The number is striking in its bluntness: almost every organisation in the UK public sector – 95% of central and local bodies – uses cloud services from one of the big American providers. We are not talking about scattered experiments; total spending has now reached billions of pounds a year, and the trajectory, fuelled by accelerated digitalisation and the adoption of artificial intelligence, points only upward.

But the figure that worries analysts most is not the bill. It is the concentration of risk. Because financial dependency translates into technological, strategic and, ultimately, geopolitical dependency. At a time when citizen data, welfare models, healthcare and even automated assessments for benefit allocation flow through infrastructure owned by a handful of companies legally based overseas, the phrase “strategic risk” is not hyperbole.

This is where AI acts as an amplifier. Training and inference of large language models (LLMs) devour compute capacity and storage. AI workloads are inherently voracious: the more they move into document analysis, decision support and administrative process automation, the more the choice to keep everything “in the cloud” becomes not only a technical and economic constraint, but a sovereignty knot that is hard to untie. It is no coincidence that in the public sector, across Europe, calls are growing louder for on-premise or hybrid deployments, where sensitive data remains under direct control and is not subject to extraterritorial legislation.

The structural analysis that follows is stark: the rush to cloud-based AI is creating a paradox. On one hand, governments are incentivised to move to managed platforms to access computing power otherwise unavailable; on the other, every new LLM-based service hosted beyond the border widens the surface of regulatory and operational exposure. For those who lose control over the data lifecycle – from residency to deletion – Total Cost of Ownership (TCO) is not measured in pounds alone, but in the ability to respond to geopolitical shocks, legislative changes or unilateral provider decisions.

Who gains, in the short term, are the three big US hyperscalers, consolidating a positional rent on a segment – public administration – notoriously slow to change supplier. Who loses, beyond taxpayers, is the local technology ecosystem, which struggles to insert itself into hyperspecialised and opaque architectures. But the most worrying signal comes from the speed with which this dependence is extending to the most sensitive workloads, those linked to inference on non-anonymised data or automated decision-making processes. Without a rethink of infrastructure, the next generation of public services risks being born already captive to proprietary stacks that are difficult to reverse.

For those evaluating alternative scenarios, concrete trade-offs exist: self-hosted solutions or hybrid models require investment in hardware, internal skills and orchestration frameworks. They are not easy paths, but they offer a lever that pure cloud cannot guarantee: the ability to choose where to run inference, on what data and with what audit guarantees. The British news is not an isolated case – it is a warning bell that many European public administrations would do well not to ignore.