Skip to content
You can now search across every topic, entity and event.What's new
Iran Conflict 2026
14AUG

ORG brands UK tech dependency a risk

4 min read
09:56UTC

The Open Rights Group published 'Tech Giants and Giant Slayers' on 15 April, branding Britain's decade of US-tech dependency a national security vulnerability. It cites a CMA estimate that the UK wastes £500m a year on cloud lock-in alone.

← Back to The ships Iran does not control are leaving HormuzJump to analysis ↓
ConflictDeveloping
Key takeaway

The CMA figure means the entire Sovereign AI Fund is being burned every year on cloud lock-in alone.

The Open Rights Group published "Tech Giants and Giant Slayers" on 15 April 2026, arguing Britain's decade of US-tech dependency is a national security vulnerability 1. The report cites a Competition and Markets Authority (CMA) estimate that the UK wastes £500m a year on cloud services due to lock-in, switching barriers and project overruns 1. It flags the US CLOUD Act, the US federal law requiring disclosure of overseas data held by US-headquartered companies, as a mechanism that can compel UK data disclosure without UK consent, and points to Microsoft's documented shutdown of email services for individuals hit by ICC-related sanctions as concrete precedent 1. Palantir contracts, the report adds, are expanding rather than shrinking 1.

The CMA figure sits awkwardly next to the Sovereign AI Fund . In budget terms, the annual cloud waste matches the entire fund spent every year on lock-in alone, yet DSIT has not matched it with a single cloud-layer instrument. The CMA cloud investigation closed in July 2025 without DMA-equivalent enforcement powers, leaving the exposure untouched. Britain is solving the model layer at the margin while the cloud layer still bleeds at scale.

The CLOUD Act flag shifts the framing from commercial efficiency to legal exposure. ICC-sanctioned individuals losing Microsoft email access is not a hypothetical: it is precedent that a US statute can reach UK users through the infrastructure they already use, regardless of where the data sits. The report treats this as an analogue of the EU-level Draghi Report's 11.2% implementation rate after one year : stated ambition without the matching legal instrument. Britain is building a national champion upstairs and leaving the front door open downstairs.

Deep Analysis

In plain English

The Open Rights Group is a British digital rights organisation. In April 2026 it published a report arguing that Britain's dependence on American technology companies carries national security consequences beyond commercial inefficiency. The core of the argument: a US law called the CLOUD Act means American companies can be ordered by US courts to hand over data they hold on behalf of British customers, including government data, without UK courts being involved. The ORG cites Microsoft shutting down email accounts for people sanctioned by the International Criminal Court as a real-world example where US law reached into British infrastructure and cut off services. The Competition and Markets Authority (the UK's competition regulator) estimates that Britain wastes £500m a year on cloud services purely because of the difficulty of switching providers. The report argues that building a domestic AI sector while leaving this dependency unaddressed is building on a compromised foundation.

Sources:The Register / Open Rights Group·The Register / Open Rights Group
Mentions:Open Rights Group →Competition and Markets Authority →CLOUD Act →Microsoft →Palantir →DSIT →Google →Switzerland →Azure →Draghi Report →Brexit →US Treasury →AWS →
First Reported In

Update #2 · Brussels buys, Britain backs, Google unlocks

The Register / Open Rights Group· 19 Apr 2026
Read original →
Causes and effects
Caused by
UK launches £500m Sovereign AI Unit
The ORG report's £500m annual cloud waste finding highlights the gap left by the UK Sovereign AI Fund, which addresses model-layer but not cloud-layer dependency.
Occurred 16 Apr 2026
Read story →
This Event
ORG brands UK tech dependency a risk
The report puts a number on the cloud-layer gap the UK's sovereign AI strategy leaves untouched, and flags the US CLOUD Act as a legal mechanism that can compel UK data disclosure without UK consent.
Different Perspectives
Zawtar municipality, Lebanon
Zawtar municipality, Lebanon
Mayor Muhammad Ismail called the 12 August demolition of the Sheikh Naim Mahdi School the biggest blow of a month that has also taken a nursery, municipal buildings, and his own home. The school falls inside Lebanon's nominal ceasefire zone.
European Union
European Union
The EU's High Representative joined 31 other states on 13 August condemning Iran's use of the death penalty to silence dissent. The joint statement cites no single casualty figure, leaving the scale of what it condemns to three monitors that disagree with each other.
Hengaw
Hengaw
The Norway-based monitor recorded 67 Iranian executions in July alone, against the Abdorrahman Boroumand Center's full-year total of 916 and Iran Human Rights Monitor's roughly 463. None of the three reconciles its count with the other two.
Lloyd's List Intelligence and Kpler
Lloyd's List Intelligence and Kpler
Lloyd's List counted 78 weekly Hormuz transits to 9 August, down from 95, with non-Iranian-linked ships leaving fastest. Kpler-sourced reports for 11 August traffic diverge between outlets by more than double, leaving underwriters no single figure for the route.
United States Treasury
United States Treasury
Treasury Secretary Scott Bessent told Newsmax on 13 August that Washington will announce measures with more detail the following week. He named no instrument, sanctions target, or effective date.
United Arab Emirates
United Arab Emirates
The UAE foreign ministry named the IRGC as the perpetrator of the 13 August attack on two ADNOC vessels, called it piracy, and invoked UN Security Council Resolution 2817. The statement follows five months in which every UAE shipping claim rested on Abu Dhabi's word alone.