Government must tackle cloud dependencies, says digital sovereignty expert

UK public sector organisations should prioritise understanding their technology dependencies and identifying which systems require greater strategic control as digital sovereignty rises up the agenda, according to engineering and technology consultancy Zühlke.

Speaking to Think Digital Partners, Zühlke UK CEO Angela Bishop said growing geopolitical tensions, evolving regulation and increasing concern over resilience have transformed digital sovereignty from a technical consideration into a board-level issue.

“We’re still very much in that phase of people getting to know digital sovereignty,” she said. “What is it, and how should we address it? What are the first steps I should take?”

While some organisations, particularly in Switzerland where Zühlke was founded, have been thinking about sovereignty for years, Bishop said many UK organisations are only now beginning to understand how it can improve resilience and reduce strategic risk.

Not an argument against hyperscalers

Bishop stressed that digital sovereignty should not be interpreted as a call to move away from the major cloud providers.

“We’re not going to get away from the hyperscalers. It’s not viable,” she said. “They are leaps ahead in terms of the technology and the frameworks and the toolsets that they offer.”

Instead, she argued organisations should make strategic decisions about which parts of their estate require greater control.

“It’s not saying it’s an all or one answer,” said Bishop. “It’s about what are the strategic parts of the business, or what are the most at risk? What do you want to protect? And it’s about putting a strategy around that part.”

For most organisations, she said, much of their data and workloads can continue to run on hyperscale cloud platforms. The focus should instead be on the smaller proportion of systems containing highly sensitive data or underpinning critical services, where regulatory requirements or operational resilience may demand different deployment models.

Strategic dependencies emerge over time

Chief of software engineering at Zühlke, David Elliman, said organisations often find themselves with strategic dependencies not because of a single decision, but through years of incremental technology choices.

“There’s nothing wrong with deep dependency if you chose it,” he said. “But the problem is, is that people have moved to this gradually through a series of decisions.

“You end up in a position where you think, well, a series of good decisions, maybe even that were right for the business at the time, but you end up somewhere you didn’t intend to be.”

Elliman argued that recent ransomware attacks, software supply chain incidents and vendor licensing changes have highlighted the importance of understanding those dependencies.

“You need to understand your estate, and you need to understand your dependencies, because everything is now about impact and resilience,” he said.

Public sector needs common guardrails

For government departments and local authorities, Bishop believes a more consistent national approach would help organisations make better decisions.

She said central government should establish common principles for digital sovereignty that departments and councils can follow, rather than leaving organisations to develop their own approaches independently.

“I think there’s probably different areas of government doing different things because there isn’t sort of one set of guardrails that they’re working within. So having some guardrails, I think, or principles, would be really helpful to share more broadly.”

Alongside those principles, she said public sector organisations should build a clearer understanding of their technology estates and identify which systems and datasets are genuinely critical.

Preparing for regulatory change

Elliman said organisations should also be preparing for an evolving regulatory landscape, pointing to developments around AI, cybersecurity and data sovereignty.

Rather than waiting until legislation forces changes, organisations should understand how easily critical workloads and services could be moved if circumstances required.

“You have to look at your dependency, understand your estate, understand your dependencies, and you have to risk gauge them,” he said.

“The first thing that we’ve found is just making people aware that this is a big deal. This is like the biggest issue you’ve never heard of.”