When buyers worry about where a screen comes from, they look at the hardware. The invidis Yearbook 2026 argues they are looking at the wrong layer. Hardware origin is visible and, increasingly, diversified. The layer that actually decides how an estate behaves — and who controls it — is the software. And that layer is usually invisible.
"If hardware origin is visible, software sovereignty is often hidden — and arguably more critical. Content management systems, operating systems, analytics platforms, and AI-driven functions ultimately define how signage behaves in day-to-day operation."
Source: invidis Yearbook 2026 — NextGen Signage, "The hidden sovereignty layer."
The three questions buyers now ask
The Yearbook lists the questions operators have started putting to signage vendors — the same questions an enterprise asks of any IT platform:
"Key questions raised by operators include where software is developed and maintained, under which legal framework vendors operate, and whether systems can function independently if connectivity or access is restricted."
Read those three as a procurement checklist — where is it built, whose law governs it, and does it still work when the network is cut — and most cloud-first signage platforms struggle to give a clean answer. A platform that lives in someone else's cloud, under a jurisdiction the buyer did not choose, fails the third question the moment connectivity is restricted.
Why this lands hardest in the Gulf
This is not a European-only debate. For the first time, the Yearbook's own programmatic survey added Saudi Arabia, Qatar and the UAE — a signal that the region is now central to the conversation, not peripheral. And the Gulf's regulatory direction points squarely at software sovereignty:
- UAE — NESA Information Assurance Standards, the TDRA Cybersecurity Standard's "no unmanaged egress" expectation, and the UAE PDPL (Federal Decree-Law No. 45 of 2021), with DIFC and ADGM layering stricter rules for the financial free zones. See Digital Signage in the UAE.
- Saudi Arabia — NCA Essential Cybersecurity Controls, SAMA's framework for financial institutions, and the Saudi PDPL — all favouring infrastructure that keeps regulated content and data in-Kingdom. See Digital Signage in Saudi Arabia.
- Qatar — the NIA Policy, CRA oversight and the Qatar PDPL, with national-vision projects that treat signage as part of critical infrastructure. See Digital Signage in Qatar.
In each of these markets the buying pattern is the same: government, life-safety, banking and flagship hospitality specify on-premises, data-resident infrastructure as the baseline — exactly the architecture a cloud-only CMS cannot deliver.
Neither bloc: why neutral origin is the point
The Yearbook is candid that the obvious "safe" origins are no longer automatically safe. It records concern over "'Made in USA' for specific categories, reflecting deteriorating political relations between the current US administration and long-standing allies," and notes that "AI Made in China remains a hard sell in Europe, North America, and much of the Middle East." Its conclusion is restrained and worth repeating: the goal is "not substitution — but diversification."
This is where a Swiss vendor is not a marketing flourish but a structural answer. Switzerland is aligned with neither bloc — neutral jurisdiction, transparent ownership, a stable legal framework. For a buyer trying to diversify away from a single geopolitical dependency, "Swiss" is the third option the binary leaves out.
How SpinetiX answers the three questions
| The operator's question | The SpinetiX / 123CMS answer |
|---|---|
| Where is the software developed and maintained? | Switzerland / Europe — Swiss vendor, transparent ownership, two decades of continuous engineering. |
| Under which legal framework does the vendor operate? | Swiss law — a neutral jurisdiction, neither US nor Chinese. |
| Can the system run if connectivity or access is restricted? | Yes. DSOS plays content locally on the player; Elementi authors and publishes on-premises; ARYA covers the cloud-managed case for estates that want it; and 123CMS runs on-premises and is air-gap capable. No dependency on a foreign cloud. |
The stack gives a buyer the full range without leaving the vendor: Elementi for on-premises authoring and publishing, ARYA for cloud-managed operation where that is wanted, and 123CMS where the customer wants their own branded, data-sovereign console. One vendor, one security model — the customer chooses where the control plane lives.
The hidden layer becomes visible the moment you look at the operating system. SpinetiX DSOS is a purpose-built, minimal OS — no Windows, no Android, no general-purpose browser stack, no telemetry to foreign clouds — with a zero-CVE record since 2007. An independent reviewer in the same Yearbook describes it as a hardened OS "all but immune to security vulnerabilities."
123CMS: sovereignty you can own — and built in the region
Most "NextGen" CMS platforms answer the sovereignty question by asking the customer to trust a shared cloud. 123CMS answers it the other way: a customer-branded, data-sovereign CMS that runs on the operator's own infrastructure. Content and audit data stay on-premises rather than flowing into a vendor's monetisation cloud. The brand on the console is the customer's, the servers are the customer's, and the system keeps running when the link to the outside world is closed.
There is a second sovereignty layer that matters in the Middle East: 123CMS is developed in Dubai by Media La Vista. The hardware and operating system are Swiss; the CMS that sits in front of them is built in the region, by a team in the region. For a Gulf buyer weighing where software is written and maintained, that is the rare combination of Swiss-engineered platform and regionally-developed, locally-accountable management layer — not a foreign cloud reached over someone else's network, but a system authored next door.
For a regulated buyer that is the whole point: not a promise that the vendor's cloud is secure, but an architecture where the sensitive data never leaves the building in the first place. As our zero-trust architecture puts it — if the data was never in someone else's cloud, there is nothing there to leak.
Hardware origin is the question buyers ask first. Software sovereignty is the one that decides who controls the estate. The platform is Swiss-engineered; 123CMS is built in Dubai by Media La Vista — so the answer stays on the customer's own premises, kept by a team in the region.