Multinationals have long benefited from globalizing their technology development and operations. Pooling data, standardizing software, and centralizing hardware and staff have enabled global companies to convert scale into a driver of efficiency and, ultimately, competitive advantage. But today, the fragmentation of technology along geopolitical fault lines, due largely to competition over the development of AI, is turning globalization into a liability—and a source of major strategic risk.
In the real world, this risk plays out in myriad ways among multinationals. In one specific market, a US-based consumer electronics manufacture had to revise its product and turn to a local AI provider to power it in order to avoid running afoul of potential software use restrictions. A European company with foreign ownership risks losing access to critical hardware for its products due to export restrictions tied to its ownership structure. An Asia-based machine tool manufacturer could not standardize the software embedded in its products because the software had to comply with different regulatory regimes.
In each of these stories, sudden regulatory action resulting from volatile geopolitical tensions disrupted a multinational’s strategy and operating model and affected its ability to cost-effectively deploy or adapt technology across geographies. If this sounds like a board-level problem, that’s because it is. Whereas previously, “IT resilience” was a matter of maximal uptime or business continuity, today it is existentially significant. As such, boards need to test and support their management teams' efforts to plan for the increasing possibility that technology-driven geopolitical turbulence will upend their core business—not merely to ensure continuity but also to maintain access to growth markets and create strategic advantage.
BCG Henderson Institute Newsletter: Insights that are shaping business thinking.
How the Risk of Regulatory Disruption of Technology Is Changing
More than ever, the world’s largest economies are intertwined. Today, approximately 40% of S&P 500 companies’ revenues are generated in foreign markets. Talent is spread across the globe, too—a trend that has had a big impact on technology: 45% of the tech staff (excluding IT help desk roles) at the world’s largest companies are located outside their headquarters country. And in 43% of the companies analyzed, tech staff was split across ten or more foreign markets. (See Exhibit 1.)
Moreover, in the past decade, exports of digitally deliverable services (for example, financial, health, and education services), as opposed to services that are not digitally deliverable (such as maintenance and repair or transportation), have outpaced growth of overall exports of services. (See Exhibit 2.) So while the world’s economy became more globalized, technology became more central to the flow of goods and services across national boundaries.
Collectively, these trends leave global players exposed to technology-related geopolitical disruptions—and hence to the regulatory changes shaping the technology landscape—to an unprecedented degree. Of course, technology regulation is not new. As of 2022, an estimated 80% of the world’s data was already subject to transnational mobility restrictions of some kind. (See Exhibit 3.) In the medium term, we expect that data nationalism will not abate, but rather will continue to drive growth in sovereign cloud: According to the International Data Corporation, sovereign cloud’s share of global infrastructure-as-a-service (IaaS) revenues will grow by 9% per year through 2028.
The shift that has elevated IT resilience from an operational concern to a strategic imperative reflects the increased intensity, complexity, and volatility of the regulatory environment that multinationals face.
Intensity: A Global Push for Technological Sovereignty
In the past, the objectives underlying most technology regulation were to ensure consumer protection and healthy competition in the tech sector. With the rise of generative AI (GenAI), however, government leaders are increasingly emphasizing a different set of priorities: national security and technological sovereignty. (See Exhibit 4.)
As the recent Paris AI Summit made clear, governments around the world worry about the high concentration of AI supply in a handful of players, most of them headquartered in the US or China. Indeed, our research indicates that most countries lack the enablers to become self-sufficient suppliers of AI.
But because the stakes are so high, countries are unlikely to remain idle. Fears about AI supply concentration will push many governments to impose tighter and broader restrictions on the use of technologies within their jurisdictions. We expect regulations to proliferate across data, software, and hardware, resulting in accelerated fragmentation of markets and compliance regimes.
Complexity: The Moving Goalposts of Regulatory Liability
The ways in which regulatory mechanisms are applied are becoming less evident and are evolving constantly. Companies today are subject to government-mandated restrictions not only on the basis of where they are headquartered or which markets they operate in, but also as a consequence of their ownership structures.
For example, the Biden administration made ownership rather than headquarters location the determinant for its AI chip and model export restrictions. Aside from ownership, regulators can target specific revenue and operating model configurations. The US AI Diffusion Framework, for example, sets specific limits on the geographic distribution of a cloud provider’s computing power. Companies that do not stay within those limits risk losing access to the most advanced chips. This may be the case for Oracle, whose current distribution of computing power exceeds the non-US capacity threshold imposed on hyperscalers (which mandates that no more than 50% of computing power may be located outside of the US).
These rules, enacted in the past year, were hardly predictable. We anticipate that companies will face additional challenges as governments become more creative in imposing restrictions to close potential regulatory gaps.
Volatility: Geopolitics Upends Traditional Resilience Strategies
In an increasingly unpredictable environment, the usual hedging strategies that multinationals employ—long premised on a seemingly stable map of geopolitical alliances—will become significantly less effective. For example, friendshoring—basing and sourcing operations in the territory of geopolitical allies—may not insure against disruption, as policymakers may subject friendly nations to tariffs and other restrictive measures.
For instance, at the end of March, the Trump administration announced a 25% tariff on all imported cars and car parts. This included cars and parts made in Canada and Mexico—both traditionally close trading partners and allies of the US—and occurred despite the impact falling mostly on US-based carmakers with manufacturing operations in both countries. As of April 2, the administration has imposed tariffs on a wide range of imports from traditionally close allies such as the EU, the UK, and Australia. For its part, the Biden administration restricted access by strategic allies such as Saudi Arabia, the UAE, and Switzerland to leading-edge AI hardware.
How Boards Can Test Resilience and Preparedness
Boards need to know the right questions to ask in order to help management anticipate threats, prepare the organization to mitigate risks, and pivot the business when needed.
Anticipate: “What and So What?”
Are any of our most critical inputs or processes exposed to proxy geopolitical battles? Geopolitical tensions can spill over and affect business as usual. Consider the experience of US telecom companies that, in 2020, were required to remove telecommunication equipment made by the Chinese companies Huawei and ZTE and switch to non-Chinese equipment providers. Carrying out this rip-and-replace program imposed large costs on carriers, even though the U.S. government covered some of these costs.
What tech-related regulatory trends should we be concerned about, what signposts should we monitor to proactively identify disruptions, and what are the implications on our business? Developing plausible scenarios helps companies map out a range of potential disruptions and can reveal critical vulnerabilities. Frequently assessing the evolving implications of any such scenario if it were to materialize can help companies pivot at the right time to focus on the most salient risks. Companies need strategic foresight to anticipate and understand the depth of shifting trends, and this involves knowing where to look and what to look for. Equally important in a context of increased volatility, boards must carefully separate signals from noise.
In the 1960s, Shell shifted from traditional risk forecasting to scenario planning. Unlike static predictions, scenarios explored alternative futures and improved decision making. In 1973, when the oil crisis struck, Shell was prepared. It weathered the volatility of the 1970s and generated billions of dollars in profits, in part by selling refineries and installations or opting not to replace them. Shell has continued to use scenario building to anticipate global economic, social, and political changes and their implications on the company’s operations. Today, more than 50 years later, scenario planning is still a core aspect of Shell’s strategic decision making.
More generally, in the past five to ten years, geopolitical scenario planning has become critical to corporate decision making in a wide range of industries, from mining to retail. In our experience working with executives in recent years, hundreds have sought to achieve this foresight. But the ramifications of regulatory changes may not be obvious at first. For example, multinational retailers that extract value from centrally processing customer data may see their competitive advantage over smaller, more localized competitors diminish in the face of rising data transfer barriers. Stricter data localization measures will prevent multinationals from pooling their data to gain a scale advantage from their worldwide presence.
How are current and likely future regulations impacting our tech partnerships and threatening future access to hardware, software, and apps? When Huawei was put on the US's restricted entity list in 2019, the Chinese telecom giant could effectively no longer buy technology from US companies. Previously it had relied on an Android license for its operating system and on tech giants such as Google for many apps. As a result, Huawei eventually had to build its own operating system, HarmonyOS.
Prepare: “How Can We Mitigate Our Exposure?”
What areas of the business rely most heavily on globalized technology operations? This risk came to the fore in Russia after the country’s invasion of Ukraine in 2022, which caused many European and American service providers to cut off access to their tools in Russia. For example, when SAP, which many large Russian companies used prior to the war, terminated its services in Russia, the software that Russian companies already had in place quickly became outdated—notably on the cybersecurity front—in the absence of ongoing service and security updates. This situation left Russian companies scrambling to find or build viable alternatives—which may take years to develop.
Do we have adequate prospective technology partners in key regions, in case we may need to modularize tech operations? To take one example, it has been widely reported that Apple has tailored its AI partnership strategy on the basis of the geography to be served. In China, Apple procures the AI model embedded in its iPhones from Alibaba; elsewhere, it uses a combination of its proprietary Apple Intelligence and OpenAI’s ChatGPT. The objective of this strategy is to insulate Apple from potential disruptions linked to US-China tensions.
What tradeoffs between efficiency and tech resilience does our company face? Although not directly related to technology, the manufacturing fragmentation strategy adopted by Chinese carmakers may serve as a good model for treading uncertain waters. Several large Chinese car manufacturers are expanding their presence in Europe: Chery has recently opened its first European manufacturing center in Spain; MG is considering Spain, Hungary, or the Czech Republic as the site for a new factory; BYD is building a plant in Hungary; and Geely is scouting various locations for a European plant. Decentralizing production has its costs, but this strategy should enable these companies to avoid tariffs that are imposed on cars manufactured in China.
More broadly, multinationals should aim to build effective resilience and flexibility so that they can turn crises into competitive opportunities. Although a BCG survey found that 80% of executives view risk in a mainly negative or neutral light, our analysis shows that resilience can drive significant value: 30% of companies’ total shareholder returns accrue during times of crisis, even though such periods account for only 11% of overall time.
Pivot: “Now What?”
What internal processes and mechanisms have we set up to rapidly pivot and execute defensive strategies? During Cisco’s February 2025 earnings call, its CFO shared some insights on how the company had prepared for trade wars. Already, Cisco had reduced its exposure in China by 80%. In addition, it planned scenarios for other increases in tariffs—notably tariffs on Mexico and Canada—and modeled the impact of tariffs that the Trump administration had announced on steel and aluminum imports. This analysis enabled Cisco to map out key steps that it would take to mitigate the impact of these new measures. As a result, Cisco—which has nine global manufacturing sites, four manufacturing-repair sites, and three logistics sites split among the Americas, Europe, and Asia—can in theory pivot its production to limit the impact of tariffs.
Turning Awareness into Action
Concerns over geopolitical fractures have kept both executives and board members awake at night. But boards need to recognize their unique role in steering their management teams to ensure that they are adequately prepared for the increasing likelihood that geopolitically driven interference will impact their access to hardware, software, and data. As tech regulation becomes more intense, complex, and volatile, corporate resilience will increasingly depend on effective scenario planning and readiness to modularize global technology development and operations. This begins with boards asking the right questions.
The authors thank Elton Parker and Hussein Abdulghani for their contributions to this piece.
