Our data lives in the UK. Control of it mostly doesn't.

We mapped the technology behind the NHS, central government, defence, the devolved governments, councils, police forces, the BBC, schools and universities, from chips to AI, and asked who supplies it, who controls it and who owns it. Every claim carries a reference.

Start here: the brief The key findings Explore the stack How we score

UK Public Sector Sovereignty Index · 2026 Verified 14 Oct 2026

46 out of 100: how much of the technology behind UK public services the UK controls. 411 findings, 9 sectors, 12 dimensions

ExposedDependentPartly sovereignSovereign

D1 Residency Sovereign 82
D3 Crypto keys Partly sovereign 53
D6 Code / model control Dependent 36
D12 UK value capture Dependent 31

411 sourced findings across 28 layers. Dataset: findings.json, CC BY 4.0. How we score.

1. What we found

All ten findings

Finding 1 4 sources

~£9bn

expected public-sector Microsoft spend over five years (SPA24)

One vendor sits under every public service we studied

Read the evidence

Finding 2 3 sources

56 of 67

sourced agreements of £100m or more with no published evidence of customer-held encryption keys

UK hosting is not UK control: the keys and the law sit elsewhere

Read the evidence

Finding 4 6 sources

25 of 46

supplier takeovers, buyouts and restructurings since 2020 that involved a UK-owned supplier; 20 were between overseas owners and 1 brought a supplier into UK hands

UK-owned specialist systems are changing hands, mostly to private equity and overseas buyers

Read the evidence

Finding 6 2 sources

£225m

Isambard-AI, the UK’s flagship AI supercomputer: UK-owned and UK-run, built on HPE and Nvidia hardware

The AI layer runs on foreign models and foreign chips

Read the evidence

2. Where the money goes

How to redirect it, year by year

We traced 78 public technology contracts with a published value and term. Spread over their terms they are worth about £4.6bn a year, including the public-sector-wide Microsoft estimate (£2.8bn without it): a sample of the roughly £26bn the public sector spends on technology each year. 86% of that money goes to suppliers owned outside the UK, 76% without the Microsoft estimate. 13 suppliers take more than 80% of it. That money could build UK skills, firms and intellectual property instead.

Who owns the suppliers

86% of £4.6bn a year in sourced contracts goes to suppliers ultimately owned outside the UK. 78% goes to US-owned suppliers; 12% to UK-owned.

US-owned 78%
Other non-UK-owned 8%
UK-owned 12%
Unknown or mixed 2%

How concentrated it is

Microsoft alone: 29%
Top 4 suppliers: 52%
Top 8 suppliers: 70%
Suppliers to pass 80%: 13 of 86

Microsoft BT Salesforce

Dark and light blue blocks are the 13 largest suppliers; grey is everyone else.

Largest suppliers by published contract value
#	Supplier	Owner	Value	Share	Cumulative
1	Microsoft	US	£9bn	29%	29%
2	BT	GB	£2.5bn	8%	37%
3	Salesforce	US	£2.4bn	8%	45%
4	IBM	US	£2bn	7%	52%
5	Motorola Solutions	US	£1.6bn	5%	57%
6	Infosys	IN	£1.4bn	5%	61%
7	Amazon Web Services	US	£1.4bn	4%	66%
8	Palantir	US	£1.3bn	4%	70%
9	Oracle	US	£1.2bn	4%	74%
10	Atos	FR	£585m	2%	76%
11	Airbus Defence and Space UK	Mixed	£500m	2%	77%
12	Mark43	US	£469m	2%	79%
13	Boeing Defence UK	US	£460m	1%	80%

Ownership is by ultimate owner, not headquarters. The annual figure is a ceiling run-rate: each contract's published value, less VAT where the notice says it is included, spread over its longest stated term (78 contracts covering 86% of the value); contracts without a stated term are left out. It includes the public-sector-wide SPA24 Microsoft estimate (£1.8bn a year, counted once); the sampled contracts on their own come to £2.8bn a year across 77 contracts. It is a sample: total public-sector technology spend is about £26bn a year. £31bn across 137 sourced contracts with 86 named suppliers. Values are published contract values or ceilings over different periods, so they are not annual spend. Microsoft is counted once, using the public-sector-wide estimate under its SPA24 agreement. The red line marks 80%. How we count.

3. Sovereignty is more than where data sits

We score twelve dimensions, from residency and jurisdiction to who holds the keys, who owns the vendor, and how much value and capability stays in the UK. The pattern is consistent: strong on location, weak on control.

What is sovereignty?

UK Public Sector Sovereignty Index by layer and sector. Select a cell to explore.

UK Public Sector Sovereignty Index by layer group and sector (0 exposed to 100 sovereign)
Layer	NHS	Central Government	BBC	Schools	Higher Education	Local Government	Policing	Defence	Devolved Governments
Physical	92 n=1	48 n=3	57 n=5	84 n=3	57 n=7	— n=0	49 n=8	56 n=13	70 n=2
Infrastructure	32 n=3	45 n=13	47 n=5	83 n=1	48 n=3	57 n=7	45 n=6	38 n=8	32 n=9
Platform	31 n=4	42 n=1	62 n=13	76 n=2	41 n=2	41 n=2	36 n=5	31 n=3	53 n=4
Workplace	48 n=6	41 n=4	39 n=2	72 n=2	49 n=3	35 n=8	30 n=7	55 n=8	30 n=10
Business apps	51 n=16	32 n=6	60 n=14	69 n=7	35 n=9	41 n=29	42 n=35	45 n=20	37 n=32
AI	33 n=3	43 n=7	51 n=3	44 n=4	37 n=4	39 n=5	45 n=2	50 n=7	22 n=1
Security	56 n=4	60 n=2	— n=0	66 n=2	50 n=2	61 n=4	44 n=3	57 n=5	53 n=2

4. It can be done

The highest-scoring parts of the UK stack are open and UK-run: GOV.UK Notify, Pay and One Login; Jisc's Janet network and eduroam; NHS smartcard identity. Across Europe, the French Gendarmerie, Schleswig-Holstein and Estonia's X-Road show open infrastructure working at national scale.

We document 43 case studies, 37 of them live or expanding, and the reversals too, because they show what success requires.

What's working

5. A UK-led open stack

We propose that the UK leads, with EU, Five Eyes and willing partners, an open shared stack for public digital infrastructure that is highly reliable, dispersed and centred on the people it serves, and that education and the BBC build the skills to run it.

Read the vision

6. The plan

Help build the evidence

The Body of Knowledge is open data under CC BY 4.0. If you can correct a finding, supply a source, or want to support the initiative, we'd like to hear from you.

Get in touch