Sovereignty, security and resilience: getting the balance right

Connecting and protecting the country is at the heart of what BT does. We want the UK to succeed, and businesses and public services here to have confidence in the technology they depend on. That is why we are developing sovereign services1 and working with partners to expand UK AI infrastructure2. The aim is to give customers credible sovereign choices over how their services are delivered, secured and maintained, and help build the capabilities the country needs over the long term.

There is a national economic opportunity too. Research by Assembly Research for BT3 estimates that accelerated investment in UK-based data centres could generate £14.6bn by 2030, while the expansion of sovereign cloud services is estimated to be worth an additional £13.6bn over the next five years.

The reality of digital dependencies

Cloud platforms, AI models, software, semiconductors and connectivity all depend on international supply chains and partnerships. These relationships bring investment, expertise and innovation. Trying to replace them all with domestic alternatives would be costly, impractical and could leave the UK less competitive.

The challenge is to understand which dependencies create material exposure, and how much control organisations retain if circumstances change. A supplier’s commercial decisions, an outage or geopolitical restrictions can affect access to services and the ability to maintain them. UK hosting alone does not resolve dependencies on overseas technology, support or decision-making.

These risks also need to be assessed nationally. Where essential sectors depend on the same providers or underlying technologies, arrangements that appear adequate for individual organisations may leave the wider economy exposed to a common point of failure.

The response should be proportionate. Some dependencies can be managed through stronger technical and operational controls, others may warrant greater supplier diversity or investment in domestic capability. Government and industry need a shared understanding of where each is appropriate.

What happens when things go wrong?

A system supporting retail footfall does not carry the same consequences of failure as one used in hospital care, financial payments or defence. Requirements for control, security and continuity should reflect that difference.

For critical services, organisations need clear visibility of who operates systems and who can access them. They need confidence that data is protected, responsibilities are understood and services can continue through disruption. They also need to know what happens if a supplier, region or critical technology becomes unavailable, and what credible alternatives exist.

There are harder questions, too. During a major incident or capacity constraint, which services are restored first? Do critical national workloads receive the technical support, recovery priority and access to capacity their importance warrants?

These arrangements need to be agreed across the supply chain and backed by the capability to deliver them. Setting requirements is only part of the task. Where critical services need greater control, buyers must have credible options that meet those requirements. But developing the infrastructure, skills and operations behind those options takes time, and requires a commercial case for investment.

Building UK capability needs confidence in demand

For capital-intensive cloud and AI projects, that commercial case depends on sufficient committed demand. Suppliers’ ability to secure finance often depends on credible commitments. When demand is spread across separate organisations, even a clear need may not translate into enough firm commitments to start building.

Government can help bridge that gap. By bringing public sector requirements together, it can give suppliers a stronger basis for investment. It can also bring established UK businesses, start-ups, investors and international technology partners together to deliver the capabilities buyers need.

Those efforts need a clear national purpose. A UK digital sovereignty strategy would help government and industry agree which capabilities to develop and how procurement and investment should support them. It should distinguish between attracting infrastructure to the UK and strengthening the domestic expertise and supplier base to operate and sustain it. Both matter, but one does not automatically deliver the other.

The Government’s commitment to ‘Buy British’ is a welcome step and it can go further by using its role as a customer, investor and convenor to:

Define. Set out a clear, tiered and risk-based approach to sovereignty within a UK-wide strategy, so buyers and suppliers understand what level of control, security and resilience is appropriate for different workloads, including the ability to switch providers when needed.

Procure. Coordinate public sector demand through targeted procurement of secure, resilient digital infrastructure, including UK-operated capabilities where needed, to give suppliers the committed demand required to invest at scale.

Finance. Consider targeted investment support where financing barriers prevent viable UK capability from being built, for example by expanding the size and scope of the UK Sovereign AI Fund.

We can build on the best international technology while developing more options here in the UK. That means giving businesses the confidence to invest and government a clear role in supporting them.