Summary
- MPs and peers are intensifying scrutiny of the UK public sector’s dependence on US cloud providers.
- Parliamentary work has highlighted both provider concentration and the extraterritorial reach of the US CLOUD Act over data held by US companies.
- The debate increasingly links cloud procurement to physical UK data centre capacity, supplier diversity, and the ability to maintain essential services during geopolitical disruption.
Britain’s reliance on US cloud providers is moving from a procurement concern into a wider infrastructure resilience debate as politicians question how much control the UK retains over digital services supporting government and critical public functions.
Current scrutiny centres on the concentration of public sector cloud spending among American hyperscalers and the legal reach of the United States over companies headquartered there. Bloomberg reported on Sunday that MPs are concerned about the dependence of services including health, defence, and tax administration on US owned platforms.
The issue is not whether servers are physically located in Britain. US providers operate substantial UK data centre infrastructure, but corporate ownership and applicable law can still affect the services and data hosted inside domestic facilities.
A House of Commons committee examining the digital centre of government concluded earlier this year that reliance on a small number of US based providers represents a strategic and economic vulnerability. Its evidence noted that the US CLOUD Act could in principle compel US headquartered companies to provide American authorities with access to UK customer data held in UK data centres.
Parliamentary debates have also exposed a more basic information gap. Ministers have faced questions over whether government can state precisely how dependent essential public services are on individual overseas cloud providers. MPs have argued that it is difficult to manage resilience where the state does not have a complete map of those dependencies.
The concern is partly legal, but it is also operational. Large cloud platforms have become embedded in application hosting, identity systems, collaboration tools, data storage, and increasingly AI services. Replacing one provider at short notice is not equivalent to switching electricity supplier: applications may be built around proprietary services, interfaces, and operating models that make migration expensive and technically difficult.
That creates a form of infrastructure concentration above the physical data centre. A department can operate workloads across several halls or availability zones and still depend on one company for the control plane, software stack, contracts, and service access.
The UK government has simultaneously been trying to attract more data centre investment and expand domestic compute capacity. Those policies address part of the problem by ensuring facilities and processing power exist in Britain, but additional buildings do not automatically create supplier sovereignty if the capacity is principally operated by the same small group of global platforms.
Ministers have also discussed using procurement and public investment to strengthen UK technology companies. In evidence to Parliament in July, the government described sovereign AI investment, hardware support, and a review of cloud procurement as ways to increase domestic leverage across the technology stack.
A fully national cloud supply chain is neither realistic nor necessarily desirable. Servers, processors, networking equipment, and software are built through international supply chains, and hyperscale operators have capabilities that smaller domestic providers cannot replicate quickly.
The resilience question is therefore one of concentration and choice rather than complete technological autarky. Government can reduce exposure by knowing which services depend on which providers, requiring credible exit plans, avoiding unnecessary dependence on one provider, and supporting alternatives where workloads justify them.
The physical data centre sector sits underneath that debate. Sovereign providers still require powered buildings, fibre connectivity, hardware supply, and skilled operations teams. If the UK wants more control over cloud services, the policy has to reach beyond software procurement and into the infrastructure needed to operate credible alternatives at scale.
That also changes the commercial significance of new UK data centre capacity. A campus hosting another region for an established US hyperscaler increases domestic compute supply, but it is not the same policy outcome as creating a competitive market of providers able to support sensitive government workloads.
Parliament’s current scrutiny is pushing those distinctions into the open. The next step is likely to focus less on whether foreign cloud providers should be excluded and more on whether government can quantify its exposure, maintain genuine exit options, and prevent operational convenience from becoming an unmanaged strategic dependency.
