Body of Knowledge · October 2026 · thesovereignstack.org
The Sovereign Stack

Body of Knowledge · first edition, October 2026

How sovereign is UK public technology?

We mapped the technology behind nine parts of the UK public sector, layer by layer, from chips to AI, and asked who supplies it, who controls it and who owns it. Every finding below is sourced.

Public Sector Sovereignty Index
42/100
Sourced findings
414
US-headquartered vendor
47%
Supplier takeovers and restructurings since 2020
46
Open the Stack Playground What is sovereignty?

Ten key findings

The findings we judge most material. Confidence reflects the quality of evidence: high where primary or multiple credible sources agree, medium where sources are fewer or partly reported.

Finding 1 3 sources

~£9bn

expected public-sector Microsoft spend over five years (SPA24)

One vendor sits under every public service we studied

Microsoft provides office software, email, collaboration, staff identity and increasingly security and AI across the NHS, central government, the BBC, schools and universities. The NHS alone signed a £774m five-year agreement, and the public sector spent about £1.9bn on Microsoft licences in 2024/25. (The Register, 2025; Digital Health, 2023; Government Commercial Agency, 2024)

Explore in the playground High confidence

Finding 2 3 sources

£473m

HMRC ten-year AWS contract to exit legacy data centres

“Sovereign cloud” mostly means UK storage under US control

Major platforms are hosted in UK regions of US providers: HMRC and NHS Spine on AWS, the MoD on an air-gapped Google cloud. Data residency is strong, but we found no public evidence of customer-held encryption keys in the largest agreements. (The Stack, 2026; NHS England Digital, 2023; Google Cloud, 2025)

Explore in the playground High confidence

Finding 3 2 sources

50–75%

of Crown Hosting held by Ark, whose owner is US fund Elliott

Government's own UK hosting vehicle is majority US-owned

Crown Hosting Data Centres is a joint venture in which the Cabinet Office holds a minority stake; the majority holder, Ark Data Centres, is controlled by Elliott, which has explored a sale. (Companies House, 2026; DatacenterDynamics, 2025)

Explore in the playground High confidence

Finding 4 6 sources

46

supplier takeovers, buyouts and restructurings since 2020, half of them by private equity

UK-owned specialist systems are being sold to private equity and overseas buyers

All three main council social care systems are now private-equity owned (Liquidlogic under CVC, Mosaic under Access, Eclipse under Blackstone-owned Civica). Council planning (Idox) was taken private by a US fund, and Capita sold its council revenues and benefits software to US-owned MRI and its policing software to Japan’s NEC. GP records (EMIS, now TPG), student records (Tribal, agreed sale to Main Capital), school information systems (SIMS under Montagu, Arbor under Permira) and school web filtering (Smoothwall, now Aura) have also changed hands. These sector systems are where UK ownership was strongest. (Digital Health, 2026; Tribal Group plc, 2026; Aura, 2026; Tes, 2026; Civica, 2025; Capita plc, 2024)

Explore in the playground High confidence

Finding 5 3 sources

up to £2.4bn

HMRC enterprise CRM contract with Salesforce

Large single-vendor platforms with costly exit

Recent awards concentrate core functions in single US vendors: HMRC’s Salesforce CRM, the NHS Federated Data Platform (Palantir, up to £330m), the MoD’s Palantir enterprise agreement (£240.6m) and Oracle Health records across many hospital trusts. (CX Today, 2026; UK Spending, 2024; PublicTechnology, 2026)

Explore in the playground High confidence

Finding 6 2 sources

£225m

Isambard-AI, the UK’s flagship AI supercomputer, built on HPE and Nvidia

The AI layer is foreign end to end

Foundation models are accessed through US APIs, the government’s own teacher assistant (Oak’s Aila) runs on GPT-4o, and national AI compute depends on US accelerators subject to US export controls. (Oak National Academy, 2025; insideHPC, 2025)

Explore in the playground High confidence

Finding 7 2 sources

July 2024

a single vendor update disrupted GP systems nationally

Concentration risk has already materialised

The CrowdStrike update failure took GP practice systems offline, and Blackboard, the second-largest university learning platform, went through Chapter 11 restructuring while institutions were renewing contracts. Continuity risk is not theoretical. (Digital Health, 2024; Campus Technology, 2026)

High confidence

Finding 8 2 sources

No

central record of Microsoft spend held by the Cabinet Office

The state cannot see its own dependency

The Cabinet Office has said it holds no complete central data on Microsoft spend, sector licence deal values (for example Jisc’s agreements) are unpublished, and there is no public figure for how schools divide between Microsoft and Google. (The Register, 2025; Jisc, 2024)

Medium confidence

Finding 9 2 sources

£257m+

donated or pledged to the Tony Blair Institute by the Larry Ellison Foundation since 2021

Policy influence is concentrated

Reporting documents the scale of funding from Oracle’s founder to the Tony Blair Institute, an influential voice on NHS data and AI in government, and tech-sponsored think-tank events at party conferences. (New Statesman, 2025; Lighthouse Reports, 2025)

Medium confidence

Finding 10 2 sources

13.7bn

messages sent by GOV.UK Notify, an open-source shared platform

Where the UK runs open, shared infrastructure, it works

The highest-scoring findings are UK-run and open: GOV.UK Notify, Pay and One Login; Jisc’s Janet network, eduroam and the UK Access Management Federation; NHS smartcard identity and PKI. These are the building blocks to scale. (Government Digital Service, 2026; Jisc, 2026)

Explore in the playground High confidence

Where the money goes

Of the contract values we could source, Microsoft takes 29%, the top four suppliers 52% and the top eight 70%. 13 suppliers pass 80%.

Who owns the suppliers

86% of £4.8bn a year in sourced contracts goes to suppliers ultimately owned outside the UK. 78% goes to US-owned suppliers; 12% to UK-owned.

  • US-owned 78%
  • Other non-UK-owned 8%
  • UK-owned 12%
  • Unknown or mixed 2%

How concentrated it is

Microsoft alone
29%
Top 4 suppliers
52%
Top 8 suppliers
70%
Suppliers to pass 80%
13 of 86

Dark and light blue blocks are the 13 largest suppliers; grey is everyone else.

Largest suppliers by published contract value
Supplier Owner Value Cumulative
Microsoft US £9bn 29%
BT GB £2.5bn 37%
Salesforce US £2.4bn 45%
IBM US £2bn 52%
Motorola Solutions US £1.6bn 57%
Amazon Web Services US £1.4bn 61%
Infosys IN £1.4bn 66%
Palantir US £1.3bn 70%
Oracle US £1.2bn 74%
Atos FR £585m 76%
Airbus Defence and Space UK Mixed £500m 78%
Mark43 US £469m 79%
Boeing Defence UK US £460m 81%
DXC US £445m 82%
Google US £413m 83%

Ownership is by ultimate owner, not headquarters. The annual figure averages each contract's value over its stated term (78 contracts covering 86% of the value); contracts without a stated term are left out. It is a sample: total public-sector technology spend is about £26bn a year. £31bn across 139 sourced contracts with 86 named suppliers. Values are published contract values or ceilings over different periods, so they are not annual spend. Microsoft is counted once, using the public-sector-wide estimate under its SPA24 agreement. The red line marks 80%. How we count.

Who bought whom

46 changes of ownership or control since 2020 among suppliers in the evidence base, completed or formally agreed, each counted once however many findings it touches.

Read this first

  • Each entry reports only what the cited source states. We draw no conclusion about the conduct, security or performance of any company named.
  • A change of ownership is not in itself a risk or a failing. We record it because who owns a supplier affects who ultimately controls the systems the public sector depends on.
  • Minority stakes, funding rounds, listings, contract moves and sales that are only being explored are excluded. See how we count.
  • Ownership changes quickly. Entries reflect sources available in October 2026. Please tell us about any error and we will correct it.

Private equity (23)

Supplier What changed, as reported Source
Civica (finance, revenues, social care, elections) Blackstone completed acquisition of Civica, 2024 (Blackstone, n.d.)
Idox (planning; used by most UK councils) Long Path Partners (US) took Idox plc private, completed May 2026 (Investegate, n.d.)
System C / Liquidlogic (care records) CVC took majority stake (Feb 2021) (Cvc, n.d.; Digital Health, n.d.)
The Access Group (care, health, finance) Access Group recapitalised with Hg and TA Associates (2022) (Hgcapital, n.d.)
Servelec / Mosaic (social care) Access Group acquired Servelec (Mosaic), Sep 2021; GIC took minority stake 2022 (Htn, n.d.)
Pay360 (council payments) Capita sold Pay360 to Access PaySuite, 2022 (Businesswire, n.d.)
EMIS (GP records) Optum (UnitedHealth) bought EMIS 2023; sold to TPG Mar 2026 (Digital Health, 2026; Managementinpractice, n.d.)
Vision and Medicus (GP records) OneAdvanced acquired Vision (2025); Doctolib (FR) acquired Medicus (2026) (Blackenterprise, n.d.; Consultancy, n.d.)
SIMS and ParentPay (school MIS and payments) Montagu invested in ParentPay and bought ESS (SIMS/FMS) from Capita Dec 2020; combined 2021 (The Register, 2020; Schoolsweek, 2023)
Arbor (school MIS) Permira majority investment in The Key Group (Arbor parent) closed 20 Nov 2025 (Yespress, n.d.)
Atomwide (London schools) Wavenet (Macquarie Capital-backed) acquired AdEPT Technology Group incl Atomwide in 2023 (Wavenet, n.d.)
Unit4 (ERP) TA Associates (with Partners Group) acquired Unit4 from Advent International 2021 (Tech, n.d.; Goodwinlaw, n.d.)
Tribal (student records) Sep 2026 agreed sale of all Tribal operating companies to Thames Bidco (Main Capital Partners NL) at £231.2m; subject to NSI Act; completion expected Q4 2026 to Q2 2027 (Tribal Group plc, 2026)
Instructure / Canvas (learning platform) KKR and Dragoneer took Instructure private Nov 2024 ($4.8bn) (Pehub, n.d.)
Ping Identity and ForgeRock (identity) Thoma Bravo took Ping private 2022 and merged ForgeRock 2023 (Thomabravo, n.d.)
Jaggaer (procurement) Vista Equity Partners acquired Jaggaer from Cinven (Aug 2024) (Digitalcommerce360, n.d.)
Dalet (media asset management) Long Path Partners public tender offer took Dalet private (2020-21) (Alantra, n.d.)
Software AG (Police National Computer database) Silver Lake (US PE) acquired Software AG, May 2023 (Computer Weekly, n.d.)
Magnet Forensics / GrayKey (phone forensics) Thoma Bravo (US PE) acquired Canadian Magnet Forensics, closed Apr 2023 (~CA$1.67bn incl rollover), to combine with Grayshift (Thomabravo, n.d.)
Sepura (police radios) Sepura sold by Hytera (CN) to UK private equity Epiris, Jul 2022 (Securityworldmarket, n.d.)
Redcentric data centres (national ANPR hosting) Redcentric Data Centres sold to Stellanor Datacenters (DWS-backed fund), agreed Oct 2025 (Channelweb, n.d.)
Ultra Electronics / Ultra Cyber (defence encryption) Ultra Electronics acquired by Advent International (US) for £2.6bn, cleared Jul 2022 with UK national-security conditions; Airbus agreed Mar 2026 to buy Ultra Cyber (pending) (Defensenews, n.d.)
Trustmarque (Microsoft reseller to NHS Wales) reseller Trustmarque sold by Capita to One Equity Partners, 2022 (The Register, 2024)

Trade sale (19)

Supplier What changed, as reported Source
Capita One (revenues, benefits, housing) Capita sold Capita One to MRI Software (US), completed Sep 2024 (Irei, n.d.)
OLM / Eclipse (social care) Civica (Blackstone) acquired OLM Systems, Sep 2025 (Blackstone, n.d.)
Capita policing software (UNIFI, PoliceWorks, Origin) Capita SSS (incl. Origin) acquired by NEC Software Solutions UK, completed Jan 2022 (£62m) (GOV.UK, n.d.; Capita, n.d.)
NEC control-room communications NEC's ICCS (APD Cortex etc.) and duties businesses sold to Codan (AU) on 1 Aug 2023 under CMA undertakings (GOV.UK, n.d.)
PA Consulting (policing and defence programmes) Jacobs (US) completed purchase of a 65% stake in PA Consulting, Mar 2021 (Consulting, n.d.)
Cerner (hospital records) Oracle acquired Cerner (Jun 2022) (Oracle, n.d.)
DXC healthcare software (Lorenzo) Dedalus acquired DXC healthcare software incl. Lorenzo (2020); Ardian exploring sale (Unquote, n.d.)
Allscripts hospital business Harris acquired Allscripts hospital business forming Altera (2022) (Alterahealth, n.d.)
VMware (virtualisation) Broadcom acquired VMware Nov 2023 (licence repricing followed) (Department for Science, Innovation and Technology, 2025)
Unified Streaming Unified Streaming (NL) acquired by Software Combined (AU) Sept 2025 (Tvbeurope, n.d.)
mParticle (customer data) mParticle acquired by Rokt (~$300m) Jan 2025 (Adexchanger, n.d.)
AT Internet (web analytics) Piano acquired AT Internet (FR) 2021 moving analytics engine to US ownership (Updata, n.d.)
Smoothwall / Qoria (school web filtering) US-based Aura completed acquisition of Qoria (Smoothwall parent) 17 Jul 2026; relisted on ASX (Aura, 2026)
ProQuest and Ex Libris (library systems) Clarivate acquired ProQuest including Ex Libris Dec 2021 (Librarytechnology, n.d.)
Vodafone UK and Three UK (mobile networks) Vodafone UK merged with Three UK into VodafoneThree (51/49 with CK Hutchison) 2025 (Vodafone, n.d.)
OneWeb (satellite) OneWeb merger 2023; 2025 French-state-led capital increase with UK government stake (Satellitetoday, n.d.)
Blue Prism (defence process automation) Blue Prism Group plc (UK) acquired by SS&C Technologies (US), completed 16 Mar 2022 (Investor, n.d.)
Intelsat (SKYNET operations partner) Team Aurora partner Intelsat acquired by SES (Luxembourg), completed 17 Jul 2025 (Ses, n.d.)
Cancom UK&I (hosting for NI encompass) Telefonica Tech bought 100% of Cancom UK&I from Cancom Group for EUR 398m (Jul 2021) to build its UK cloud business (Telefonica, n.d.)

Restructuring or major stake (4)

Supplier What changed, as reported Source
OpenAI (foundation models) OpenAI recapitalised as public benefit corporation (Oct 2025) (GOV.UK, 2026; Oak National Academy, 2025)
Atos / Eviden (BBC and defence IT) financial restructuring closed Dec 2024 with creditors taking control; Bull sold to French State 2026 (Atos, n.d.)
Anthology / Blackboard (learning platform) Anthology Chapter 11 Sep 2025; emerged Mar 2026 as Blackboard controlled by former creditors Oaktree and Nexus (Onedtech, n.d.)
Hexagon safety division (Met command and control) Hexagon's Safety, Infrastructure & Geospatial division spun off as independent listed Octave, May 2026 (Hexagon, n.d.)

Where we stand

Scores run from 0 (exposed) to 100 (sovereign), averaged across the twelve dimensions for each sourced finding. Data is mostly held in the UK; control, keys, code and value mostly are not. Select a cell to see the findings behind it.

UK Public Sector Sovereignty Index by layer group and sector (0 exposed to 100 sovereign)
Layer NHS Central Government BBC Schools Higher Education Local Government Policing Defence Devolved Governments
Physical 92 n=1 43 n=3 50 n=5 82 n=3 56 n=7 — n=0 43 n=8 53 n=13 61 n=2
Infrastructure 30 n=3 41 n=13 44 n=5 83 n=1 43 n=3 53 n=7 39 n=6 36 n=8 29 n=10
Platform 30 n=4 42 n=1 61 n=13 76 n=2 41 n=2 39 n=2 33 n=5 28 n=3 49 n=4
Workplace 45 n=6 39 n=4 36 n=2 58 n=2 47 n=3 32 n=8 26 n=7 49 n=9 26 n=10
Business apps 44 n=16 31 n=6 56 n=14 61 n=7 32 n=10 35 n=29 36 n=35 42 n=20 31 n=32
AI 28 n=3 38 n=7 46 n=3 39 n=4 34 n=4 34 n=5 44 n=2 48 n=7 20 n=1
Security 50 n=4 49 n=2 — n=0 58 n=2 42 n=2 55 n=4 38 n=3 55 n=5 45 n=2

By dimension

D1 Residency 82
D2 Jurisdiction 58
D3 Crypto keys 20
D4 Operational control 56
D5 Continuity 50
D6 Code / model control 11
D7 Ownership 53
D8 IP 22
D9 Supply chain 42
D10 Portability 36
D11 UK capability 47
D12 UK value capture 30

By sector

NHS 42
Central Government 39
BBC 54
Schools 62
Higher Education 41
Local Government 38
Policing 36
Defence 45
Devolved Governments 32

By layer

Physical 54
Infrastructure 40
Platform 47
Workplace 37
Business apps 38
AI 39
Security 50

Scores use equal weights and count each finding once, so a niche component counts as much as a platform used by a million staff. Weighting by seats or spend is planned. Sector scores depend on how many findings could be sourced (shown as n in the heatmap).

Explore the Body of Knowledge

What is sovereignty?

The twelve dimensions, why they matter, and what the UK gains along the way.

Stack Playground

Search, filter and sort all 414 sourced findings by sector, layer, vendor country and score.

What's working

43 UK, EU and allied case studies, including the reversals and what they teach.

Method & dimensions

How findings are gathered, evidenced, scored and kept honest.

Related work

Other UK reports and indices on sovereignty, and how this work complements them.

References

535 sources in Harvard style.

Investment and influence

Announced investment pledges and policy funding by technology firms and their founders. Pledges are intentions, not spend, and several overlap.

FunderHQType VehicleAmountPeriodSource
Microsoft US Capex pledge UK AI infrastructure and operations $30bn (~£22bn) 2025–2028 (Telecoms.com, 2025)
Nvidia with partners US Capex pledge AI factories with Nscale and CoreWeave Up to £11bn Multi-year (Telecoms.com, 2025)
Amazon Web Services US Capex pledge UK data centres £8bn 2024–2028 (Comms Business, 2024)
Salesforce US Capex pledge UK business and R&D $6bn total ($2bn new) to 2030 (Infrastructure Intelligence, 2025)
Google US Capex pledge Waltham Cross data centre, DeepMind £5bn 2025–2027 (Infrastructure Intelligence, 2025)
Oracle US Capex pledge Oracle Cloud Infrastructure UK regions $5bn 2025–2030 (Oracle, 2025)
CoreWeave US Capex pledge Scottish data centres with DataVita £1.5bn (£2.5bn total) Multi-year (Infrastructure Intelligence, 2025)
OpenAI US Compute commitment Stargate UK, Cobalt Park, Newcastle Undisclosed Phased (BTW Media, 2025)
Larry Ellison Foundation US Think-tank funding Tony Blair Institute for Global Change £257m+ donated or pledged 2021– (New Statesman, 2025)
Google DeepMind US Event sponsorship Tony Blair Institute events, Labour conference 2026 Undisclosed 2026 (DeSmog, 2026)

Evidence wanted

A further 191 candidate findings are held back because we have not yet found a source we would stand behind. If you can point to one, please tell us.

Contribute a source