Body of Knowledge · October 2026
The Sovereign Stack

Our data lives in the UK. Control of it mostly doesn't.

We mapped the technology behind the NHS, central government, the BBC, schools and universities, from chips to AI, and asked who supplies it, who controls it and who owns it. Every claim carries a reference.

Read the key findings Explore the stack How we score
Sovereignty index Verified 14 Oct 2026
46 out of 100
UK public sector, 12 dimensions, equal weights
Four headline dimensions of the sovereignty index
Dimension Score Reading
D1 Residency 78 Sovereign
D3 Crypto keys 23 Exposed
D6 Code / model control 21 Exposed
D12 UK value capture 30 Dependent

172 sourced findings across 28 layers. Dataset: findings.json, CC BY 4.0. How we score.

1. What we found

All ten findings

Finding 1 3 sources

~£9bn

expected public-sector Microsoft spend over five years (SPA24)

One vendor sits under every public service we studied

Read the evidence

Finding 2 3 sources

£473m

HMRC ten-year AWS contract to exit legacy data centres

“Sovereign cloud” mostly means UK storage under US control

Read the evidence

Finding 4 4 sources

42

sourced findings involve a vendor bought, sold or restructured since 2020

UK-owned specialist systems are being sold to private equity and overseas buyers

Read the evidence

Finding 6 2 sources

£225m

Isambard-AI, the UK’s flagship AI supercomputer, built on HPE and Nvidia

The AI layer is foreign end to end

Read the evidence

2. Sovereignty is more than where data sits

We score twelve dimensions, from residency and jurisdiction to who holds the keys, who owns the vendor, and how much value and capability stays in the UK. The pattern is consistent: strong on location, weak on control.

What is sovereignty?

Index by layer and sector. Select a cell to explore.

Sovereignty index by layer group and sector (0 exposed to 100 sovereign)
Layer NHS Central Government BBC Schools Higher Education
Physical 92 n=1 43 n=3 50 n=5 82 n=3 56 n=7
Infrastructure 30 n=3 42 n=14 44 n=5 83 n=1 43 n=3
Platform 30 n=4 42 n=1 61 n=13 76 n=2 41 n=2
Workplace 45 n=6 36 n=5 36 n=2 58 n=2 47 n=3
Business apps 44 n=16 31 n=9 56 n=14 61 n=7 32 n=10
AI 28 n=3 38 n=7 46 n=3 39 n=4 34 n=4
Security 50 n=4 49 n=2 — n=0 58 n=2 42 n=2

3. It can be done

The highest-scoring parts of the UK stack are open and UK-run: GOV.UK Notify, Pay and One Login; Jisc's Janet network and eduroam; NHS smartcard identity. Across Europe, the French Gendarmerie, Schleswig-Holstein and Estonia's X-Road show open infrastructure working at national scale.

We document 43 case studies, 37 of them live or expanding, and the reversals too, because they show what success requires.

What's working

4. A UK-led open stack

We propose that the UK leads, with EU, Five Eyes and willing partners, an open shared stack for public digital infrastructure that is highly reliable, dispersed and centred on the people it serves, and that education and the BBC build the skills to run it.

Read the vision

5. The plan

Vision

A UK-led open stack with EU, Five Eyes and willing partners: highly reliable, dispersed, user-centric.

Business case

The money is largely already being spent. How to redirect it, what transition costs, and the price of doing nothing.

Architecture

One reference architecture on open standards, delivered by many suppliers. Identity first.

Skills

Schools, universities and the BBC teaching on the stack the public sector runs.

Roadmap

Three horizons: stop the drift, scale what works, move up the value chain.

Help build the evidence

The Body of Knowledge is open data under CC BY 4.0. If you can correct a finding, supply a source, or want to support the initiative, we'd like to hear from you.

Get in touch