Making the case
Questions and challenges
The objections we hear most often, with the evidence for and against. Where the evidence is against us, we say so.
Isn't open source less secure?
Security comes from maintenance, not from whether code is visible. The risk with open source is under-funded maintainers; the answer is to fund them, which is exactly what Germany's Sovereign Tech Agency does for critical components such as OpenSSH and systemd (Sovereign Tech Agency, 2026). Proprietary concentration carries its own risk: a single vendor's faulty update took GP systems offline across England in 2024 (Digital Health, 2024). Hardening open components that the public sector depends on is supply-chain security.
Won't it cost more?
Transition costs are real, and under-resourced migrations fail. Done well, open estates have reported lower running costs, and the money to start is largely already being spent on licences. See the business case for figures on both sides, including Munich's expensive return to Windows (heise online, 2017).
Will staff lose productivity?
They can, if change is rushed. Freiburg reverted after a review estimated significant productivity losses (Computerwoche, 2012), and Schleswig-Holstein's fast email cutover caused outages (Staatskanzlei Schleswig-Holstein, 2025). The French Gendarmerie, which moved in stages over years with strong support, now runs about 100,000 open desktops (Hillenius, G., 2013). That is why the architecture starts with identity and storage, which users barely see, and leaves desktops until later.
What about documents we exchange with others?
Interoperability is the most common reason migrations reverse: Bristol returned to Microsoft Office in 2010 because document exchange with other public bodies kept breaking (Buss, A., 2010). The fix is a common standard across government. The UK already mandates Open Document Format for sharing documents (UKAuthority, 2018); the task is to make it real everywhere at once, not one organisation at a time.
The US is our closest ally. Why does this matter?
Sovereignty is not hostility. It is the ability to keep services running whatever happens elsewhere. When US sanctions cut off the International Criminal Court prosecutor's Microsoft email, the court moved to an open European workplace (heise online, 2025). Allies can share open building blocks; that is why we propose a coalition with EU, Five Eyes and willing partners.
Can UK suppliers actually deliver?
The base exists but needs demand to grow. UK-owned operators include Civo, which describes its sovereign cloud as built and owned in the UK (Civo, 2026), and Mythic Beasts, which is founder-owned and hosts in UK data centres (European Purpose, 2026). AI infrastructure firm Nscale is UK-domiciled but has filed for a US listing (Computing, 2026), which shows how quickly ownership can move. Redirected spend is how this market scales.
Do we have the skills?
Not yet at the scale needed, which is why skills are a pillar in their own right. Schools, universities and the BBC can teach on the stack the public sector runs. See Skills.
Will open tools meet accessibility needs?
They must. Accessibility (WCAG 2.1 AA as a minimum) is a requirement for every component in the reference architecture, tested with users in pilots before wider rollout, not assumed.
What about AI?
AI is the most foreign layer today. The aim is not to ban commercial models but to make sure the public sector can run capable open-weight models on UK infrastructure, pin versions, and switch providers. See the key findings.
What about Scotland, Wales and Northern Ireland?
Health, education and much procurement are devolved, and each nation runs its own systems and agreements. The Body of Knowledge currently focuses on England and UK-wide bodies, noting devolved differences where found. A UK-led stack should be offered to all four nations as shared building blocks, with each choosing how to adopt.
Who would run it?
We propose that a small, accountable body coordinates the reference architecture and the hardening fund, working with the digital centre of government, sector bodies such as Jisc and NHS England, and partner countries. Delivery stays with many suppliers. See Vision.
Isn't this another big central IT programme?
It must not be. The NHS National Programme for IT and GOV.UK Verify show what happens when large programmes are procured centrally and imposed (National Audit Office (reported by Digital Health), 2013; National Audit Office, 2019). The approach is the opposite: small shared components, voluntary adoption, as GOV.UK Notify spread (Government Digital Service, 2026). See what's working.