corporate governance

Digital sovereignty is moving off the IT compliance list and onto the board's risk agenda. Vivicta's Nordic Digital Sovereignty Survey 2026, published on 22 September, finds that seven in ten organisations expect to increase their sovereignty investment over the next twelve months, while fewer than three in ten are confident they control their critical data.

Not long ago, the CIO of a large Swedish company told Vivicta's CEO Satu Kiiskinen what his single highest priority was. It was knowing where the company's business-critical data actually sits. He knew a moment would come when the executive team and the board would ask him that question, and he wanted the answer ready.

The question stopped being technical

Digital sovereignty means an organisation's ability to retain control and decision-making authority over its critical data, systems and operational continuity, including when the operating environment changes.

The definition might sound like an IT matter. According to Kiiskinen, that is precisely the problem. In executive teams and boardrooms the subject is still treated too often as a compliance and technology question. Her own view is different: this is first and foremost about business continuity, risk management and the capacity to keep operating when conditions shift.

“It’s clear that sovereignty has become an increasingly important priority in the current geopolitical environment. Digital sovereignty has become a leadership priority linked to business continuity and risk management, and it’s no longer seen as just a compliance issue”

The gap is not in the budget

The survey, run by Vivicta in collaboration with the research company Kairos Future, drew 320 senior decision-makers and key advisers in Finland, Sweden and Norway between June and July 2026. All worked in organisations employing more than 500 people.

The findings describe a subject that is recognised but not yet governed:

• 70 per cent expect sovereignty-related investment to increase over the next 12 months.

• 46 per cent have a formal, explicit sovereignty strategy.

• 29 per cent strongly believe they control their critical data to a sufficient standard.

This, Kiiskinen says, is the most interesting result in the dataset. The subject is recognised, it is discussed, and organisations are willing to put money behind it. The capability still does not match the ambition. A gap has opened between intent and execution.

For a board, that is a familiar situation in unfamiliar clothing: an investment decision is coming up on a matter that too often has no strategy, no named owner and no metric.

Finland invests most. Sweden is further ahead on strategy.

Seventy-four per cent of Finnish organisations plan to increase investment, more than in Norway (69 per cent) or Sweden (68 per cent). On strategy the order reverses: a formal sovereignty strategy exists at 53 per cent of Swedish organisations, 44 per cent of Finnish ones and 39 per cent of Norwegian ones.

On control of critical data, Finland leads the comparison at 35 per cent, with Sweden and Norway at 26 per cent. Finland is ahead of its Nordic peers, and still only one Finnish organisation in three strongly believes it has sufficient control of its critical data.

Sweden, Kiiskinen notes, put sovereignty on the table some time ago. The CIO in the opening example represents that stage: the question is no longer whether the subject matters, but whether the organisation can answer when asked.

The opportunity is competitiveness.

Kiiskinen does not frame the subject as a threat. She sees it primarily as an opportunity to strengthen an organisation's resilience and competitiveness, and, ultimately, shareholder value.

Artificial intelligence connects to this directly. When the AI conversation runs hot and business benefits are wanted quickly, control of data determines whether AI can be adopted in a governed way, with risks identified in advance rather than reconstructed afterwards. Twenty-seven per cent of respondents rank AI, data use and control of decision-making among their most important sovereignty priorities. Seventeen per cent see AI as a new obstacle to data control.

On the risk side, Kiiskinen names one above the others: excessive dependency on individual providers.

Respondents agree. Dependency on external service providers tops the entire list of obstacles at 28 per cent. Cost and the complexity of an organisation's own environment follow at 23 per cent each, vendor lock-in at 16 per cent, and the absence of a strategy, owner or governance model at 14 per cent.

Dependency is rarely anyone's decision. It accumulates. Each individual choice was defensible at the time, and the result is a structure no one designed. It becomes visible only when something has to change quickly.

Full control is not the goal

Kiiskinen is careful not to overstate what the survey shows.

Complete sovereignty across every system is neither realistic nor the point, Kiiskinen says. What matters is distinguishing what is business-critical from what is not. The organisations that find a sensible balance are the ones that find resilience when conditions change

The data supports her. Only 8 per cent of respondents consider standard or global cloud sufficient for all critical workloads, and exactly the same share require full national sovereignty with elevated security. Everyone else sits somewhere in between. Seventeen per cent have not assessed the question at all.

“Ultimately, sovereignty is about freedom of action: the ability to remain in control when technology, suppliers or circumstances change. Organisations that find the right balance will be better positioned to innovate, grow and manage risk simultaneously”

What the board should ask

Kiiskinen does not present this as an easy topic for a board. The natural route onto the agenda, she says, runs through the audit committee, as part of risk management and business continuity. That does not mean it stays there. The whole board needs to take an interest.

Five questions a board can put to management at its next meeting:

1. Do we share a view of which data is business-critical to us?

2. Which systems are business-critical, and do we understand the difference between the two?

3. Where does our business-critical data actually reside, and how is it governed?

4. Who has access to it?

5. To what extent are our data, systems and decision-making genuinely under our own control, and which part of our preparedness is an assumption rather than something tested?

None of these requires technical expertise to ask. On the evidence of this survey, many organisations would struggle to answer them.

Which leaves one question on the table, and it belongs to the board rather than to IT: are boards challenging management hard enough, before the next disruption reveals the real state of their readiness?

A day before Luotea posted half-year results showing Sweden pulling ahead of a lagging Finland, the group named Rikard Nyhrén, most recently of Intea and Newsec, as CEO of its Swedish operations from February 2027 with the group’s profit guidance now resting on Sweden.

He succeeds Mikko Taipale, who has stepped down from the role and from Luotea's Group Management Team effective immediately; Saman Khalilian, CFO of Luotea Sweden, will run the unit on an interim basis until Nyhrén arrives. CEO Antti Niitynpää said the appointment supports Luotea's aim to "accelerate improvement in profitability" in Sweden.

The change lands at the point where Sweden has become the group's growth engine. Swedish net sales rose roughly 10% in the first quarter and 9% in the second, even as Finnish cleaning and support services fell a further 7%, and the reaffirmed full-year guidance, adjusted EBITA to increase, or increase significantly, against 2025's EUR 7.0 million, increasingly rests on Sweden holding its trajectory.

Two features of the appointment stand out. Management is changing the leadership of its best-performing region at the moment that region is working; and it has gone outside facility services to do it.

Nyhrén, born in 1981, joins from Intea Fastigheter, where he heads asset management. He has held senior roles at Newsec, Hemsö and Parmaco, and was chief technical officer at Hemsö. He trained as a construction engineer at Mälardalen University. So his background spans both sides of the business Luotea wants to build: property and asset management, and the technical side, not cleaning or facility management.

His background points to where Luotea wants to grow: property services and data-driven services, both central to its 2026–2028 strategy. This is our read of the hire, not a reason the company has given.

The numbers behind the timing

The appointment landed one day before Luotea published half-year results. Group net sales for the second quarter rose 1.5% to EUR 88.1 million and adjusted EBITA rose to EUR 2.5 million, with Swedish net sales up 9%.

For the first half, net sales increased 0.4% to EUR 174.2 million, adjusted EBITA improved to EUR 2.9 million, and operating profit stood at EUR 0.5 million.

The improvement builds on the first quarter, when Luotea said that the "turnaround in Sweden proceeds as planned" even as group net sales dipped on price competition and delayed investment decisions in Finland.

The AI race has moved past experimentation. 2026 is about execution at scale. The winners won’t be the fastest adopters. They’ll be the ones with the governance to deploy AI decisively across their organizations. Everyone else is already behind.

When I was considering joining Dell Technologies in 2022, one thing stood out above all else. It was the culture around artificial intelligence. Dell had decided to take AI seriously. The organization was thinking disruptively, moving with intent, and treating itself as the first test case, not just the advisor. It made me curious and convinced me.

Nearly four years later, I can say the leap we’ve made in AI, both as an organization and in my own leadership, has been remarkable. It has fundamentally changed how I work, how I lead, and how I see the future, with a strong sense of optimism.

This shift is not just about productivity. It is about whether organizations can scale AI safely, effectively, and continuously innovate. At its core, this is a question of governance.

The leader who cannot look away

There is a temptation among senior executives to treat AI as a technology matter, as something to delegate to the CIO or CTO, while the real business of leadership continues elsewhere. That temptation should be resisted firmly.

A leader must have a horizontal view across the organization. Strategy, culture, operations, finance, and risk are all now shaped by AI. This is not something that can be delegated away from the top. Leadership teams that try to do so are not reducing complexity; they are allowing it to build, unseen and unmanaged.

My own experience confirms this. Since embracing AI tools in my daily work, my leadership has genuinely moved forward. I use my time more intelligently. I produce more value in the role, and I see the same effect ripple through the organization: people doing more meaningful work, freed from the routine tasks that once consumed their days. This is not a marginal efficiency gain. It is a qualitative shift in what leadership and professional work can mean.

Governance: The leadership trend that cannot wait

Among the many dimensions of AI leadership, one has emerged as the defining challenge of 2026: governance.  This is where the AI race will be decided, not in pilots, but in the ability to scale with control.

This is not primarily a regulatory question, though regulation matters. It is a leadership and competitiveness question. 

"As John Roese, Dell's global CTO and chief AI officer, wrote in a Dell blog post last December, “Top on the list is governance. We haven’t established strong governance frameworks yet.” He added that “governance in general will be a big deal in 2026,” and that inside the enterprise, “investment in a structured approach to AI will become a requirement.”

Companies are often moving faster than their organizational structures can absorb, from AI pilots to genuine production environments. In that transition, governance gaps appear. Who is accountable for an AI system's outputs? How is training data governed? What happens when a model fails, or behaves unexpectedly, at scale?

These questions are already surfacing in boardrooms. And the leaders who have clear answers will have a competitive advantage over those who do not.

Data is the asset and the vulnerability

AI does not merely use data. It amplifies data's value and its risk simultaneously.

Modern AI platforms ingest vast volumes of information, generate new data continuously, and concentrate an organization's most sensitive intellectual property in ways that were not true even five years ago. 

The security implications are direct. As Dell's President and Chief Security Officer, John Scimone, observed in a blog post last October: "Hackers go where the data is," and increasingly, that means where the AI is. 

This changes the risk calculus for leadership teams in a fundamental way. AI governance and data security are not separate conversations to be routed to different functions. They are two sides of the same strategic question: can we trust the systems on which our business depends?

An integrated, whole-of-company approach to risk and opportunity is no longer a best practice. It is a baseline.

Infrastructure as strategy

For much of the past decade, infrastructure was treated as a commodity, something to outsource, abstract away, or procure from whichever cloud provider offered the best commercial terms. AI has reversed that logic.

Where data resides, who controls it, and under what jurisdictional framework it is processed have become board-level questions. The concept of sovereign AI ensuring that data sovereignty, model ownership, and operational continuity remain under an organization's own governance is moving to practical architecture decisions.

The question organizations must now answer is not merely which AI tools to deploy, but what kind of AI platform to build on. 

Finland's moment if it chooses to take it

Finland carries some genuine advantages into the AI era. 

The Nordic country has technology-oriented people. Digital literacy runs deep. Trust in institutions, a precondition for data-sharing and AI deployment at scale, remains comparatively high.

And yet the Finnish economy has not grown. That is the uncomfortable fact sitting alongside those advantages.

AI offers a path to a growth leap that organic development alone cannot provide. The United States offers a preview: a meaningful share of recent GDP growth is now attributable, directly or indirectly, to AI-driven productivity. Projections for the coming years are more striking still. The same potential exists here. But potential is not destiny.

What is required is a change from companies, from workers, and above all from leaders. The AI revolution is not arriving. It has arrived. The only useful question now is what each organization will do about it.

The best place to start is with oneself. Leaders who have done that internal work, who have actually changed how they operate, not merely approved a strategy slide, are the ones driving genuine transformation in their organizations. At Dell, we have trained for this, measured it, and held ourselves accountable to it. We want to be the best reference for what we preach.

Governance is not the brake. It is the engine

Some leaders worry that governance frameworks will slow AI innovation. The concern is understandable but misplaced.

Ungoverned AI does not move faster. It moves recklessly, accumulating hidden liabilities in data quality, security exposure, regulatory risk, and organisational trust that eventually force a costly reckoning. "Governance is not about slowing down innovation," Roese argues. "It's about building the guardrails that allow us all to accelerate safely and sustainably." 

The organizations that will succeed with AI over the next decade are not necessarily those with the most impressive early pilots. They will be those who built the infrastructure, governance, and cultural readiness to operate AI at scale reliably, securely, and with clear accountability.

AI can help address major global challenges. But that requires trust. And trust requires governance. The opportunity is immediate, and so is the risk of inaction. Delays now will be difficult to reverse later.

Finland has the technological capability and institutional foundations. What remains is leadership, the courage to build trust and take the growth leap within reach. The work does not start with another strategy document, but with each leader choosing to step into the unknown. In a race already underway, delay is not neutral. It is a decision to fall behind.

“In Finland, we need further alignment regarding the notion that strong value creation is important from a national interest perspective. The more successful our companies are, the more growth, investment, and well-being they generate for Finnish society,” says Solidium’s new CEO, Matts Rosenberg.

For Rosenberg, the current environment creates increased demand for active ownership. There is a deeper structural issue in Finland, one that goes beyond strategy and into how companies are owned, governed, and ultimately pushed to perform.

Learnings from Sweden

Matts Rosenberg has over 20 years of experience in active ownership, of which a decade was in Sweden, a country with a strong culture and heritage of active ownership and ambitious value creation. That experience shapes his view of what Finland could become.

“Finland has more potential than it has so far managed to realize,” he says.

In Sweden, ownership culture is more explicit and more assertive. Long-term owners, such as the Wallenberg sphere, have demonstrated how active and engaged ownership can shape companies across generations. In that context, value creation and national interest are not competing priorities, but mutually reinforcing outcomes.

Rosenberg’s perspective reflects that model. The guiding principle is that ownership is not a passive position, but a continuous responsibility to communicate the owner’s view in relation to the level of ambition, direction, and targets.

Finland’s structure has been different. A smaller capital base and a fragmented ownership landscape with a lack of active owners have left a gap that Solidium was originally created to fill.

The real bottleneck: execution, not strategy

Beneath the surface, a more uncomfortable reality is emerging. Finnish publicly listed companies do not appear to lack strategic ambition. What they lack is the ability to execute change consistently.

Evidence of this has been highlighted in research by Saara Karasvirta, featured in Helsingin Sanomat HS Visio. Based on interviews with 33 change leaders across 11 large companies, the study finds that transformation efforts are often inconsistent and dependent on individuals rather than institutionalized processes.

What begins as a management challenge increasingly points elsewhere. In that sense, the problem is not only operational. It is one of ownership and governance.

From passive owner to active partner

As the Finnish State’s investment arm and a minority shareholder in nationally important companies, Solidium sits at the intersection of ownership and influence. Its updated strategy places greater emphasis on growth, transformation, and long-term value creation—not only for its portfolio companies, but for Finnish society more broadly.

Historically, state ownership in Finland has been associated with stability and long-term stewardship. But it has also, at times, been perceived as passive. Solidium’s new direction challenges that legacy. Rather than acting as a traditional asset manager, the organization is seeking to operate as an active owner—one that shapes outcomes inside its portfolio companies rather than merely observing them.

“We don’t see ourselves as just managing assets. Our role is to be an active owner—creating impact through nomination committees, board work, and continuous, constructive dialogue with co-investors and key stakeholders, particularly board chairs. The level of ambition and competence within boards is critical, and if we want stronger outcomes, for example, in terms of value-creating growth, we need to actively ensure that we have the right people around the table,” says Rosenberg.

In practice, this means influencing board composition, strengthening governance, and using ownership as a lever to drive the level of ambition and direction. Value creation is pursued not only through capital allocation, but through sustained engagement with companies and their leadership. 

The shift is subtle in language, but significant in implication: the shift from passive to active and engaged ownership is centered on communicating educated shareholder views regarding the ambition level. Creating strong alignment among key stakeholders (owners, boards, and management) is a prerequisite for successful value creation journeys. Target setting and incentive design play an important role in achieving this.

This shift is not happening in isolation. Similar themes have recently emerged from other major Finnish institutional owners. As explored in Listeds’ article on Ilmarinen’s governance approach, nomination committees have become one of the most strategic tools for shaping company direction, effectively determining who sits around the table when the most consequential decisions are made.

Together, these developments point to a broader evolution in Finnish ownership culture: from passive stewardship toward active, engaged governance.

That ambition carries weight. Solidium’s portfolio includes some of Finland’s most significant companies, such as Nokia, Sampo, Stora Enso, Valmet, Outokumpu, Nokian Tyres, Anora, and ICEYE. Changing how they are owned and guided has implications far beyond individual balance sheets.

Defining full potential

At the core of Solidium’s approach is a simple but demanding question: what is the full potential of each company? 

“Active ownership starts with ambition. We need to define what the full potential of a company really is, and then align everything behind reaching that.”

This is about setting a level of ambition that reflects what the company could achieve under optimal conditions.

Making ownership visible through dialogue

Equally important is the role of continuous dialogue.

“Active ownership is not about occasional intervention. It is about continuous, constructive dialogue — building a shared understanding of direction and targets,” says Rosenberg.

Yet the long-term ambition is not to entrench the ownership indefinitely.

“In the long run, it would be a positive development if the market evolves to a point where Solidium's role could be smaller,” says Rosenberg.