Why UK MPs want a stronger push for sovereign IT

MPs propose a comprehensive UK digital sovereignty strategy

The UK is moving into a bigger conversation about who controls the technology behind government and critical infrastructure. A group of 20 MPs has backed an amendment to the Cyber Security and Resilience Bill that would require the government to publish a digital sovereignty strategy within 12 months. The goal is straightforward: understand where the UK depends on foreign technology, identify the risks, and build a plan to reduce them over time.

The proposed strategy covers much more than cyber security in the traditional sense. It would examine hardware, software, supply chains, procurement decisions, and the companies that operate critical digital services. It would also look at how foreign governments could influence or disrupt these systems through legal powers, sanctions, or broader geopolitical actions.

This reflects a broader shift in how governments view technology. Digital infrastructure is now part of national infrastructure. Decisions about cloud platforms, software vendors, and procurement models increasingly affect national resilience, economic competitiveness, and public trust.

For business leaders, this is worth paying attention to. Government procurement often sets the direction for wider markets. If the UK introduces policies that prioritize resilience, supplier diversity, and domestic capability, technology vendors and enterprise buyers will likely adapt their own strategies. Organizations that already understand where they rely on single suppliers or overseas dependencies will be in a stronger position if regulations evolve.

The strategy is not designed to isolate the UK from global technology. Victoria Collins, Liberal Democrat MP and sponsor of the amendment, has been clear that the objective is to take a “smart, strategic and ambitious approach” to UK technology, not to close the country to international innovation. The focus is on building stronger capabilities at home while continuing to benefit from global technological progress.

There is also an economic dimension. Supporters believe stronger domestic technology capabilities could help UK companies compete more effectively for public-sector contracts, encourage investment, and develop skills in strategic industries. If implemented carefully, this could strengthen both economic resilience and national security without reducing access to international markets.

The proposal also aligns with concerns already raised in Parliament. The Science, Innovation and Technology Committee has described the UK’s reliance on a small number of technology providers as a “clear vulnerability,” warning that digital transformation in the public sector could become “at the mercy” of foreign actors. That assessment provides much of the policy momentum behind the amendment.

The strategy emphasizes managing foreign interference risks while building domestic technology capability

The proposed digital sovereignty strategy goes beyond identifying risks. It also asks how the UK should respond to them. That includes reducing strategic dependence on foreign-owned technology providers while investing in domestic capabilities that can support essential public services over the long term.

The amendment calls for systematic assessments across several areas. Government would evaluate risks associated with hardware, software, digital supply chains, procurement practices, managed service providers, and operators of essential services covered by the UK’s Network and Information Systems Regulations. The objective is to understand where critical dependencies exist before they become operational problems.

For executives, this reflects a broader trend in enterprise technology. Organizations are placing greater emphasis on resilience alongside cost and performance. Supplier concentration, geopolitical uncertainty, regulatory change, and cyber threats have become board-level issues. Managing these risks increasingly requires visibility across the full technology stack rather than focusing only on security controls.

The proposal also encourages greater use of technologies developed in the UK where they strengthen resilience and reduce unnecessary strategic dependence. That does not necessarily mean replacing every foreign supplier. Instead, it creates incentives to diversify technology ecosystems, encourage competition, and ensure critical services have alternatives when disruption occurs.

This approach could also influence procurement policy. Supporters argue that UK technology companies often struggle to compete against large multinational vendors when government contracts are awarded. A digital sovereignty strategy could create procurement frameworks that give innovative domestic companies greater opportunities while maintaining rigorous standards for security, capability, and value.

Victoria Collins has argued that too much of the UK’s critical infrastructure and government services depend on foreign technology and supply chains, creating “real risks, from national security vulnerabilities to economic fragility.” She also stated that UK technology companies are frequently locked out of government procurement in favor of larger multinational firms, and that a proper digital sovereignty strategy would support UK innovation while reducing long-term dependencies.

For business leaders, the message is practical. Supply-chain resilience is becoming a strategic capability rather than simply an operational consideration. Companies that diversify suppliers, understand critical dependencies, and invest in technology flexibility will be better prepared as governments introduce new resilience requirements and procurement expectations across critical sectors.

Heavy reliance on a limited number of overseas technology companies is seen as a critical vulnerability

The amendment is driven by a growing concern that the UK’s digital infrastructure has become too dependent on a small group of global technology providers. The discussion is not about whether these companies deliver high-quality technology. It is about what happens when essential government services rely heavily on a limited number of suppliers that operate under foreign jurisdictions.

Supporters of the amendment point to the risks of vendor lock-in. Once government departments build critical systems around proprietary platforms, moving to another provider becomes expensive, technically challenging, and sometimes impractical. Over time, this can reduce competition, limit flexibility, and increase operational risk.

The concern extends beyond commercial relationships. MPs argue that geopolitical developments could directly affect digital services used by the UK. Foreign governments may introduce sanctions, legal requirements, export controls, or other measures that influence how technology companies operate. If critical public services depend on those companies, decisions made outside the UK could have domestic consequences.

The Science, Innovation and Technology Committee has echoed these concerns, describing the UK’s dependence on a small number of providers as a “clear vulnerability.” The committee warned that the country’s ambitions to modernize public services could become “at the mercy” of foreign actors if concentration risks continue to grow.

Victoria Collins has also raised questions about the limited public information available regarding these risks. She has argued that the National Risk Register does not provide enough transparency about scenarios in which foreign states could use legal powers to disrupt or discontinue critical digital services used across the UK.

This issue is not unique to government. Large enterprises often face similar challenges after years of technology consolidation. Cloud platforms, enterprise software, cybersecurity services, and data infrastructure frequently become deeply integrated into business operations. That creates efficiency, but it can also reduce strategic flexibility if organizations have limited alternatives.

For executives, the lesson is not to avoid global technology providers. They remain essential partners for many organizations. The priority is understanding where dependencies exist, assessing the impact if services become unavailable, and ensuring that critical functions are not unnecessarily concentrated with a single vendor or jurisdiction. Resilience increasingly depends on maintaining options.

Strengthening the domestic technology sector is integral to the UK’s economic and security resilience

Supporters of the amendment argue that digital sovereignty should not be viewed only through a security lens. It is also an economic strategy. Building stronger domestic technology capabilities can improve resilience while creating opportunities for innovation, investment, and long-term growth.

The proposal encourages the government to support UK technology companies through procurement and strategic investment. Advocates believe many domestic firms struggle to compete for public-sector contracts because procurement processes often favor established multinational providers with greater scale and existing government relationships. A more balanced approach could create a stronger competitive environment without lowering standards.

Victoria Collins has argued that “a proper digital sovereignty strategy would change that: backing UK innovation, reducing the UK’s dependencies, and ensuring the UK is a world leader in the technologies that will define the next decade.” Her position is that strengthening domestic capability should complement, rather than replace, international collaboration.

A stronger domestic technology sector can also expand the UK’s skills base. Government demand often influences private-sector investment, research activity, workforce development, and startup growth. When public procurement supports innovation, it can encourage companies to invest in new products, advanced engineering, cybersecurity capabilities, and specialized digital services.

For business leaders, this creates potential opportunities as well as new competitive dynamics. Companies with UK-based development, research, or service capabilities may find increased opportunities to participate in public-sector projects if procurement priorities evolve. At the same time, international providers that invest locally and contribute to the UK’s technology ecosystem could remain important partners under a digital sovereignty framework.

The broader objective is resilience through capability. A country that develops stronger domestic expertise in critical technologies gains greater flexibility when responding to economic shocks, supply chain disruption, or geopolitical uncertainty. That does not eliminate the need for international technology partnerships. Instead, it creates a more balanced technology ecosystem where domestic capability becomes an additional strategic asset rather than a replacement for global innovation.

Parliamentary debates spotlight the concentration risk in public-sector technology procurement

The discussion around digital sovereignty is closely connected to how the UK government buys technology. MPs are increasingly questioning whether current procurement practices have unintentionally concentrated critical public services within a small number of global technology providers. While these vendors offer mature and widely adopted platforms, concentration itself has become a strategic concern.

The Science, Innovation and Technology Committee has argued that relying on a limited group of suppliers creates a “clear vulnerability.” The concern is not simply about individual companies. It is about systemic risk. If multiple government departments depend on the same cloud platforms, software providers, or managed services, a disruption affecting one supplier could have consequences across many public services at the same time.

Supporters of the amendment also argue that procurement decisions made today shape technology choices for many years. Once major systems are deployed, organizations often invest heavily in integration, employee training, operational processes, and data migration. These investments can make future supplier changes significantly more difficult, increasing long-term dependence on incumbent vendors.

Victoria Collins has argued that this procurement model has another consequence: UK technology companies often struggle to compete for government contracts against large multinational firms. As a result, domestic innovation may receive fewer opportunities to scale through public-sector partnerships, even when competitive alternatives exist.

For executives, procurement should increasingly be viewed as a strategic function rather than an administrative process. Cost, functionality, and implementation speed remain important, but resilience, supplier diversity, contractual flexibility, and long-term control over critical systems are becoming equally important decision factors.

This shift is already visible across many industries. Boards are asking management teams to assess concentration risk alongside cybersecurity, financial exposure, and operational continuity. Technology procurement is becoming part of enterprise risk management rather than a standalone purchasing activity.

Organizations that regularly evaluate supplier concentration, maintain competitive procurement processes, and preserve flexibility within their technology architecture are likely to be better prepared for future regulatory expectations and changing geopolitical conditions.

There is a growing call for greater transparency around government assessments of digital risk

Supporters of the amendment argue that effective digital resilience depends on better policy and on greater transparency. MPs have expressed concern that much of the government’s assessment of long-term digital risks remains confidential, limiting informed public discussion and making it more difficult for organizations to prepare for emerging threats.

Victoria Collins was among four MPs who wrote to the Chancellor of the Duchy of Lancaster and the chairs of two parliamentary committees in April, urging the government to strengthen the resilience of UK digital systems against potential interference by foreign governments. They also requested publication of the government’s internal analysis of several “chronic risks” that remains confidential.

According to the letter, these risks include the concentration created by the dominance of global technology companies, the UK’s reliance on digital platforms and digital services, and the potential impacts associated with artificial intelligence. The MPs argued that keeping the entire analysis secret limits meaningful public debate and policy development.

Their position is not that every security assessment should be made public. Certain operational details will always require protection. Instead, they argue that governments should publish enough information to allow businesses, researchers, policymakers, and citizens to understand the nature of strategic risks and contribute to developing effective responses.

The MPs also noted that several European countries have held more open national discussions about digital sovereignty and technology dependence. They believe greater transparency has helped those countries build broader consensus around digital resilience and long-term technology policy.

For executives, transparency has practical value. Organizations make better investment decisions when they have a clearer understanding of regulatory priorities, national security concerns, and emerging systemic risks. Greater visibility into government thinking can improve long-term planning, supplier selection, risk management, and technology investment strategies.

As digital infrastructure becomes increasingly important to economic activity, governments and the private sector will need closer coordination. Sharing appropriate information about strategic risks can strengthen resilience across both sectors while maintaining necessary protections for sensitive national security matters.

European governments are advancing digital sovereignty initiatives to reduce dependence on foreign technology

The UK debate is taking place within a much broader international movement. Across Europe, governments are reassessing how much control they have over the technologies that support public services, national security, and economic activity. The objective is not to disconnect from global technology markets but to reduce strategic dependence in areas considered critical to national resilience.

The European Commission has already outlined plans to strengthen Europe’s sovereign IT capabilities. These plans include investment in European data centres and greater adoption of open source software to reduce reliance on US technology suppliers. The emphasis is on ensuring that Europe retains the ability to operate critical digital infrastructure even as geopolitical and economic conditions evolve.

Several European countries have already begun implementing national initiatives. France is introducing sovereign open source desktop and collaboration tools for senior civil servants to reduce the risks associated with surveillance and potential service disruption. Germany’s armed forces are moving to OpenDesk, an open source alternative to Microsoft Office, as part of a broader effort to strengthen operational independence.

The movement extends beyond government software. European banks are working together to develop their own electronic card payment system as an alternative to the US-operated Mastercard and Visa networks. This reflects a broader effort to reduce dependence on external providers in sectors where financial infrastructure is considered strategically important.

These initiatives demonstrate that digital sovereignty is no longer viewed solely as a cybersecurity issue. It has become part of industrial policy, economic competitiveness, and long-term national resilience. Governments are increasingly evaluating where domestic capability should be strengthened while continuing to participate in global technology markets.

For business leaders, these developments have important implications. Organizations operating across Europe should expect procurement requirements, regulatory expectations, and technology investment priorities to continue evolving. Companies that support interoperability, open standards, supplier diversity, and resilient infrastructure may find themselves better positioned as governments increasingly prioritize strategic autonomy in critical sectors.

The UK is now considering whether to follow a similar path. While the specific policies may differ, the underlying questions are consistent across Europe: where critical dependencies exist, how much resilience is needed, and what role domestic capability should play in supporting national digital infrastructure.

Supporters and critics agree on the importance of resilience but differ on how digital sovereignty should be implemented

There is broad agreement that the resilience of the UK’s digital infrastructure deserves greater attention. Where opinions differ is in how far government policy should go in promoting domestic technology and reducing dependence on foreign suppliers.

Supporters of the amendment argue that current levels of dependence create unnecessary national security and economic risks. They believe the proposed digital sovereignty strategy would encourage better long-term planning, reduce strategic vulnerabilities, and strengthen the UK’s ability to control the technologies that underpin essential public services.

Jim Killock, Executive Director of the Open Rights Group, supports the amendment and argues that the UK’s reliance on major US technology companies presents both national security and economic risks. He stated that “by voting on this amendment, MPs can take the first step to secure the UK’s resilience and control over its digital infrastructure.” His organization views the proposal as an important step toward improving accountability and strengthening the country’s digital independence.

Not everyone agrees with every aspect of the proposal. Richard Starnes, Chief Information Security Officer and author of a study on the UK’s cybersecurity and privacy legislative framework, acknowledged that the amendment raises legitimate national security concerns. However, he cautioned that it also risks combining two separate issues: protecting critical infrastructure from foreign interference and promoting domestic industry through economic policy.

Starnes argued that “the enormous risks facing UK critical infrastructure, vendor lock-in and the UK’s current economic climate warrant a more strategic, open-minded approach.” His perspective highlights an important policy challenge. Governments must reduce genuine security risks without unnecessarily limiting competition, innovation, or access to globally competitive technologies.

For executives, this distinction matters. Most organizations will continue to depend on international technology partners for many years. The strategic objective is not complete technological self-sufficiency. Instead, it is developing sufficient resilience, supplier diversity, and operational flexibility to manage disruption while continuing to benefit from global innovation.

The debate is therefore likely to focus less on whether digital sovereignty is important and more on how it should be implemented. Organizations that actively monitor policy developments, diversify critical dependencies where practical, and build resilience into long-term technology strategies will be better positioned regardless of the final legislative outcome.

Final thoughts

The UK’s debate over digital sovereignty is not simply about where technology comes from. It is about ensuring that critical systems remain resilient, adaptable, and under sufficient national control as geopolitical and economic risks continue to evolve.

For executives, the discussion offers a useful reminder that technology strategy and business strategy are becoming increasingly interconnected. Decisions about cloud platforms, software providers, procurement, and supply chains now have implications that extend well beyond cost and performance. They influence resilience, regulatory readiness, operational continuity, and long-term competitiveness.

The outcome of the proposed amendment remains uncertain, but the direction of travel is becoming clearer. Governments are placing greater emphasis on supplier diversity, strategic resilience, and reducing unnecessary dependencies in critical infrastructure. Similar conversations are already taking place across Europe, suggesting this is part of a broader shift rather than a temporary policy debate.

Business leaders do not need to wait for new legislation to act. This is an opportunity to assess technology dependencies, review procurement strategies, strengthen supply chain visibility, and identify where greater flexibility can reduce long-term risk. Organizations that build resilience into their technology decisions today will be better prepared for tomorrow’s regulatory, economic, and geopolitical challenges.

Digital sovereignty is ultimately about creating options. The organizations that understand their dependencies, diversify where it makes strategic sense, and continue investing in innovation will be in the strongest position as technology policy continues to evolve.