Breaking the Stranglehold: Responses to Data Sovereignty Risk

Why It Matters

Concentration in a few foreign cloud providers threatens national security, price stability and innovation, making sovereign digital infrastructure a strategic priority for governments and businesses across Europe.

Key Takeaways

• 95% of UK public sector spent on US hyperscaler cloud in 2023/24.
• Top five spenders total $4.9bn on hyperscale services last year.
• CMA may grant strategic market status to AWS, Microsoft for intervention.
• EU proposes sovereign cloud projects like Gaia‑X, SecNumCloud, Cloud de confiance.
• UK advocates call for diversified procurement to boost domestic cloud providers.

Pulse Analysis

The United Kingdom’s public‑sector cloud landscape is now dominated by the three U.S. hyperscalers, with 95% of agencies using their services and the five largest spenders allocating roughly $4.9 billion in a single fiscal year. This reliance creates a strategic vulnerability: data could be subject to foreign jurisdiction, and the lack of competition drives up costs, estimated at up to $625 million per year for taxpayers. The concentration also hampers the development of home‑grown technology, limiting the UK’s ability to retain digital expertise and value within its own economy.

European policymakers are moving in parallel to address the same risk. The EU’s early‑day motion and the Berlin summit gathered 900 stakeholders to push for a permanent EU Tech Forum, while initiatives such as Gaia‑X, France’s SecNumCloud certification and the "Cloud de confiance" programme aim to create a secure, sovereign cloud ecosystem. In the UK, the Competition and Markets Authority is weighing a strategic market status for AWS and Microsoft, a tool that could force targeted interventions to curb anti‑competitive practices. These policy signals underscore a growing consensus that digital sovereignty must be embedded in regulatory frameworks, not left to market forces alone.

For businesses, the emerging focus on sovereign cloud translates into both risk and opportunity. Companies that can demonstrate compliance with European data‑sovereignty standards may gain a competitive edge in public‑sector contracts, while those reliant on the big three must prepare for potential migration costs and renegotiated terms. Diversified procurement strategies, investment in domestic cloud providers, and participation in EU‑backed projects could unlock new revenue streams and reduce lock‑in risk. As governments tighten rules and invest in indigenous infrastructure, the market is poised for a shift toward a more balanced, resilient digital ecosystem.