From cloud-first to data-first: why 2026 is the year we rethink the strategy
Chris Roberts
Director, Public Sector UK&I, NetApp
Website:: www.netapp.com/
Read lessmore
The “cloud-first” doctrine that defined a decade of public sector IT modernisation is reaching its limits. It was built for a world of experimentation, not one where artificial intelligence runs continuously on sensitive, high-value public data under strict legal and operational constraints. Today, CIOs face a different reality shaped by production-scale AI, tightening sovereignty rules, and escalating cloud economics. The challenge in 2026 is no longer how much can be migrated to the cloud, but how to architect a unified data fabric that spans on-premises, cloud, and edge environments while keeping data secure, governed, and cost-efficient.
Why cloud-first falls short of production-grade AI
Cloud-first made sense when organisations needed agility and rapid deployment of digital services. But AI has changed the operating model. Modern systems depend on continuous inference over large institutional datasets such as health records, transport systems, and fraud detection platforms. These workloads are not episodic; they are persistent and high-frequency.
This shift exposes structural weaknesses in cloud-first approaches. Every inference call, data movement, and API interaction introduces latency and cost. Egress fees alone now account for a significant share of cloud spend, often cited at 10–15% of total bills, and can rise sharply in AI-heavy workloads. At scale, organisations are effectively paying multiple times: once for storing data on-premises systems they cannot retire, and again for cloud infrastructure that cannot fully replace them.
Regulation reinforces this constraint. UK frameworks including GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, and upcoming cyber resilience legislation increasingly require data to remain under UK jurisdiction. In sensitive sectors such as defence or intelligence, the US CLOUD Act adds further complexity, allowing extraterritorial access to data held by US providers. In many cases, data simply cannot move.
Addressing the infrastructure challenge
Most public sector organisations now operate fragmented environments spanning legacy infrastructure, multiple cloud platforms, and emerging edge deployments. These systems rarely share consistent governance, security, or audit frameworks.
This leads to three flawed options for AI workloads: move data to the cloud and incur cost and sovereignty risk; keep data on-premises and lose access to modern AI tooling; or manually orchestrate across environments, creating operational complexity and inefficiency. None of these approaches scale effectively. The result is duplicated investment and growing technical debt, where organisations fund parallel infrastructures that do not fully integrate and cannot be retired.
A data-first model can go a long way in addressing these challenges. By introducing a unified data layer that spans all environments, compute is positioned where data resides. In turn, this allows storage to become flexible, allowing it to unlock better insights, integrate with AI more effectively and improve resilience and traceability.
This shift is already underway across the public sector. For example, HMRC has publicly described how it has established an internal generative AI “landing zone” to enable AI use cases such as fraud detection and compliance analytics, while keeping sensitive taxpayer data inside a tightly governed and controlled environment. Elsewhere, the Department for Work and Pensions has also formally stated that AI is being deployed “in a measured and controlled manner”, with strict security, data protection, and governance requirements that dictate where and how AI systems can operate.
The 2026 priority
The priority is to move beyond cloud migration as an end goal. Organisations must classify data properly, design a single consistent infrastructure layer, and make deliberate workload placement decisions based on real constraints. Procurement must reward hybrid architectures that demonstrate interoperability, governance consistency, and total cost efficiency.
Cloud-first was an important phase of modernisation, but it was never intended to be permanent. The next phase is about control, not location. Success in 2026 will belong to organisations that can place every workload exactly where it belongs, rather than forcing everything into a single environment.
