Britain’s dependence on American cloud companies is no longer simply a question of technology procurement. It is becoming a question of national resilience, economic leverage and ultimately sovereignty.
Some of the UK’s most sensitive public services are increasingly being hosted on infrastructure operated by American technology companies. Tax records, defence systems and NHS data are moving into cloud environments dominated by Amazon Web Services and Microsoft, while Google Cloud has secured major government business.
The attraction is obvious. Building and maintaining comparable infrastructure domestically would be enormously expensive. American cloud providers have scale, sophisticated security systems and computing capacity that Britain would struggle to reproduce on its own.
But efficiency has a price when the supplier becomes indispensable.
The UK government spends roughly £1 billion a year on cloud services, according to estimates cited by Parliament’s Science, Innovation and Technology Committee. AWS and Microsoft may account for as much as 80 per cent of government cloud purchases, although officials do not have a precise measure of their overall dependence.
That uncertainty is itself revealing.
A government cannot properly manage strategic dependency if it does not know how dependent it has become.
The concern is not that American companies are inherently unreliable. The United States remains Britain’s closest major security partner, and cooperation between the two countries extends across defence, intelligence and technology.
The problem is structural.
When critical infrastructure depends on foreign-owned platforms, the ultimate source of control does not sit entirely with the government using them.
The US CLOUD Act has become a particular point of concern. Under American law, US-based technology companies can, in certain circumstances, be required to provide data to US authorities even when that information is stored outside the United States. British officials and lawmakers are therefore questioning whether keeping data physically inside Britain is enough to guarantee genuine control over it.
That distinction between where data is stored and who ultimately controls the infrastructure is becoming increasingly important.
Britain’s public sector is moving rapidly toward a digital economy in which cloud computing is not merely a convenience. It is becoming the foundation on which government services operate.
HM Revenue & Customs has awarded AWS a £473 million, 10-year contract covering UK tax data. The Ministry of Defence has signed a £400 million agreement with Google Cloud. NHS organisations are also transferring patient records to US-operated cloud platforms.
Each contract may make sense individually.
Together, they create something more consequential: dependence.
Once a government builds core systems around a particular cloud provider, leaving becomes difficult and expensive. Data migration is complicated. Software may be designed around proprietary systems. Staff acquire specialised expertise. New applications are integrated into existing infrastructure.
Over time, the cost of switching providers rises.
That is the essence of vendor lock-in.
And cloud computing is particularly vulnerable to it because the infrastructure sits underneath so many other services. Britain’s competition authorities have already identified barriers to switching, including interoperability problems and data-exit costs, while calling for greater choice among providers.
This creates a paradox for Britain.
The country wants to become a leader in artificial intelligence, yet advanced AI requires enormous computing capacity. That means more cloud infrastructure, more data centres and more dependence on the companies capable of providing them at scale.
Britain cannot easily achieve AI ambitions while simultaneously rejecting the infrastructure on which modern AI depends.
But that does not mean it has to accept permanent dependence.
The more realistic objective is diversification.
Britain is unlikely to build a domestic company capable of matching AWS, Microsoft or Google on every dimension. Attempting to reproduce Silicon Valley inside Britain would consume enormous resources and could still fail to provide genuine independence.
A better strategy would be to ensure that no single foreign supplier becomes indispensable.
That means interoperability, portable data, open standards, multiple providers and credible exit strategies. It also means maintaining domestic capabilities in the most sensitive areas, particularly defence, intelligence, healthcare and critical government systems.
Europe is beginning to move in this direction.
France has strengthened its domestic cloud capabilities, including the use of Scaleway for its national health data infrastructure, while Germany has moved parts of its public sector toward open-source alternatives. The European Union is also developing policies aimed at strengthening European cloud and AI capacity.
Britain faces a more complicated position after Brexit.
It has less influence over European digital policy than it once did, yet building a completely independent technological ecosystem is unrealistic.
That makes cooperation with France, Germany and other European technology powers potentially more important, not less.
There is also a political question that London cannot avoid.
If British citizens are increasingly uncomfortable with sensitive healthcare and personal information being held within systems controlled by foreign technology companies, public confidence could become another constraint on the government's digital strategy.
The issue is not simply privacy.
It is whether a government can credibly claim control over critical public services if a foreign company ultimately controls the infrastructure on which those services depend.
Britain therefore faces a choice.
It can continue optimising for short-term efficiency and assume that its political and strategic relationship with Washington will remain sufficiently close to make the risks manageable.
Or it can treat cloud infrastructure as critical national infrastructure and begin reducing its exposure before a crisis forces the issue.
The second approach will cost more.
True resilience usually does.
But sovereignty is rarely tested when everything is working normally. It is tested when relations deteriorate, regulations change, sanctions are imposed, companies face conflicting legal demands or a supplier becomes unwilling or unable to provide a service.
Britain does not need to sever its dependence on American technology.
It needs to make sure that dependence never becomes an instrument of leverage.
The cloud may look invisible, but the power behind it is not. For Britain, the next battle over sovereignty may be fought not over territory or trade, but over who controls the servers on which the state increasingly runs.
