Great-Power Competition Rewrites Global Tech Policy Map
Great-power rivalry is back—and technology is the terrain. Enterprises must navigate fragmented rules on data, chips, and AI as states use policy to project power.
Executive Summary
Great-power rivalry has moved from history books into your operating plan. Technology is now a primary instrument of state power, fracturing rules across data, chips, and AI. Enterprises need sovereignty-aware architectures, automated compliance, and resilient supply chains. Those who institutionalize geopolitics in their operating model will out-execute peers.
- ▸Geopolitics is now embedded in technology policy and market access.
- ▸Design for sovereignty: regional data, keys, and modular product features.
- ▸Automate compliance: policy-as-code, continuous screening, auditable AI.
- ▸Dual-source critical inputs and validate alternate designs for resilience.
- ▸Adopt scenario triggers to move ahead of enforcement cycles.
Context: State power returns to the digital arena
The short-lived era of unchallenged globalization is giving way to renewed great-power competition. Technology has moved from being a neutral conduit of commerce to a strategic lever of national power. Governments now shape markets through export controls, investment screening, procurement, standards, and data regimes—often with explicit geopolitical ends.
For enterprise leaders, this is not a narrative shift; it’s an operating reality. Supply chains, cloud architectures, capital flows, and research partnerships are increasingly bounded by policy. The playbook of scale-first, border-agnostic growth is being replaced by a model that prizes resilience, regulatory adaptability, and regionally tuned product and data strategies.
Why this matters for enterprises
- Regulatory divergence is accelerating: competing data sovereignty rules, AI governance frameworks, and cyber mandates.
- Supply chains are being rewired: friend-shoring, dual-sourcing of critical inputs (especially semiconductors and specialty components).
- Standards are strategic: technical standards are now arenas for influence, with different blocs pushing competing frameworks.
- Capital and talent mobility face new filters: outbound investment screens, national security reviews, and sensitive research restrictions.
Policy shifts to monitor
- Export controls and investment screening: Expanded restrictions on advanced chips, compute services, and certain AI capabilities; growing oversight of outbound and inbound investments into sensitive tech.
- Data sovereignty and localization: Stricter rules on cross-border data flows; public-sector cloud procurement increasingly conditioned on local control and auditability.
- AI governance: Risk-based AI rules, sectoral safety obligations, and transparency requirements that differ by jurisdiction; potential obligations on foundation model disclosures and safety testing.
- Cybersecurity mandates: Baseline security controls, incident reporting timelines, and software bill of materials expectations that cascade across supply chains.
- Sanctions and trade policy: More dynamic sanctions lists and tariff regimes forcing continuous vendor, customer, and partner screening.
The enterprise playbook
- Build multi-geography operating models: Design product, data, and go-to-market variants aligned to regional policies (Americas, Europe, Indo-Pacific, Middle East).
- Invest in compliance as a capability: Treat regulatory intelligence, sanctions screening, and export-control classification as core, automated functions rather than project-by-project work.
- Architect for sovereignty: Adopt cloud regions, key management, confidential computing, and data residency controls that can be tuned per jurisdiction.
- De-risk critical inputs: Dual-source semiconductors and high-dependency components; develop buffer inventory and alternate designs to accommodate node or vendor switches.
- Institutionalize geopolitical scenario planning: Tie policy scenarios to trigger-based action plans for product, pricing, and supply decisions.
AI-specific considerations
- Compute governance: Expect tightening oversight on access to advanced compute and model training at scale; be prepared to attest to data provenance, model lineage, and risk controls.
- Model export and access controls: Segment model capabilities by market; restrict or degrade certain features where rules or risk profiles demand it.
- Secure data pipelines: Implement robust data loss prevention, encryption, and synthetic data strategies to maintain utility while meeting localization and privacy obligations.
- Assurance and reporting: Prepare for model cards, safety testing documentation, incident reporting, and third-party audits as table stakes.
Operating model implications
- Create a geopolitics and technology policy desk: A permanent function spanning legal, security, engineering, and supply chain that monitors policy, maps it to controls, and triggers responses.
- Shift to policy-resilient architecture: Modularize products and platforms so components can be swapped, disabled, or reconfigured without full redesign.
- Automate controls: Deploy policy-as-code for data residency, encryption, access, and logging; integrate export and sanctions checks into CI/CD and sales workflows.
- Board oversight: Elevate technology policy risk to board-level dashboards with clear risk appetite statements and measurable KPIs.
KPIs and triggers to track
- Lead time variance for constrained components (especially chips) across regions.
- Percentage of data assets with verified residency and key ownership controls.
- Time-to-comply for new regulatory obligations from draft to enforcement.
- Coverage of automated sanctions/export checks across vendors, customers, code, and models.
What to watch next
- Semiconductor capacity and policy: Incentives, restrictions, and ecosystem build-out will determine the reliability and cost of advanced compute.
- Cloud sovereignty and public procurement: National preferences and audit requirements will shape where and how you deploy workloads.
- AI standards and enforcement: Convergence or divergence among major markets on risk classifications, safety testing, and transparency will drive product design.
- Alliances and digital trade: Emerging agreements may open corridors for compliant data and services, while rival blocs entrench competing regimes.
Executive bottom line
Great-power dynamics are now embedded in technology policy. Treat this as a design constraint and a strategic advantage: the firms that operationalize regulatory adaptability, sovereignty-aware architecture, and supply chain resilience will capture growth while competitors stall in compliance drag.
Executive Perspective
The unipolar, border-light model that fueled tech scale is over. Today, state priorities shape markets, and technology is the leverage point. As executives, we should assume policy divergence persists and build systems that thrive under constraint—modular platforms, controllable data perimeters, and multi-regional routes to revenue.
I advise treating policy as a programmable parameter. Embed regulatory intelligence into code and supply workflows, design products with feature flags for jurisdictional variance, and construct a compute and data posture that can pivot as controls tighten. This turns geopolitics from external noise into a managed variable—and a source of competitive speed.
What This Means for Organizations
Structurally, enterprises need a durable cross-functional capability that fuses legal, security, engineering, and supply chain into a single policy operations desk. Its mandate: translate evolving rules into technical controls, product variants, and supplier actions—continuously, not episodically.
Operationally, adopt policy-resilient architectures: sovereign cloud patterns with local key control, confidential computing for sensitive workloads, and modular product builds. Pair this with automated sanctions/export checks at quote-to-cash and code-to-prod, and with tiered supplier strategies for critical components and compute capacity.
Strategic Impact
Strategy must assume persistent fragmentation. Growth plans should include region-first product designs, pricing calibrated to policy risk and supply volatility, and capital allocation that favors optionality—such as multi-region capacity and flexible compute contracts.
Decision-making should be scenario-driven with clear triggers. Tie regulatory milestones to go/no-go product features, supplier switches, or data localization moves. This creates a repeatable rhythm for acting ahead of enforcement rather than reacting under duress.
Operational Implications
Implement policy-as-code across data and infrastructure: enforce residency, encryption, access, and logging by region; instrument CI/CD to block non-compliant deployments. Integrate automated export and sanctions screening into CRM, procurement, developer repositories, and MLOps pipelines.
Re-qualify suppliers and designs for critical components. Maintain alternate BOMs and validated second sources; track component and region exposure. For AI, maintain model lineage, dataset inventories, and usage controls for sensitive geographies and sectors.
Future Outlook
Expect further bifurcation of standards and controls across major blocs, with occasional convergence on safety and security baselines. Semiconductor policy, cloud sovereignty, and AI assurance will be the pressure points that determine cost, speed, and market access.
Winners will combine regulatory fluency with engineering discipline. Organizations that codify compliance, design for sovereignty, and maintain supplier optionality will gain share as policy headwinds intensify. Those that delay will face rising costs, slower releases, and shrinking addressable markets.
- • Pricing power will correlate with policy resilience and supply optionality.
- • Regional product and data variants become a core growth enabler.
- • Compliance automation reduces execution drag and audit risk.
- • Capital allocation shifts toward sovereign cloud and multi-region capacity.
- • Prepare for granular controls on compute access and model export.
- • Institute model lineage, provenance, and safety documentation as defaults.
- • Segment AI capabilities by jurisdiction with feature flags and guardrails.
- • Adopt confidential computing and synthetic data to satisfy localization.
This analysis was inspired by reporting from Brendan Simms’s new novel asks, have great powers returned?. All analysis, commentary, and strategic perspective is original work by Geraldine Vilato.