Why this suddenly feels urgent
If you run key public services in someone else's cloud, the landlord's rules matter. MPs say the UK is learning that in real time as health, defence and tax systems move onto American platforms. Lawmakers added that the Trump administration's unpredictability makes the stakes feel higher right now.
Speaking to Bloomberg, Chi Onwurah, chair of the Commons committee on science, innovation and technology, said the US CLOUD Act effectively gives Washington a legal kill switch that trumps UK privacy and data protection rules. Experts briefing the committee said that when Washington classifies an individual as a threat, US-based cloud firms can be compelled to hand over personal data and even shut off service. Earlier this year, the committee cautioned that this could mean British public services are "derailed at any time by a decision taken outside our shores." To illustrate that power, Onwurah cited recent moves by the White House that blocked Anthropic and OpenAI from providing tools to the UK, adding, "The president could kill parts of critical national infrastructure by turning it off."
The money, the contracts, the concentration
By the committee's estimates, government cloud spending runs about £1 billion a year, and the dependence is concentrated. Onwurah said AWS and Microsoft might make up as much as 80% of government cloud services, while officials "don't know the exact level of dependence." In the last 12 months, AWS secured a 10-year, £473 million HM Revenue & Customs contract to manage UK tax data. The Ministry of Defence inked a £400 million agreement with Google Cloud to "strengthen secure communication links between the UK and US." NHS trusts are also moving patient records from on-premise servers to US clouds.
Competition concerns are rising too. Some experts argue the UK faces greater monopoly danger in cloud than in AI, where the field has more competitors. At a recent conference in London, "On this question of monopoly, the place where you can see more concentration is the cloud providers themselves," said the Office for National Statistics' director general of economic statistics, James Benford.
Onwurah also believes the government is "not getting value for money."
Concentration risk is easy to ignore right up until someone else controls the switch. Market Briefs covers tech and policy free every morning.
Power, pushback, and Europe's playbook
AI needs lots of compute, and compute lives in data centres. Last week, AI minister Kanishka Narayan said Britain needs roughly six times today's power just to cover basic needs. That points to a big buildout, but hyperscalers are already running into resistance.
Last month, Scotland's ministers approved a halt on all new hyperscale data centre developments, putting 24 projects on hold, and residents elsewhere have protested, echoing US politics. Narayan thinks stronger cloud security could help: "The thing the British public really doesn't like is their private sensitive data, particularly their healthcare data, going to foreign billionaires." Across Europe, the sovereignty push is picking up. The European Commission is crafting rules under the Cloud and AI Development Act aimed at boosting Europe's sovereignty and competitiveness by encouraging greater use of home-grown infrastructure.
Momentum has been helped by 2025 testimony from Microsoft France's legal director acknowledging the company could not resist a US injunction for French citizens' data. In April, France replaced Microsoft Azure with local provider Scaleway to operate its national health data hub, and it has also built OVHcloud into a domestically controlled cloud platform. The German state of Schleswig-Holstein has transitioned away from Microsoft in favor of open-source options.
In the last year, OVHcloud's revenue was roughly €1 billion, versus $128 billion at AWS. Meanwhile, top data centre companies have affirmed or raised planned capital spending that totals more than $700 billion, according to Bloomberg and company filings.
What London says, and what to watch next
A government spokesperson said departments must weigh "risks associated with over-reliance on any individual supplier" and noted that officials were working "to strengthen resilience and improve the way the public sector procures and manages cloud services." HMRC said its cloud contracts meet "strict government security, data protection and procurement requirements." The MOD said contracts face "strict data sovereignty and security controls." DHSC said protecting patient data is "an absolute priority" and all NHS organizations "must comply with UK data protection law." Departments told Bloomberg their data is safeguarded in UK-domiciled data centres, but did not address the CLOUD Act directly. Onwurah doubts the UK can build a national rival on its own and argues, "We should be working with France and Germany."
Watch for procurement shifts, Europe's sovereignty rules, and local pushback on data centres. If you have savings or a business tied to Britain's buildout of compute and storage, those policy moves can shape timelines and demand.
Who hosts a country's data is becoming an economic question, not just a technical one. Get the free Market Briefs daily newsletter and watch it develop.
