Can Public Procurement Strengthen the UK’s Digital Sovereignty?

Digital sovereignty has moved from a niche concern to a strategic priority for governments across Europe. In the UK, efforts have focused largely on sovereign AI while a far larger lever has gone underused: the government’s own purchasing power. This article looks at the state of public procurement, sets the UK against how European neighbours are meeting the moment and argues for a national digital sovereignty strategy and a bolder approach to innovation. 

Why everyone is talking about digital sovereignty

The conversation about digital sovereignty started gaining momentum when the former European Central Bank President, Mario Draghi, released his report on the future of European competitiveness in 2024; highlighting the strategic dependency on critical technologies like computer chips, cloud computing platforms and frontier AI models that are dominated by overseas giants. 

Digital sovereignty - broadly, a nation's ability to make independent choices about its digital infrastructure, data and technology, rather than having those choices shaped or overridden by foreign providers and governments - has since become a political priority. 

Various events have precipitated UK and European efforts to find a response to this mounting challenge; among them: 

• Microsoft France’s director of public and legal affairs admitted that the sovereignty of French customers’ data is not guaranteed due to the CLOUD Act that lets the US government obtain data held by US-based companies on foreign servers. Microsoft has also been accused of leaking the names of Dutch civil servants working on the implementation of the EU’s Digital Services Act to the US House of Representatives.
• The US Government imposed sanctions on ICC judges, leading to US tech companies shutting down personal Google and Amazon accounts and, seemingly, restricting access to one of the judge’s official emails, though Microsoft has denied this.
• Anthropic temporarily disabled access to its Fable 5 model following an export ban imposed by the US Government, signalling the Trump administration’s willingness to cut foreign allies’ access to key technologies without warning.

How the UK and EU are reacting

In the UK

Despite spending an estimated £14 billion per year on digital services, the UK Government does not have an overarching policy on digital sovereignty. Instead, much of its attention has focused on sovereign AI, in the hopes of turning fundamental AI research and talent from UK universities, the presence of leading AI labs and the AI Institute’s global leadership on AI safety and governance into a competitive advantage.

Building out national AI compute is seen as a major enabler and the government plans to invest up to £2 billion by 2030 and to establish AI Growth Zones to keep momentum behind private data centre investment. In addition, a £500 million Sovereign AI Unit aims to de-risk and scale British AI startups by offering funding, access to compute and fast-track R&D visas. Yet these efforts remain strikingly disconnected from the government's own purchasing power: the Sovereign AI Unit has no influence over the £14 billion the state spends on digital services each year; spending that continues to flow mostly to big overseas vendors.  

In the EU

In contrast, the EU has a much more defined policy approach, agreeing on a Declaration for European Digital Sovereignty during the Summit on European Digital Sovereignty in Berlin. It is also working on a Cloud and AI Development Act meant to close the gap in cloud and AI infrastructure, as well a European Open Digital Ecosystem Strategy that acknowledges “open source as a crucial contribution to EU technological sovereignty, security and competitiveness”.

In addition, the EU developed a Cloud Sovereignty Framework that it hopes will be a reference point for cloud providers to drive compliance with European standards and values which will play a role when assessing whether cloud services meet digital sovereignty requirements during procurement. That public procurement design can play an important role in strengthening digital sovereignty has also been noticed by the EU, which launched a new procurement process for cloud services based on mini competitions that will enable cloud providers of varying sizes to build multi-tenant solutions.

In the private sector

In the private sector, businesses have started to work on redundancy plans for technical infrastructure and generative AI systems as part of their risk management. While the market share of cloud providers this side of the Atlantic remains small, the pressure on US hyperscalers is big enough for them to advertise European sovereign cloud offerings. However, these offerings mostly amount to data residency rather than data sovereignty: a European data centre operated by a US-headquartered company remains subject to the CLOUD Act.

It is no accident that such offerings do not meet standards like France's SecNumCloud, which excludes providers subject to extraterritorial legislation by design. Additionally, some European governments have started to move away from US-made software, ditching tools like Teams and Microsoft Office in favour of homegrown or open-source options and the Dutch government blocked the takeover of cloud provider Solvinity by US-based Kyndryl to protect the sovereignty of the Dutch digital ID. 

The status quo of public procurement and SMEs in the UK

Public procurement is a major lever to strengthen the UK’s digital sovereignty and an obvious path to tap into the capabilities of national SMEs. That SMEs can play a key role in a country’s digital sovereignty has been demonstrated by digital leaders like Estonia. X-Road, a secure open-source data exchange layer for sending and receiving data between private and public sector organisations, is a prominent success story. Rather than procuring a finished product from a single vendor, the government specified an open standard and contracted domestic firms to build against it, retaining ownership of the architecture while keeping individual contracts small enough for SMEs to win. This approach demonstrates that sovereignty can be an output of procurement design, not just procurement nationality. In addition, choosing an open approach let Estonia benefit from the contributions of other countries who faced similar challenges. Today, X-Road contributes to the digital sovereignty of over 30 countries and is maintained by over 2000 members from more than 60 countries.

In contrast, recent reports by the National Audit Office and the House of Lords Science and Technology Committee on technology procurement found that the UK government’s approach is hampering modernisation and innovation while preferencing operating models like subscription-based cloud services from big tech companies that weaken the UK’s digital sovereignty. In addition, today’s public procurement makes it hard for innovative SMEs to participate and favours large and often overseas incumbents.

Research from Tussell shows that, among the Top 150 IT government suppliers, the market share of UK-based vendors has declined in recent years and the value of AI projects awarded to US-based firms was almost double that of those won by UK-based suppliers. The most striking recent example is the £240 million Ministry of Defence contract awarded to Palantir in December 2025, which Politico states was awarded without a competitive process, and criticised from across the political spectrum for deepening reliance on US firms at the expense of British alternatives, highlighting the tension between the government’s ambition to support sovereign capabilities and actual procurement outcomes.

Decisions like these are, in part, driven by a longstanding culture of risk aversion in public procurement, which limits innovation and makes access to public contracts especially difficult for SMEs and startups. The Procurement Act 2023 was meant to change this through a focus on outcomes and more flexible tenders but, so far, this has done little to change the default stance procurement teams take.

How public procurement and SMEs could support the UK’s digital sovereignty

The House of Lords Science and Technology Committee recommends several changes to public sector procurement practices aimed specifically at increasing SMEs’ access. This includes a mandatory spend on UK-based SMEs, the creation of a central contracts database, outcome-based procurement to provide flexibility and stage-gated contracts that allow smaller companies to develop and scale their processes. This could make it more likely for SMEs with innovative solutions to the UK’s digital sovereignty challenges to get access to and succeed in tenders.

Some of the necessary tools already exist. The Procurement Act 2023 provides for flexible competitive procedures and the disaggregation of contracts into smaller lots, levers well suited to opening tenders up to SMEs. What is missing is the instruction to use them for this purpose, which the government could supply through the National Procurement Policy Statement. Tussell’s GovTech Market 2026 report shows a tenfold increase in social value-related terms in award criteria following the Procurement Act, suggesting that this act is an effective way to steer procurement across public sector organisations. Formal implementation of sovereignty-focused award criteria would also give SMEs additional incentives to develop sovereignty-focused solutions and would de-risk their long-term investment in upskilling staff to work with alternatives to big tech’s services, which would otherwise be the default. 

Procurement can also work as a scaling mechanism, not just a defensive one. Analysis from the University of Cambridge argues that the UK's core problem is not inventing technology but scaling the companies that build it. The government acting as an anchor customer is the missing pathway, with institutional adoption validating solutions and giving startups the revenue and references they need to grow. Connecting the Sovereign AI Unit's portfolio to real public sector procurement opportunities would be the obvious place to start, and would answer the criticism that it operates in isolation from the government's own spending. 

Additionally, a UK sovereignty certification or assessment scheme, analogous to France's SecNumCloud or the EU's Cloud Sovereignty Framework and Gaia-X label, would simplify sovereignty-focused procurement. Creating a shared standard would prevent each department devising its own and give SMEs a clear target to work towards. Open standards and interoperability as default award conditions could also lead to solutions that naturally work towards sovereignty goals.

At Butterfly Data, we have made good experiences with frameworks like the Home Office’s Accelerated Capability Environment (ACE). ACE brings together expertise from industry, academia and the public sector to speed up the development of innovative technology solutions. It directly supports public sector organisations with technical expertise, removing one of the limiting factors identified by the National Audit Office’s report. An overarching framework that focuses on digital sovereignty could give more SMEs access and spawn innovative solutions.

In the meantime, there are private initiatives starting to fill the void left by the government’s lack of an overarching strategy, such as AIM for the UK, a citizen-led group which wants to develop a “vision for the role of AI in our society, democracy, and economy”. SMEs should also seek strength in numbers, use their networks and collaborate with peers to demonstrate to the government that they can play a crucial role in strengthening the UK’s digital sovereignty while advocating for the much-needed national frameworks and changes to public procurement.

Conclusion

So, can public procurement strengthen the UK's digital sovereignty? Yes, but not as currently practised, quietly working in the opposite direction.

Given the scale of the UK government's technology operations, changing course is a major challenge and it seems unlikely to happen without a clear vision. Developing a national digital sovereignty strategy that goes beyond the existing measures, mostly limited to the UK's AI economy, should be a priority. That strategy will have to acknowledge that more control over our digital services and infrastructure comes at a cost and that the UK cannot outspend the US tech sector.

It means being selective, applying the strictest sovereignty requirements where the stakes are highest rather than everywhere at once and learning from digital leaders like Estonia, who have shown that smart procurement design makes a difference. If spent differently, the £14 billion a year of demand that the government already controls could have a sizeable impact on the UK's digital sovereignty. At the same time, the government needs to back those willing to take risks on innovative ideas, SMEs and startups. Only if procurement teams overcome the reflex to buy tried-and-tested yet dependency-deepening solutions do the many good ideas coming from within the UK stand a chance to make us more sovereign. 

‍