UK Cloud Strategy Faces Sovereignty Challenge

Industry observers warn a long-awaited regulatory framework to strengthen oversight of the cloud services underpinning Britain's financial system fails to tackle the country's growing dependence on a small group of U.S. technology providers.

The Treasury has formally designated major cloud providers as "critical third parties", bringing services supplied to the financial sector under the direct supervision of the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority.

Under the new framework, providers must identify the services deemed critical to financial stability, demonstrate their resilience through testing and self-assessments, report significant disruptions and remediate identified weaknesses.

The move reflects concerns that have been building for years. In 2019, Parliament's Treasury Select Committee concluded that the concentration of financial services on a handful of cloud providers created a potential single point of systemic failure and described the case for regulatory oversight as "overwhelming."

Today, those concerns have only intensified. According to the Competition and Markets Authority, Amazon Web Services and Microsoft together account for as much as 80% of UK revenues from core cloud services, highlighting the degree of concentration across the market.

While the new supervisory framework is widely viewed as a positive step, some analysts argue it addresses only part of the problem.

Rather than reducing dependence on a small number of hyperscale providers, the regime focuses on ensuring those providers are more resilient.

The approach mirrors Europe's Digital Operational Resilience Act, which came into force in January 2025 and similarly established enhanced oversight of critical information and communications technology providers supporting financial institutions.

Both frameworks seek to improve operational resilience but stop short of encouraging meaningful diversification away from dominant cloud vendors.

That strategy is increasingly being questioned as geopolitical considerations reshape technology policy.

Across Europe, concerns are shifting beyond operational risk toward issues of technological sovereignty.

Policymakers in several countries argue that heavy reliance on foreign-owned cloud providers exposes governments and critical industries to legal, political and security risks, particularly where data may be subject to overseas legislation.

France has emerged as one of the strongest advocates of this approach through its SecNumCloud framework, which requires sensitive government data to be hosted by providers meeting strict sovereignty requirements.

Similar expectations increasingly apply to operators of critical infrastructure, including energy, transport, telecommunications and water. German policymakers have also emphasized the importance of strengthening domestic digital capabilities.

Some organizations have already begun adapting. France's domestic intelligence agency has reduced its reliance on certain U.S. technology providers, while aerospace group Airbus has announced plans to host some sensitive workloads with a domestic cloud provider rather than relying exclusively on global hyperscalers.

The debate is becoming even more significant as artificial intelligence transforms financial services.

Cloud infrastructure has become the foundation for training and deploying advanced AI models, giving the largest technology companies enormous influence over future innovation.

Research from Epoch AI estimates that the four largest cloud providers, together with Meta Platforms, controlled nearly three quarters of global AI computing capacity by the end of last year.

For banks, insurers and asset managers investing heavily in generative AI, that concentration raises questions extending well beyond operational resilience.

Dependence on a small number of providers could influence access to computing power, advanced AI models, cybersecurity capabilities and future digital infrastructure.

Financial institutions are therefore increasingly balancing two competing priorities: maintaining access to world-leading technology while reducing concentration risk and strengthening resilience against geopolitical disruption.

The UK's new oversight regime is expected to improve transparency and accountability among critical cloud providers.

However, as cloud computing and artificial intelligence become even more central to financial services, policymakers may face growing pressure to complement resilience measures with a broader strategy that encourages greater competition, domestic capability and technological independence.