When did a supplier choice become a geopolitical question?

Geopolitics, technology and security are increasingly interconnected – and impact our freedom to act.

Geopolitics is no longer something “out there”. It is moving straight into the decisions we make about technology, security and resilience.

That was one of my clearest takeaways from the Cyber Security Symposium hosted by Radar.

For organisations responsible for critical infrastructure, this changes the conversation. Geopolitical risk is no longer primarily something for threat intelligence, government affairs or the annual risk assessment. It increasingly affects technology choices, architecture, suppliers and ultimately our ability to keep critical services running.

Technology has become part of geopolitics

For many years, technology decisions were primarily evaluated through functionality, cost, security and operational performance.

Those criteria remain important. But they are no longer enough.

We increasingly need to ask other questions.

Where does our technology come from? Who controls it? Which jurisdictions affect our suppliers? What happens if access to a service, platform, component or capability is restricted?

And perhaps most importantly:

What happens if something we depend on is suddenly no longer available to us?

Radar highlighted China as an increasingly important force of change. After Huawei and 5G, the discussion is moving into new areas: AI models, robotics, power electronics, drones and other technologies that are becoming embedded in critical infrastructure.

At the same time, geopolitical blocs are hardening. Regulation, trade policy, industrial policy and national security are becoming increasingly intertwined.

The consequence is simple: supplier dependencies that once looked commercial can become strategic.

Supplier risk is becoming continuity risk

This is particularly relevant for organisations operating critical infrastructure.

A supplier can be financially stable, technically capable and fully compliant – and still represent a significant resilience risk.

The question therefore cannot stop at:

Is this a secure supplier?

We also need to ask:

• Can we switch if we need to?
• How long would that take?
• What needs to continue working during the transition?
• Which data, competence and operational capabilities must remain under our own control?

This changes how we should think about third-party risk.

Supplier management, cyber security, architecture and business continuity can no longer be treated as separate disciplines. They increasingly describe different aspects of the same dependency.

Sovereignty is about freedom to act

This also changes the discussion about digital sovereignty.

The debate often focuses on where data is stored. That matters – but sovereignty is broader than data residency.

For me, the more useful question is:

What freedom do we have to act when circumstances change?

Can we operate a critical process without continuous access to a particular cloud service?

Can we move workloads?

Can we change an AI model or technology provider?

Do we have access to our own data in a usable format?

Do we retain the competence required to operate or rebuild critical capabilities?

And do we understand which dependencies would become critical in a geopolitical crisis?

That is where sovereignty starts to become an operational resilience question rather than an abstract policy discussion.

From planning to action

There is also a danger in responding to this development by creating yet another strategy.

An AI strategy. A cloud strategy. A sovereignty strategy. A cyber strategy.

The discussion at the symposium reinforced something I think is increasingly important: we need to move from strategy towards tactical understanding and action.

For CISOs, security managers and resilience leaders, that could start with something quite practical.

Take a critical service and map the technology and supplier dependencies behind it. Then challenge the assumptions.

What if one important supplier disappeared?

What if access to a cloud platform became restricted?

What if AI capacity became scarce or prioritised elsewhere?

What if a component could no longer be maintained?

How long could the service continue?

That exercise connects geopolitics with something management teams already understand: business impact and continuity.

A question for the next risk review

Perhaps the most useful question is therefore not which geopolitical scenario we believe is most likely.

It is:

Which dependencies do we have today that we would not choose if we were designing the organisation from scratch?

That is a conversation worth having before circumstances force us to have it.