Cloud sovereignty becomes a boardroom issue: What the EU tech sovereignty package means for DACH
Tobias Massow
6 min read The EU unveiled its Tech Sovereignty Package on 27 May. It proposes restricting the use of ...
Read Article
⏱ 7 min Reading Time
IT budgets are growing double-digit in 2026 – but cost pressure remains real: scaling AI, achieving NIS2 compliance, and consolidating security tooling all compete for the same scarce resources. CIOs who execute just three priorities excellently – rather than ten adequately – will deliver a measurable competitive advantage to their companies. Here’s a look at the three levers that will make the difference in 2026.
TL;DR
- 📊 The 2026 Budget Paradox: Gartner forecasts 11% growth in IT spending across Europe – but AI scaling, NIS2 compliance, and security upgrades are consuming that growth faster than it arrives.
- 💰 FinOps as an immediate lever: Cloud cost optimization saves 20-30% of cloud spend, according to the FinOps Foundation. Freed-up budget funds innovation – not infrastructure.
- 🎯 Three, not ten: Siemens CIO Hanna Hennig sets the standard – radical prioritization on a handful of strategic initiatives outperforms scattergun investment.
- 🔒 Security consolidation: Companies average 45 security tools (Gartner). Reducing to 10-15 core tools cuts license costs and improves threat detection rates.
- 🏢 The CIO at the executive table: Anyone still operating as a cost-center administrator in 2026 forfeits influence. The role is shifting decisively toward business strategist – with quantifiable value contribution.
The 2026 CIO agenda reads like an exercise in applied impossibility: more innovation, more security, more compliance. Germany’s economic uncertainty allows no room for misallocation – yet the strategic necessity of these investments has never been greater.
The way out lies not in securing more budget – but in sharper prioritization. The CIOs who succeed in 2026 will be those who execute three things exceptionally well – and consciously defer the rest.
The Budget Dilemma: Double-Digit Growth, But No Breathing Room
According to Gartner, European IT budgets will grow 11 percent in 2026, reaching approximately $1.4 trillion. Globally, Gartner forecasts 10.8% growth. That sounds comfortable. It isn’t.
At the same time, demands are exploding: AI implementation, NIS2 compliance, CSRD data requirements, preparation for the EU AI Act, cloud modernization, and compensating for the IT skills shortage. That budget increase is fully committed before it even hits the ledger. Treating every demand as equally urgent spreads resources so thinly that no initiative reaches critical mass. The result? Started everywhere – finished nowhere.
Successful CIOs resolve this by embracing radical prioritization: Not five strategic initiatives – but three. Not ten AI pilot projects – but two, fully funded through to scale. Siemens CIO Hanna Hennig exemplifies this approach: She concentrates IT strategy on a few transformative initiatives – like Zero Trust security and AI-powered automation – rather than running dozens of parallel projects. The art lies not in saying yes, but in saying no.
Priority 1: Moving AI from the Sandbox to the Value Chain
2025 was the year of AI experimentation. 2026 must be the year of AI-driven value creation. The board no longer asks whether AI works – it asks what it contributes to the bottom line.
That requires a paradigm shift in AI governance: away from isolated, use-case-driven pilots – and toward a unified AI platform strategy that establishes scalable foundations. Data quality, model management, monitoring, and compliance become shared services. Business-unit-specific applications are then built on top.
The hardest decision? Halting AI projects with unclear ROI – not because they’re technically flawed, but because capacity is needed for initiatives that demonstrably create value. AI portfolio reviews should happen quarterly, using the same criteria applied to any other capital investment. For those seeking regulatory guardrails: The EU AI Act 2026 defines the boundaries.
Concretely, this means: Every AI project must have a business sponsor who quantifies its expected value contribution. Projects delivering no measurable ROI after six months get terminated. It sounds harsh – but it prevents the trap many companies fell into in 2025: numerous pilots, zero scaling, no business impact.
Priority 2: Cloud FinOps as an Efficiency Lever
For many organizations, cloud bills have spun out of control. Cloud costs are rising faster than cloud usage – a clear signal of inefficiency.
FinOps offers one of the few levers enabling CIOs to free up budget immediately. According to the FinOps Foundation, typical savings range from 20-30%. In the “Crawl” phase – the first 30 days – companies often achieve 10-20% reduction without touching infrastructure.
Quick wins are well known: identify and shut down idle resources; purchase Reserved Instances for predictable workloads; right-size oversized instances. The strategic lever runs deeper: architectural decisions that structurally lower costs – serverless over always-on; Spot Instances for batch-friendly workloads; multi-cloud arbitrage for standardized services.
A dedicated FinOps team – even as a sub-function within the cloud team – typically pays for itself within the first month. For those ready to go deeper: The FinOps guide on cloudmagazin.com outlines the practical entry path.
Priority 3: Cybersecurity Without Budget Explosion
NIS2 makes executives personally liable. Cyber insurers now require technical assessments. The threat landscape is escalating. And cybersecurity budgets remain finite.
The solution? Security consolidation. Per Gartner, companies average 45 distinct security tools. Consolidating onto an integrated platform – or reducing to 10-15 core tools – cuts licensing costs, reduces complexity, and improves detection rates.
In parallel: Automating security operations. SOAR platforms (Security Orchestration, Automation and Response) can automatically handle 80-90% of routine alerts, per industry analysis – freeing SOC teams for high-complexity incidents.
And finally: Security awareness as a continuous program – not an annual compliance checkbox. Investing in human firewall competence delivers the highest ROI in any security budget. What’s truly at stake is laid bare in the NIS2 overview on SecurityToday: personal executive liability and fines up to €10 million.
IT SPENDING EUROPE
+11 %
Growth in European IT spending in 2026 (Gartner, Feb 2026)
FINOPS SAVINGS
20-30 %
Cloud cost reduction via FinOps (FinOps Foundation, 2025)
SECURITY TOOLS
45
Average number of security tools per enterprise (Gartner, 2025)
“Never accept the status quo. Technology is not an end in itself – it must deliver measurable business value. If a project fails to do that, stop it.”
– Hanna Hennig, CIO, Siemens AG
The Evolving Role of the CIO
The CIO of 2026 is no longer a technology manager. They are a business strategist, deploying technology as a lever to achieve business goals. Consider Siemens: Hanna Hennig doesn’t sit in the basement managing servers. She actively co-shapes corporate strategy – from Zero Trust to the AI platform.
This demands three shifts: From project delivery to portfolio management. From cost-center justification to value-creation storytelling. From managing an IT organization to building digital capability across the entire enterprise.
The most successful CIOs in 2026 won’t measure themselves by SLA adherence or uptime – but by business KPIs: revenue growth via digital channels, time-to-market for new products, cost reduction through automation, and enterprise-wide compliance maturity. How this plays out at board level is analyzed in the Digital-Chiefs article on tech competence in supervisory boards.
Anyone still holed up in the IT corner, waiting for budget approval, has missed the last five years of evolution. The CIO seat is at the executive table – but only if they speak the language of business and quantify IT’s contribution to the bottom line.
Checklist: What CIOs Should Do Now
The three priorities are clear. But what does execution look like over the next 90 days? Five concrete steps:
1. Conduct an AI Portfolio Review. Bring all active AI projects to the table. Each needs a business sponsor and a measurable KPI. Projects lacking both? Stop or defer.
2. Launch a FinOps Quick Scan. Analyze cloud spend over the past six months. Shut down idle resources. Evaluate Reserved Instances for your top-10 workloads. Target: 15% savings in 30 days.
3. Inventory Security Tools. List all active security licenses. Identify overlaps. Co-develop a consolidation plan with your CISO.
4. Assess NIS2 Readiness. Perform a gap analysis against NIS2 requirements. Close critical gaps within the next 90 days. Personal liability is not an abstract risk.
5. Reframe Board Reporting. Shift from technical KPIs to business metrics. Translate every IT initiative into revenue impact, cost reduction, or risk mitigation.
Frequently Asked Questions
How much should a company spend on IT in 2026?
As a rule of thumb: 4-6% of revenue for typical mid-sized firms; 6-10% for technology-intensive industries. More important than the absolute figure is allocation: allocate at least 30% toward innovation and transformation – not just run-the-business operations.
Should I invest in AI if the ROI is unclear?
Yes – but focus is essential. Invest in two or three use cases with a clear business case and measurable KPIs. Avoid broad, unfocused AI exploration without defined success metrics. If a use case shows no measurable value after six months, terminate it – and redirect that budget to the next priority.
How do I convince the CFO to approve IT investments?
With business metrics – not technical arguments. Translate every IT investment into revenue impact, cost reduction, or risk mitigation. Use benchmarks – and show the cost of not investing: opportunity cost, compliance exposure, and competitive disadvantage.
Is multi-cloud the right strategy for 2026?
For most enterprises, yes – but only if deliberately governed, not organically grown. Multi-cloud reduces vendor lock-in and boosts resilience. Its challenge is complexity. Cloud management platforms and mature FinOps processes are prerequisites – without them, multi-cloud becomes a cost driver, not a strategic asset.
How do I address the IT skills shortage?
Deploy three parallel strategies: First, upskill existing staff – especially domain experts into citizen developers. Second, deploy AI-powered productivity tools: One developer with a copilot outperforms two without. Third, enhance employer appeal: Developer experience, remote flexibility, and mission-driven projects matter more to IT talent than salary alone. Our deep-dive on AI copilots as force multipliers details how CIOs are executing this.
Further Reading Across the Network
- → Digital Due Diligence: Why M&A Deals Fail on IT Grounds – Systematically Assessing Technology Risk (Digital Chiefs)
- → The Digital Supervisory Board: Why Tech Competence on the Board Is a Matter of Survival – Why Tech Expertise in the Supervisory Board Is Essential (Digital Chiefs)
- → EU AI Act 2026: What Companies Must Implement Now – Regulatory Guardrails for AI Projects (Digital Chiefs)
- → FinOps: Taking Control of Cloud Costs – A Practical Guide to Cloud Cost Optimization (cloudmagazin)
- → NIS2 in Germany: What Companies Need to Know Now – Personal Liability and Fines Explained (SecurityToday)
Header Image Source: Unsplash / Scott Graham