1 of 5 · UK Public Sector Sovereignty Index · 2026
Our data lives in the UK. Control of it mostly doesn't.
46 out of 100 across 411 sourced findings in 9 parts of the public sector: the NHS, central government, defence, the devolved governments, councils, police, the BBC, schools and universities.
2 of 5 · Twelve dimensions
Strong on location. Weak on control.
Where data is stored is the one thing the UK has largely got right. Who holds the keys, who can inspect the code, who owns the vendor and how much value stays here all score far lower.
What is sovereignty?- D1 Residency 82 out of 100, Sovereign 82
- D2 Jurisdiction 58 out of 100, Partly sovereign 58
- D4 Operational control 56 out of 100, Partly sovereign 56
- D3 Crypto keys 53 out of 100, Partly sovereign 53
- D7 Ownership 53 out of 100, Partly sovereign 53
- D5 Continuity 50 out of 100, Partly sovereign 50
- D11 UK capability 47 out of 100, Dependent 47
- D9 Supply chain 42 out of 100, Dependent 42
- D6 Code / model control 36 out of 100, Dependent 36
- D10 Portability 36 out of 100, Dependent 36
- D12 UK value capture 31 out of 100, Dependent 31
- D8 IP 22 out of 100, Exposed 22
3 of 5 · Ownership
Owned elsewhere.
Show as a table
| Public service | Supplier | Findings |
|---|---|---|
| Policing | All other suppliers (320) | 57 |
| Defence | All other suppliers (320) | 56 |
| Devolved Governments | All other suppliers (320) | 47 |
| BBC | All other suppliers (320) | 37 |
| Local Government | All other suppliers (320) | 34 |
| NHS | All other suppliers (320) | 27 |
| Central Government | All other suppliers (320) | 21 |
| Higher Education | All other suppliers (320) | 21 |
| Schools | All other suppliers (320) | 20 |
| Policing | Microsoft | 8 |
| Devolved Governments | Microsoft | 8 |
| Local Government | Microsoft | 7 |
| NHS | Microsoft | 6 |
| Defence | Microsoft | 6 |
| Central Government | Amazon Web Services | 5 |
| Higher Education | Microsoft | 5 |
| Local Government | Civica | 5 |
| Central Government | Microsoft | 4 |
| Central Government | 4 | |
| Local Government | Oracle | 4 |
| BBC | Amazon Web Services | 3 |
| NHS | Amazon Web Services | 2 |
| NHS | Oracle | 2 |
| Higher Education | 2 | |
| Local Government | 2 | |
| Local Government | SAP | 2 |
| Devolved Governments | Amazon Web Services | 2 |
| Central Government | Oracle | 1 |
| Central Government | SAP | 1 |
| BBC | Microsoft | 1 |
| BBC | SAP | 1 |
| Schools | 1 | |
| Higher Education | Amazon Web Services | 1 |
| Higher Education | Oracle | 1 |
| Local Government | Amazon Web Services | 1 |
| Policing | Amazon Web Services | 1 |
| Defence | Amazon Web Services | 1 |
| Defence | Oracle | 1 |
| Devolved Governments | SAP | 1 |
| Devolved Governments | Civica | 1 |
| Devolved Governments | Oracle | 1 |
4 of 5 · Stack and skills
One open stack. Many suppliers. Identity first.
A reference architecture on open standards, delivered by many UK and allied suppliers, with customer-held keys and tested exit. Schools, universities and the BBC teach on the stack the public sector runs, so the people who operate it are ours too.
It can be done: GOV.UK Notify, Pay and One Login, Jisc's Janet network, NHS smartcard identity, Estonia's X-Road, the French Gendarmerie. We document 43 cases, 37 of them live or expanding.
- Security 56
- AI 43
- Business apps 44
- Workplace 41
- Platform 49
- Infrastructure 44
- Physical 58
5 of 5 · The money
The money is already being spent.
- ~£1.9bn
- a year on one vendor's licences across the public sector (The Register, 2025)
- £95m
- a year if 5% of that were redirected to UK open-source hardening and support; £190m at 10%. Illustrative arithmetic, not a forecast.
- 6% → 30%
- the redirection ladder over five years, with six sourced procurement levers
Every large contract comes up for renewal on a known date. Each one is a chance to require open formats, customer-held keys and tested exit, and to buy from UK firms in lots they can win.