Finding 1 4 sources
£1.9bn
spent on Microsoft licences through CCS reseller agreements in 2024/25, a floor; about £9bn is expected over the five-year SPA24
Our data lives in the UK. Control of it mostly doesn't.
We mapped the technology behind the NHS, central government, defence, the devolved governments, councils, police forces, the BBC, schools and universities, from chips to AI, and asked who supplies it, who controls it and who owns it. Every claim carries a reference.
UK Public Sector Sovereignty Index · 2026
Verified 14 Oct 2026
47 out of 100: how much of the technology behind UK public services the UK controls. 419 findings, 9 sectors, 12 dimensions
ExposedDependentPartly sovereignSovereign
- D1 Residency Sovereign 82
- D3 Crypto keys Partly sovereign 53
- D6 Code / model control Dependent 36
- D12 UK value capture Dependent 31
419 sourced findings across 28 layers. Dataset: findings.json, CC BY 4.0. How we score.
1. What we found
All ten findingsFinding 2 3 sources
56 of 67
sourced agreements of £100m or more with no published evidence of customer-held encryption keys
UK hosting is not UK control: the keys and the law sit elsewhere
Finding 4 6 sources
25 of 46
supplier takeovers, buyouts and restructurings since 2020 that involved a UK-owned supplier; 20 were between overseas owners and 1 brought a supplier into UK hands
UK-owned specialist systems are changing hands, mostly to private equity and overseas buyers
Finding 6 2 sources
£225m
Isambard-AI, the UK’s flagship AI supercomputer: UK-owned and UK-run, built on HPE and Nvidia hardware
The AI layer runs on foreign models and foreign chips
2. Where the money goes
How to redirect it, year by yearWe traced 85 public technology contracts with a published value and term. Spread over their terms they are worth about £4.6bn a year, including the public-sector-wide Microsoft estimate (£2.7bn without it): a sample of the roughly £26bn the public sector spends on technology each year. 86% of that money goes to suppliers owned outside the UK, 76% without the Microsoft estimate. 9 suppliers take more than 80% of it. That money could build UK skills, firms and intellectual property instead.
Who owns the suppliers
86% of £4.6bn a year in sourced contracts goes to suppliers ultimately owned outside the UK. 77% goes to US-owned suppliers; 13% to UK-owned.
- US-owned 77%
- Other non-UK-owned 9%
- UK-owned 13%
- Unknown or mixed 1%
How concentrated it is
- Microsoft alone
- 41%
- Top 4 suppliers
- 66%
- Top 8 suppliers
- 78%
- Suppliers to pass 80%
- 9 of 56
Microsoft Motorola Solutions BT AWS
Dark and light blue blocks are the 9 largest suppliers; grey is everyone else.
| # | Supplier | Owner | A year | Confidence | Share | Cumulative |
|---|---|---|---|---|---|---|
| 1 | Microsoft | US | £1.9bn | 100% high | 41% | 41% |
| 2 | Motorola Solutions | US | £444m | 0% high | 10% | 51% |
| 3 | BT | GB | £366m | 1% high | 8% | 59% |
| 4 | Amazon Web Services | US | £329m | 31% high | 7% | 66% |
| 5 | IBM | US | £203m | 78% high | 4% | 70% |
| 6 | Salesforce | US | £133m | 100% high | 3% | 73% |
| 7 | Palantir | US | £129m | 40% high | 3% | 76% |
| 8 | Infosys | IN | £117m | 100% high | 3% | 78% |
| 9 | HPE; NVIDIA | US | £113m | 100% high | 2% | 81% |
Ownership is by ultimate owner, not headquarters. Suppliers are ranked by annualised value, so a one-year actual figure and a ten-year ceiling sit on the same footing; the share of a supplier with no stated term is not shown. The annual figure is a ceiling run-rate: each contract's published value, less VAT where the notice says it is included, spread over its longest stated term (85 contracts covering 81% of the value); contracts without a stated term are left out. It includes the public-sector-wide SPA24 Microsoft estimate (£1.9bn a year, counted once); the sampled contracts on their own come to £2.7bn a year across 84 contracts. It is a sample: total public-sector technology spend is about £26bn a year. £22bn across 144 sourced contracts with 56 named suppliers. Values are published contract values or ceilings over different periods, so they are not annual spend. Microsoft is counted once, using the public-sector-wide estimate under its SPA24 agreement. The red line marks 80%. The confidence bar beside each value shows how much of it rests on award notices and official figures (ink), press reports of a named award (grey) or estimates (paper). How we count.
3. Sovereignty is more than where data sits
We score twelve dimensions, from residency and jurisdiction to who holds the keys, who owns the vendor, and how much value and capability stays in the UK. The pattern is consistent: strong on location, weak on control.
What is sovereignty?UK Public Sector Sovereignty Index by layer and sector. Select a cell to explore.
| Layer | NHS | Central Government | BBC | Schools | Higher Education | Local Government | Policing | Defence | Devolved Governments |
|---|---|---|---|---|---|---|---|---|---|
| Physical | 92 n=1 | 48 n=3 | 57 n=5 | 84 n=3 | 57 n=7 | — n=0 | 49 n=8 | 56 n=13 | 70 n=2 |
| Infrastructure | 32 n=3 | 45 n=13 | 47 n=5 | 83 n=1 | 48 n=3 | 57 n=7 | 45 n=6 | 38 n=8 | 32 n=9 |
| Platform | 31 n=4 | 42 n=1 | 62 n=13 | 76 n=2 | 41 n=2 | 41 n=2 | 36 n=5 | 31 n=3 | 54 n=4 |
| Workplace | 48 n=6 | 41 n=4 | 39 n=2 | 72 n=2 | 49 n=3 | 35 n=8 | 30 n=7 | 55 n=8 | 30 n=10 |
| Business apps | 52 n=17 | 45 n=10 | 60 n=14 | 69 n=7 | 35 n=9 | 42 n=30 | 42 n=35 | 48 n=22 | 37 n=32 |
| AI | 33 n=3 | 43 n=7 | 51 n=3 | 44 n=4 | 37 n=4 | 39 n=5 | 45 n=2 | 50 n=7 | 22 n=1 |
| Security | 56 n=4 | 60 n=2 | — n=0 | 66 n=2 | 50 n=2 | 61 n=4 | 44 n=3 | 57 n=5 | 53 n=2 |
4. It can be done
The highest-scoring parts of the UK stack are open and UK-run: GOV.UK Notify, Pay and One Login; Jisc's Janet network and eduroam; NHS smartcard identity. Across Europe, the French Gendarmerie, Schleswig-Holstein and Estonia's X-Road show open infrastructure working at national scale.
We document 43 case studies, 37 of them live or expanding, and the reversals too, because they show what success requires.
What's working5. A UK-led open stack
We propose that the UK leads, with EU, Five Eyes and willing partners, an open shared stack for public digital infrastructure that is highly reliable, dispersed and centred on the people it serves, and that education and the BBC build the skills to run it.
Read the vision6. The plan
Help build the evidence
The Body of Knowledge is open data under CC BY 4.0. If you can correct a finding, supply a source, or want to support the initiative, we'd like to hear from you.
Get in touch