Body of Knowledge · October 2026 · thesovereignstack.org
The Sovereign Stack

Three horizons · 2026 to 2036

Roadmap

Three horizons from evidence to a sovereign, open public stack: what to do now, what to build next, and the long-term bets.

  1. H1 · Now to 18 months Prove it, and stop the drift
  2. H2 · 18 months to four years Scale what works
  3. H3 · Four to ten years Move up the value chain

1. The shape of it

  1. H1 · Now to 18 months Prove it, and stop the drift
  2. H2 · 18 months to four years Scale what works
  3. H3 · Four to ten years Move up the value chain
Each horizon delivers value on its own and builds the conditions for the next. Dates are indicative and the axis is compressed after 2030; the dashed edge marks the ten-year view.

2. What each workstream delivers

Red square: starts now
What each workstream delivers in each horizon
Workstream H1 · Now to 18 months Prove it, and stop the drift H2 · 18 months to four years Scale what works H3 · Four to ten years Move up the value chain
Evidence Body of Knowledge current; evidence-wanted findings sourced; weighted scores Annual index editions; all four nations covered UK capability and value capture among the strongest dimensions
Identity Shared open identity architecture on One Login, CIS2 and the UK federation Identity standard across the shared stack Interoperable with coalition partners
Infrastructure Pilot: open collaboration and storage on UK-operated infrastructure Multiple UK operators on standard frameworks, customer-held keys Open hardware in production for suitable workloads
Workplace Renewals require open formats, held keys and tested exit Open documents and collaboration; open desktops where estates are simple Shared stack is the default for new services
Skills Business case and spend baseline published Schools, universities and the BBC teach on the stack; maintainer pathways Mainstream: people trained on the stack across the public sector
Supply base Share of licence spend redirected to UK open-source hardening UK operators and integrators delivering every layer UK firms exporting services built on the shared stack
AI and compute Evaluation framework for public-sector AI Open-weight models served on UK infrastructure UK and allied compute with diverse hardware supply
Governance and coalition Coordinating body; ownership reviews; coalition agreed with EU, Five Eyes and partners Reference architecture adopted by partners Shared open stack maintained jointly with allies

3. How we will know

How we will know: measures by horizon
Measure H1 H2 H3
UK Public Sector Sovereignty Index Baseline published Rising in identity, workplace and infrastructure Majority of layers partly sovereign or better
Customer-held keys in major platforms Requirement in new contracts Standard Universal
Spend on UK open-source hardening Fund established Growing share of licence spend Self-sustaining UK market
People trained on the shared stack Pilots National programmes Mainstream

4. The detail

The roadmap uses three horizons. Each one delivers value on its own, and each builds the conditions for the next. Dates are indicative.

Horizon 1 · Now to 18 months (to spring 2028)

Prove it, and stop the drift.

  • Publish and maintain the evidence. Keep the Body of Knowledge current, complete the sourcing of the evidence-wanted findings, and add seat- and spend-weighted scores.
  • Use the renewal windows. Several large decisions fall in this horizon, including the Jisc agreement with Microsoft for universities, which runs to the end of 2026 (Jisc, 2026). Each renewal is a chance to require open formats, customer-held keys and tested exit.
  • Identity first. Agree a shared open identity architecture building on GOV.UK One Login, NHS Care Identity Service 2 and the UK Access Management Federation.
  • Make the business case. Publish a spend baseline (licences, cloud and platforms by organisation) and a five-case business case for redirecting a fixed share. See the business case.
  • Fund open-source hardening. Direct a share of existing licence spend to UK firms and maintainers that harden and support the open components the public sector depends on.
  • Set up governance. Establish a small coordinating body for the reference architecture and fund, with seats for sector bodies, the devolved administrations and partners.
  • Watch ownership. Use national security and investment powers to review acquisitions of specialist public-sector suppliers, which the evidence shows are changing hands quickly.
  • Build the coalition. Agree the reference architecture with EU, Five Eyes and willing partners; align with EuroStack and the EU Digital Identity Wallet.
  • Pilot. One or more public bodies and an anchor university run open collaboration and file storage on UK-operated infrastructure.

Horizon 2 · 18 months to four years (2028–2030)

Scale what works.

  • UK-operated open cloud. Multiple UK operators offering open, portable infrastructure with customer-held keys, available through standard public-sector frameworks.
  • Collaboration and storage at scale. Open document formats and open collaboration platforms across organisations that have proven them.
  • Desktop where it fits. Schools and organisations with simple estates move to open desktops, learning from the Gendarmerie, Schleswig-Holstein and the reversals in Munich and Bristol.
  • Skills programmes. Schools, universities and the BBC teach on the shared stack; open-source maintainer pathways and apprenticeships are running.
  • All four nations. The Body of Knowledge and shared components extend to Scotland, Wales and Northern Ireland.
  • A growing UK supply base. Multiple UK operators and integrators delivering each layer through standard frameworks.
  • UK-hosted AI. Open-weight models served on UK infrastructure for public-sector use, with shared evaluation.

Horizon 3 · Four to ten years (2030–2036)

Move up the value chain.

  • Coalition reference stack. A shared open stack maintained jointly with allies and used across their public sectors.
  • Open hardware. RISC-V and other open hardware moving from research into production for suitable workloads.
  • Sovereign compute. UK and allied compute capacity for public-sector AI and research, with diverse hardware supply.
  • Value and capability. UK firms exporting services built on the shared stack; UK capability and value capture among the strongest dimensions in the Body of Knowledge rather than the weakest.