Sovereignty by design: Building New Zealand's digital resilience

Artificial intelligence, cloud computing and data are embedded in almost every part of modern life. Our public services and many critical organisational functions depend on them. Technology decisions are no longer simply questions of procurement or IT architecture. They are connected to much bigger issues of digital resilience, national security and economic performance.

Digital sovereignty is ultimately a capability question: whether governments and organisations can exercise choice and control over critical systems and maintain continuity as risks and circumstances change. While in the past that may have meant relying on on-premises infrastructure in New Zealand, such an approach no longer meets the moment, especially given the scale and potential destructive impact of contemporary cybersecurity threats, as well as other risks highly relevant to New Zealand, like natural hazards.

Against that backdrop, local infrastructure and capabilities can only be one aspect of our data sovereignty. Indeed, Gartner forecasts that developed nations building a sovereign AI stack will need to spend at least 1% of GDP on AI infrastructure by 2029. Therefore, the central choice is not between connection or isolation, or local versus global.

It is vulnerability versus resilience: which combination of capabilities provides meaningful control, strong security and credible continuity in a rapidly evolving world?

The three dimensions of digital sovereignty

An organisation's ability to maintain access to compute and keep its data safe isn't determined by location. As legal firm Simpson Grierson has noted recently: "data sovereignty is a risk and governance outcome, not a hosting-location decision." In practical terms, sovereignty comes down to choice, control and continuity: understanding critical dependencies, protecting what matters most, preserving credible alternatives and retaining the ability to adapt.

It requires balancing control, security and resilience. Strengthening one dimension in isolation can create costs or vulnerabilities elsewhere.

Control

Control refers to who can access systems. Local infrastructure – whether that's on-premises or a modern cloud ecosystem – provides important benefits, especially when agencies have legal data residency requirements. Yet an excessively isolated environment can accumulate technical debt, become expensive to maintain and limit the ability of institutions to adopt better capabilities as they emerge, stifling growth, productivity and innovation, as well as creating a security risk.

Ensuring the appropriate level of control is less about geography and more about these questions:

• Who owns the data?
• Who can access, use, retrieve or delete it?
• What contractual, legal and technical safeguards make those rights enforceable?
• Can the organisation move its data or services if legal, operational or strategic circumstances change?

Security

Security is how control is expressed practically, particularly defence from cyberattacks.

Cyber intrusions are one of the principal threats to any nation's sovereignty, which is why cyber defence has to be a national priority. As Microsoft's 2026 Digital Defence Report makes clear, cybersecurity is now a continuous, industrial-scale contest involving organised criminal groups and nation-state actors operating across interconnected ecosystems.

In the first half of 2026, government agencies and services were the most-frequently targets of cyber activity, accounting for 27% of attacks globally.

AI is changing that contest by lowering the cost and expertise needed to mount cyberattacks and, critically, increasing their speed. Activities that once took hours or days can now take minutes or even seconds. Defence therefore also needs to operate at speed and scale, rapidly identifying emerging threats, sharing intelligence and taking coordinated action.

That scale provides a significant defensive advantage. Microsoft processes more than 165 trillion security signals every day across identities, devices, email, applications and cloud environments. Those signals generate threat intelligence that helps identify emerging attack patterns and strengthen protections across the platform, creating a continuous cycle of detection, learning and defence.

As the Digital Defence Report notes: "No government or company has complete visibility across the threat landscape. Effective cyber resilience therefore depends on trusted partnerships that combine public-sector leadership, private-sector innovation and international cooperation, with roles, escalation paths and practical coordination established before a crisis."

Important considerations to maximise security include:

• Are protections backed by sufficient investment, specialist capability, continuous monitoring and independent assurance?
• Can the organisation verify that controls are operating effectively?
• Are responsibilities between the technology provider and the customer clearly understood?

Resilience

Resilience refers to the level of redundancy in place, including how quickly a service can recover in a crisis.

We know that isolation does not create resilience. Concentrating critical capabilities within one country or region can also reduce the options available if disruption affects vital infrastructure, creating a common point of failure and longer recovery times.

An excessively isolated environment can accumulate technical debt, become expensive to maintain and limit institutions' ability to adopt better capabilities as they emerge, stifling growth, productivity and innovation, as well as creating a security risk.

The lesson from Cyclone Gabrielle, where communications and electronic payments networks were affected, is that multiple backups are often required. In some places, even functioning cell sites could not connect users because wider backup links had been damaged. Alternative connectivity routes were established via satellite and microwave technology until fibre cables were repaired.

Global capability can support continuity, recovery and preservation of critical data. While the scale of a multinational digital services provider can't guarantee zero disruptions, it can support levels of geographic redundancy, security investment, specialist expertise and threat visibility that would be unachievable for most organisations working on their own.

Here, the most relevant questions when reviewing technology options are:

• Can critical services continue or recover if local infrastructure is damaged?
• Are backups, recovery arrangements and external dependencies understood and regularly tested?
• Does the architecture provide more than one credible route back into operation?

A combination of local and global technology also allows New Zealand to make more of its own resources to support better decision-making – something that lies at the heart of our digital sovereignty.

During the post-quake Canterbury rebuild, frustrations around fragmented access to geotechnical data spurred the development of the New Zealand Geotechnical Database, a central cloud-based repository that brings together data about what's under the ground to enable faster, more informed decisions about where and how to build. With the addition of Microsoft cloud and AI tools, this is now allowing engineers and developers to find information they couldn't before.

Creating a truly resilient future

Enabling and maintaining access to the compute required for local organisations, employment and the economy to thrive, while keeping citizens' data safe, is a key sovereign duty of Government. In the AI era, access to advanced computing, modern security capability and continuing technological innovation will increasingly influence productivity, public-sector performance and economic participation.

A 2025 Mandala report found that strategic development of AI applications and AI datacentres together could generate $3.4 billion for our economy by 2035, through new revenues and productivity savings.

Greater control and greater opportunity are not competing objectives. New Zealand can strengthen domestic skills, research, startups and technology providers while using international platforms, infrastructure, capital and partnerships to compete at global scale.

Sovereignty by design means using global technology on New Zealand's terms. By making deliberate, informed choices on which combination of local and global capability delivers the best outcomes, New Zealand can greatly improve the digital resilience of its national infrastructure, security and economy, while retaining control over the things that matter.