Body of Knowledge · October 2026 · thesovereignstack.org
The Sovereign Stack

Body of Knowledge

Method & dimensions

How findings are gathered, evidenced and scored, and the limits of what the scores can tell you.

Scope

Nine sectors were studied: NHS, Central Government, BBC, Schools, Higher Education, Local Government, Policing, Defence, Devolved Governments. Each was mapped across 28 layers in 7 groups (Physical, Infrastructure, Platform, Workplace, Business apps, AI, Security). A finding records one product or system in one layer for one group: who supplies it, where the vendor is headquartered, who ultimately owns it, how it is licensed and hosted, its scale and published spend, and how portable its data is.

Evidence policy

The Body of Knowledge is source-based. Each finding carries an evidence status: Confirmed (an official or primary source such as a contract notice, annual report or departmental statement) or Reported (credible press or trade reporting). Only these are published: 414 findings. A further 191 candidate findings, reasoned from context but not yet sourced, are held back as evidence wanted. Sources are listed in Harvard style on the references page.

Research was carried out as structured desk research in October 2026, with AI-assisted search and extraction, and headline figures checked against their sources. Spend figures are published contract values or ceilings over stated periods; they are not annual spend and should not be added together without checking periods and overlaps.

Research protocol

  1. Frame. For each sector, list the bodies, buying routes and decision makers, then work layer by layer from chips to security asking: what is used, who supplies it, who owns the supplier, and what it costs.
  2. Search. Primary sources first: Contracts Finder and Find a Tender notices, annual reports, board and committee papers, NAO and select committee reports, FOI responses, algorithmic transparency records and company announcements. Then credible trade and national press (for example Computer Weekly, The Register, PublicTechnology, Digital Health, UKAuthority).
  3. Extract. Each finding records the fields in the data dictionary below. AI-assisted search and extraction is used to cover ground quickly; every published claim carries the URL it came from.
  4. Classify evidence. Confirmed (official or primary source), Reported (credible press) or Inferred (reasoned from context, no source). Only Confirmed and Reported findings are published or scored.
  5. Score. Map field values to the rubric below. Nothing is scored by hand.
  6. Check. Headline figures and high-impact findings are re-opened at source before publication, and the build fails if a published finding has no dimensions record.

Coverage

9 sectors across 28 layers. Local government, policing, defence and the devolved governments were added in October 2026; defence findings first listed under central government now sit under Defence.

Sector Published Confirmed Reported Evidence wanted Layers covered
NHS 37 13 24 25 16 / 28
Central Government 36 10 26 45 15 / 28
BBC 42 20 22 18 15 / 28
Schools 21 9 12 32 12 / 28
Higher Education 31 21 10 31 15 / 28
Local Government 55 42 13 15 16 / 28
Policing 66 33 33 4 21 / 28
Defence 65 36 29 12 19 / 28
Devolved Governments 61 47 14 9 17 / 28

Data dictionary

Each finding records the following. Allowed values for every scored field are listed in the rubric below; the full dataset is published as JSON.

Sector, sub-unit
The public sector and, where known, the named body (e.g. a trust, council or force).
Layer
One of 28 layers from chips to security.
Product / system; vendor
What is used and who supplies it.
Vendor country; ultimate owner; owner country
Headquarters of the supplier and of whoever ultimately controls it.
Ownership change
Completed or agreed change of ownership or control since 2020, with buyer and year.
Licence; governance
Proprietary, open source, open standard or open core; single vendor, community or foundation.
Hosting; hosting location
SaaS, cloud, on-premises or endpoint; where the data sits (UK, EU, mixed, US).
Prevalence; seats or users
How widely it is used in the sector, with a stated basis for any count.
Data format; format owner; open specification
What the data is held in and who controls the format.
Portability; switching cost; exit cost drivers
How hard and costly it is to leave.
Operator location; key custody; code and model control
Who runs it, who holds the encryption keys, and who controls updates.
IP owner; continuity risk; supply-chain risk
Who owns what is built, and exposure to failure or disruption.
UK capability; UK value capture
Whether credible UK alternatives exist and how much of the value stays in the UK.
Spend; period; source
Published contract value or ceiling, the period it covers, and where it was published.
Evidence status; source; date
Confirmed, Reported or Inferred, with the URL and date of the source.

The twelve dimensions

Each finding is scored from 0 (exposed) to 3 (sovereign) on twelve dimensions in four groups, using the rubric below. Values outside the rubric (not applicable or unknown) are left unscored rather than counted as zero. The overall score is the mean of the scored dimensions, shown on the site as an index from 0 to 100.

DimensionGroupQuestionRubric (value → score)
D1 Residency Data Where is data stored and processed?
hosting_location: UK 3 · EU 2 · Mixed 1 · US 0
D2 Jurisdiction Data Whose law can compel access?
tier: T1 UK 3 · T2 EU/EEA 2 · OSS (governance-led) 2 · T3 Five Eyes (ex-UK) 1 · T4 Other allied/partner 1 · T5 Non-allied 0
D3 Crypto keys Data Who holds the encryption keys?
key_custody: Customer (on-prem) 3 · HYOK 3 · BYOK 2 · Vendor 0
D4 Operational control Control Who runs it and holds admin access?
operator_admin_location: UK cleared 3 · Customer (in-house UK team) 3 · UK 2 · Vendor-global 1 · Offshore 0
D5 Continuity Control Can it be suspended, degraded or repriced from outside?
continuity_risk: Low 3 · Medium 1.5 · High 0
D6 Code / model control Control Can the code or model be inspected, pinned or self-hosted?
code_model_control: Self-hosted / open 3 · Version-pinnable 1.5 · Vendor-controlled 0
D7 Ownership Technology & ownership Who ultimately owns the vendor?
tier: T1 UK 3 · T2 EU/EEA 2 · OSS (governance-led) 2 · T3 Five Eyes (ex-UK) 1 · T4 Other allied/partner 1 · T5 Non-allied 0
D8 IP Technology & ownership Who owns the code, configuration and derived IP?
ip_owner: Customer 3 · Open 3 · Shared 1.5 · Vendor 0
D9 Supply chain Technology & ownership Where do chips and hardware come from?
supply_chain_risk: Low 3 · Medium 1.5 · High 0
D10 Portability Technology & ownership How easy and costly is exit?
portability: Easy 3 · Moderate 1.5 · Hard 0
switching_cost: Low 3 · Medium 1.5 · High 0
D11 UK capability Capability & economy Could the UK run or rebuild it?
uk_capability: Strong 3 · Partial 1.5 · None 0
D12 UK value capture Capability & economy How much value stays in the UK?
uk_value_capture: High 3 · Medium 1.5 · Low 0

Jurisdiction tiers: T1 UK (and Crown Dependencies); T2 EU/EEA; T3 Five Eyes excluding the UK; T4 other allied or partner states; T5 non-allied. Community open source is treated as governance-led rather than by country.

The UK Public Sector Sovereignty Index

The headline score published across this site is the UK Public Sector Sovereignty Index: the mean of the twelve dimension scores across all sourced findings, expressed from 0 to 100. It measures what UK public institutions actually use and how much control they hold over it, not national capacity in general.

EditionPublishedMethodSourced findingsIndexDataset
2026 (first) October 2026 v1.0 414 42 findings-2026.json
2027 Planned for October 2027 v1.0 or later — — —

Editions and versioning

How it compares with other indices

Other sovereignty indices measure different things. Forrester's technology sovereignty index scores 14 countries on national capacities such as chips, cloud and AI models, and puts the UK at 30% for 2025 (Forrester, 2026). Nextcloud's index counts self-hosted collaboration deployments per head of population, with the UK at 9.21 against an EU average of 16.31 (Nextcloud, 2025). The UK Public Sector Sovereignty Index is narrower in scope and deeper in control: it is built from named systems in named institutions, and every score traces back to a sourced finding. See related work.

How scores combine

Each dimension scores from 0 to 3 using the rubric above; where a dimension draws on two fields (D10 uses portability and switching cost) it takes their mean. A finding's score is the mean of its scored dimensions. Sector, layer and dimension scores are means across the findings in them, and the index is the mean across all sourced findings, multiplied by 100 and divided by 3.

Spend concentration

The where the money goes view uses 139 sourced contracts with named suppliers, worth £31bn in total. Vendor names are grouped to one supplier (for example all Palantir contracts count as Palantir). Microsoft is counted once, using the public-sector-wide estimate under its SPA24 agreement (GOV-056); individual Microsoft contracts are left out to avoid counting the same spend twice. Values are contract values or ceilings over different periods, so shares describe the published pipeline of contracts, not annual spend. The following findings carry a value but are excluded:

Ownership changes

A change of ownership counts when a supplier, or the business that supplies the system, was bought, taken private, merged or restructured so that control changed, since 1 January 2020, and the deal was completed or formally agreed. Contract moves between suppliers, funding rounds, stock-market listings, minority investments and sales that are only being explored do not count. Each deal counts once however many findings it touches: 46 deals across 72 findings. A deal is published only when a finding records it and carries a separate source for the ownership change; the table shows the change as that source reports it. See who bought whom.

Quality assurance

Limitations

Corrections and contributions

If a finding is wrong, out of date, or you can supply a source for an evidence wanted item, please contact us. The dataset is published under CC BY 4.0 so it can be checked, challenged and reused.