are changing 

As interest grows, so do expectations. Digital sovereignty is no longer an abstract or purely regulatory concept. It is becoming an essential strategic requirement in IT decision-making. 

At the same time, it remains a source of confusion. Many organisations still struggle to define what sovereignty actually means in practice, what is required to achieve it, and whether they need it at all. And then you need to ask, who can you trust? And then you need to ask, who can you trust? 

This creates a gap in the market. Providers talk about sovereignty. Customers are still trying to understand it. 

What is really driving digital sovereignty adoption 

Despite the geopolitical backdrop, the main drivers are far more practical. 

Organisations are prioritising control over their data, stronger governance and compliance, and the ability to manage risk. In Europe in particular, protection against extra-territorial data requests has emerged as the highest concern. 

This is where expectations begin to change. 

More than 40% of organisations globally say they will increase the frequency and granularity of their reviews of IT vendors and platforms to better assess and manage this risk. Furthermore, when asked what was most needed to achieve data sovereignty, 85% cited enhanced tools and solutions for governance, risk and compliance as the extremely or very important. 

Thus, if digital sovereignty is ultimately about managing IT risk, it cannot be reduced to a label or a feature. It needs to be something that is tangible and can be clearly explained, implemented, and validated. 

This also changes the role of providers. They need to help organisations assess their risk appetite, manage that risk, and deliver the solutions required to meet these expectations. 

And this is where many providers are not yet aligned. 

What digital sovereignty actually requires 

Part of the challenge lies in how sovereignty is framed. It is often treated as a single capability, when in reality it spans multiple dimensions. 

One practical way to approach it is through three areas: data sovereignty, technical sovereignty, and operational sovereignty. These form the three key pillars of cloud sovereignty, which itself represents a subset of the broader concept of digital sovereignty. 

Together, these define how control is exercised across data, infrastructure, and operations. 

For providers, this raises the bar. Sovereignty is no longer something that can be communicated in broad terms. It needs to be articulated across these dimensions, in a way that is transparent and verifiable. 

Where sovereignty really matters: high-risk workloads 

It is also important to clarify where sovereignty actually needs to be applied. 

Sovereign requirements are typically focused on workloads that involve sensitive data, regulatory exposure, and or critical business processes. This increasingly includes certain AI use cases, where data control and model governance are essential. 

This is also where trust becomes central. 

Customers need confidence that sovereignty claims hold up under scrutiny, especially in high-risk scenarios. It is no longer enough to state that a solution is sovereign or to only address isolated aspects such as data residency or localisation. 

Providers need to demonstrate how sovereignty is ensured, where the boundaries lie, and what guarantees are in place. This assurance must extend across the entire partner ecosystem, from primary providers to their partners and beyond. 

From positioning to proof 

The conversation around digital sovereignty is evolving quickly. Expectations are rising, and with them, the level of scrutiny applied to providers. 

In this environment, sovereignty is no longer a positioning or marketing statement. It is something that needs to be clearly defined, agreed upon by all stakeholders, consistently implemented, and credibly demonstrated. 

For many providers, that requires a shift. From broad claims to precise explanations. From messaging to evidence. 

And ultimately, from sovereignty as a label to sovereignty as a trust model that delivers autonomy, control, transparency, and resilience. 

If you are reassessing how to position and deliver digital sovereignty, speaking to an expert can help clarify what your customers will expect next. Request a call here

Join the webcast “Digital Sovereignty Beyond the Label: How Customer Expectations Are Changing” at the link here.

 
All data sources: IDC Europe, Worldwide Digital Sovereignty survey 2025, July 2025 

Rahiel Nasir - Research Director, European Cloud Practice, Lead Analyst, Digital Sovereignty - IDC

Rahiel Nasir is responsible for leading and contributing to IDC's European cloud and cloud data management research programs, as well as supporting associated consulting projects. In addition, he leads IDC's worldwide Digital Sovereignty research program. Nasir has been watching technology markets and writing about them throughout his professional life.

Cyber risk is no longer just a technical issue, it is a core business concern discussed at the highest levels of the organization. Across EMEA, boards are demanding clearer visibility into risk exposure, regulatory impact, and resilience. This blog explores the latest IDC insights on how CISOs can translate cyber risk into business language, align with board expectations, and strengthen decision-making in an increasingly complex threat and regulatory landscape.

How cyber risk became a board-level business risk

IDC research confirms that cyber risk has become a top board-level concern across EMEA and globally. Boards increasingly recognize that cyber risk is synonymous with business risk, prompting them to ask CISOs to translate the risk of cyber compromise into tangible business and compliance impacts.

As highlighted in IDC’s perspectives, board members are no longer satisfied with technical metrics alone they want to understand how cyber threats could affect organizational resilience, regulatory standing, and overall business continuity.

Cyber risk appetite vs. security investment: Key EMEA trends

Cybersecurity remains the primary barrier to CIO success in Europe, with 16–18% of organizations identifying it as their top challenge. Despite ongoing economic volatility, security budgets are generally protected, though not immune to cuts. IDC’s EMEA Security Tech and Strategies Survey reveals that 33% of financial services organizations kept their security budgets flat, 29% increased them by less than 10%, and 14% decreased them by more than 10%.

Boards are demanding greater clarity on risk acceptance, transfer, and mitigation strategies. A common pitfall is treating security metrics as mere program performance indicators rather than as expressions of risk and compliance management. Boards are now asking, “What is the risk cyber presents to the organization, and how well are we positioned to address it?”

CISO best practices for communicating cyber risk to the board

IDC recommends that CISOs translate cyber risk into financial terms, expressing exposure as realistic cost-of-breach scenarios rather than relying solely on severity labels. Structured exercises should identify which risks threaten financial stability and which are critical for certification or compliance. At the board level, metrics should focus on governance, risk, and compliance trends, answering questions such as: “What are our minimal viable operations? Are we cyber crisis ready? How resilient are we? How long will our business, systems, and production be offline in the event of a severe cyber compromise?”

A robust risk management framework can address 70% of board questions by identifying mission-essential assets, evaluating threats, monitoring controls, and clarifying risk ownership. While boards seek benchmarks and industry comparisons, they are cautioned against adopting a “do $1 more than our competitor” mentality.

IDC advocates for quarterly red teaming and realistic tabletop exercises to educate boards and executives, clarify escalation policies, and better identity and assess third party risk. Boards are also increasingly interested in the impact of AI and emerging technologies such as quantum key encryption and Model Context Protocol (MCP) deployment on organizational risk posture. CISOs should review use cases, implement human-in-the-loop controls, assess data security, and continuously audit AI assets.

Cyber risk and regulation in EMEA: Key insights for CISOs

Regulatory pressure is intensifying in Europe, with frameworks like NIS2, DORA, and the EU AI Act resulting in governance, risk, and compliance (GRC) as the top security technology priority for large organizations. Over 40% of these organizations now place GRC at the forefront, with liability for infringements increasingly assigned to senior management.
In European financial services, cyber security for clients (59%) and internal cyber security (57%) are the primary drivers of risk management investment. But only 43% of CISOs in large UK enterprises report having monthly board engagement, while 48% engage on an ad-hoc basis. IDC recommends establishing regular, structured communication to align risk appetite and investment decisions.

Practical steps to improve cyber risk management and board engagement

To enhance board engagement and risk management, IDC advises quantifying risk in business terms using financial impact, loss scenarios, and regulatory exposure. Cyber risk management should be continuous, using process automation where possible.
Boards must align security investment with risk appetite, and balance resilience, compliance, and operational priorities. Regular, meaningful engagement beyond ad-hoc updates is essential, as is benchmarking against peers while avoiding herd mentality. Integrating GRC platforms to automate reporting, audit, and compliance can support board-level visibility and informed decision-making.

Key takeaways for CISOs and boards in 2026

IDC’s EMEA and worldwide research underscores that effective cyber risk assessment and CISO-board communication require translating technical risk into business impact, quantifying risk appetite, and aligning security investment with strategic objectives.
Boards seek clarity, context, and actionable insights not operational minutiae. CISOs must become influential partners, guiding risk acceptance, transfer, and mitigation in a language the board understands. As regulatory and threat landscapes evolve, disciplined, data-driven communication is essential for resilient, compliant, and secure organizations.

Join the conversation: Deep dive in our upcoming webinar

Want to go beyond the headlines and understand what these shifts mean for your organization? Join our upcoming IDC webinar on May 12 to hear directly from our analysts as they break down the latest EMEA cybersecurity trends, evolving board expectations, and what it takes to translate cyber risk into business impact. Gain practical insights, benchmark your approach, and learn how leading organizations are aligning security strategy with business priorities.

Joel Stradling - Senior Research Director, European Security - IDC

As senior research director for IDC's European Security practice, Joel Stradling leads the content and analyst team for tracking the European security segment. His main focus areas include Zero Trust Network Architecture, Managed Security Services, and Cyber Risk and Resiliency. Stradling has 22 years of experience as an analyst of cyber security, and international managed enterprise network and IT services. He is a regular speaker at major industry conferences talking about security and privacy, Digital Trust and Managed Security Services in B2B enterprise services. Joel is a well-known and highly regarded expert in the industry, offering insight and advice to C-level executives on security technology competitive landscapes and evolving security market segments including: managed security services ZTNA, cloud security, risk and compliance, end point, identity and access management, IT/OT security, secure IoT and 5G, and secure operations.

David Clemente - Research Director, European Security - IDC

Dave Clemente is a Research Director in IDC's European Security practice, with a focus on security services (including managed services and professional services). He is a research professional with more than fifteen years of experience in cyber security, including in think tanks (Chatham House and the International Institute for Strategic Studies), professional services (PwC and Deloitte), and market analysis. Dave is a regular conference speaker and media contributor, and has authored numerous publications on topics including C-suite technology and security priorities, security policy and governance, risk management, and data protection.