The ambition
The UK should lead an open, shared stack for public digital infrastructure: the identity, data, collaboration, cloud and AI building blocks that every public service depends on. Built in the open with EU, Five Eyes and other willing partners, it would give each country real choice over the technology its services run on, while sharing the cost and the expertise.
Our Body of Knowledge shows why. Data about UK citizens is mostly held in the UK, but the keys, the code, the commercial decisions and the value mostly sit elsewhere. The places where the UK runs open, shared infrastructure, such as GOV.UK Notify, Jisc’s Janet network and NHS smartcard identity, are among the most resilient and best value we found.
What we mean by highly reliable, dispersed and user-centric
- Highly reliable. Services keep running through supplier failure, takeover, price changes or foreign legal action. No single update, outage or contract can stop a public service.
- Dispersed. Capability is spread across many operators, suppliers and locations, at home and among allies, rather than concentrated in a handful of global platforms. Open standards make the parts interchangeable.
- User-centric. Citizens and staff own their identity and data, choose who can reach them, and can move between services without lock-in. Every design decision gives users more control, not less.
Principles
- Evidence first. Decisions are grounded in a public, sourced Body of Knowledge that anyone can check and challenge.
- One reference architecture, many suppliers. A shared blueprint built on open standards, delivered by multiple UK and allied firms, so we do not swap one monoculture for another.
- Open by default. Open source, open standards and open data formats, with publicly funded code released for reuse.
- Control, not just location. UK operation, customer-held encryption keys and portable workloads are requirements, not options.
- Skills as infrastructure. Schools, universities and the BBC help build the people who will run and improve the stack.
- Build with allies. Work with EU initiatives such as EuroStack and the EU Digital Identity Wallet, with Five Eyes partners, and with any country willing to share building blocks.
What changes
| Today | Tomorrow |
|---|---|
| Most core platforms rented from a few global vendors | Shared open building blocks with multiple suppliers |
| Data stored in the UK, keys and code held elsewhere | UK-operated services with customer-held keys |
| Licence spend leaves the UK on long contracts | Spend hardens open components and grows UK firms |
| Skills concentrated in vendors | Skills built through schools, universities and the BBC |
| Each organisation buys alone | Coordinated renewals and shared components |
Governance
A small, accountable coordinating body should hold the reference architecture, run the open-source hardening fund and publish the Body of Knowledge, working with the digital centre of government, sector bodies such as Jisc and NHS England, the devolved administrations and partner countries. It sets standards and funds maintenance; it does not build or run everything itself. Delivery stays with many suppliers, and adoption is voluntary and earned, as it was for GOV.UK Notify.
Security
Security is a reason to act, not a reason to wait. Open components the public sector depends on should be funded for maintenance, audit and rapid patching, as Germany’s Sovereign Tech Agency does for critical open-source infrastructure. Customer-held keys, UK operation and supplier diversity reduce the impact of any single failure or compromise. See questions and challenges.
Across the UK
Health, education and much procurement are devolved. The stack should be offered to all four nations as shared building blocks, with each choosing how to adopt, and the Body of Knowledge should extend to Scotland, Wales and Northern Ireland.
Growing the UK supply base
Redirected spend creates demand for UK operators, integrators and maintainers. Procurement should reward suppliers that operate in the UK, hold no lock-in, contribute upstream and build UK skills, so that a competitive UK and allied market can deliver every layer.
Paying for it
Most of the money is already being spent on licences and rented platforms. The business case sets out how to redirect it, what transition really costs, and how to price the risk of doing nothing.
Illustrative services
The stack is a foundation, not an end in itself. Services built on it show what becomes possible. FrankMail is one illustration: an email service where people control who can reach them, verified identity replaces guesswork, and spam stops paying.
The ask
We are building a coalition of public bodies, suppliers, universities and partner countries. We are asking for:
- Evidence. Sources that confirm, correct or extend the Body of Knowledge, including the findings still marked evidence wanted.
- Pilots. Public bodies willing to run open identity, collaboration or storage on UK-operated infrastructure, and a university to evaluate them independently.
- Sponsors. Leaders prepared to ring-fence a share of a forthcoming renewal for UK open-source hardening and support.
- Partners. Countries and initiatives, including EuroStack, ready to share building blocks.
Read the roadmap, see the hard questions, and get in touch.