A PLM/ALM vendor's origin as a sovereignty factor

The origin of a PLM/ALM vendor is increasingly a structural sovereignty factor.

It helps determine which legal jurisdiction the software supplier falls under — and thus possibly also which government access and disclosure obligations could apply in a worst-case scenario. It should be clear by now that this is becoming more and more relevant.

Last week I asked the opening question of how sovereignly PLM/ALM can realistically be operated today. The jurisdiction a vendor falls under is only one aspect of that — but a structural one.

A rough overview: the origin of the main PLM/ALM vendors

• Aras Corporation – USA
• Atlassian – USA/Australia
• Autodesk – USA
• CONTACT Software – Germany
• Dassault Systèmes – France
• IBM (Engineering/ALM) – USA
• PRO.FILE by Revalize – Germany (part of Revalize)
• PTC – USA
• SAP – Germany
• Siemens Digital Industries Software – USA

This is deliberately simplified and does not fully account for corporate structures, subsidiaries and chains of command — more on that in a separate post.

Origin isn’t everything

Whether origin is practically relevant from a sovereignty perspective also depends on the context:

• Which operating model is used (on-prem, managed/private cloud, SaaS)?
• Which specific group entity signs the contract?
• Which subcontractors and support structures are involved?
• Who has technical and organizational access?

So the origin of the software vendor is not the only deciding factor. The operating model and the infrastructure used are just as relevant — more on that in the next part of this series.

Last but not least: “sovereignty” is, in the end, just a term. In a world built on division of labor, full sovereignty doesn’t really exist. That is why I think it is important to also address the question of what “independence” actually means for a company, and which risks you specifically want to counter.