Why haven't UK organizations moved off the hyperscalers?

Two-thirds of UK IT leaders say they would switch cloud providers to take back control. Fifteen percent have actually done it.

That is the headline from Civo's Digital Sovereignty Revolution 2026, a survey of 1,000 UK IT leaders. The intent is loud and getting louder. The movement is almost silent.

It would be easy to call that apathy. It is not. UK organizations are staying on hyperscale infrastructure they no longer fully trust for four very specific reasons. Three of them are structural. The fourth was simply true until this autumn.

Source: Civo, The Digital Sovereignty Revolution 2026

Read the gap that way and the question changes. Britain has decided it wants out. What it has not worked out is how to get through the door.

Reason one: They think they already left

UK-hosted and UK-controlled sound like the same thing. The gap between them is where most sovereignty strategies quietly fall apart.

For a decade, the hyperscaler answer to sovereignty was a UK region. Put the servers in London, tick the residency box, move on. Plenty of boards did exactly that and filed the risk as closed.

Residency tells you where a server sits. Sovereignty tells you whose law it answers to. Under the US CLOUD Act, American authorities can compel US-based providers to hand over data in their control, wherever that data is physically stored.

In June 2025, Microsoft France's director of public and legal affairs was asked under oath by a French Senate inquiry whether French citizens' data could reach the US government without French consent. His reply, as said under oath before the French Senate, was "I cannot guarantee that." He added that it had never happened. That is a statement about the past, not a guarantee about the future.

The UK has its own version. Computer Weekly reported that Microsoft told Scottish policing bodies it could not guarantee data sovereignty for Microsoft 365. A former Cabinet Office ICT chief told the publication that many public sector buyers may have signed up "on blind trust."

Our own research shows how deep that blind spot runs. Only 35% of UK organizations have full visibility of where their data is stored, and 58% are concerned about the legal jurisdiction of their AI provider.

You cannot leave a risk you cannot see. For many UK organizations, the move off the hyperscalers has not stalled. It never started, because someone in the room believes the UK region already solved it.

Watch on YouTube

Reason two: The door is bolted from the inside

Lock-in was sold as convenience. It arrives later as an invoice, a contract clause, and a team that only knows one console.

The UK competition regulator has already done the forensic work. In July 2025, the CMA concluded that competition in UK cloud is not working well, with AWS and Microsoft each holding between 30% and 40% of the market. It named egress fees, incompatible architectures and Microsoft's software licensing as barriers, and found that fewer than one percent of customers move cloud provider each year.

In March 2026, the CMA opened a strategic market status investigation into Microsoft's business software, while AWS and Microsoft headed off a wider cloud probe with voluntary commitments on egress fees and interoperability. Cheaper egress helps. It does not unpick a decade of proprietary integrations.

That is because lock-in is never one thing. Our research found it compounds across four layers at once.

• Technical: Workloads end up wired into proprietary services with no clean equivalent anywhere else, so moving means reengineering.
• Data: Petabytes that were cheap to upload become expensive and slow to move, and data gravity pulls compute toward them.
• Contractual: Committed spend and multi-year deals turn an exit into a finance problem before it is ever a technical one.
• Organizational: Teams, runbooks and certifications are built around one provider's way of doing things.

The longer you wait, the tighter it gets. The share of UK IT leaders who expect to become more entrenched with US hyperscalers has more than doubled in a year, from 12% to 28%. Over the past few years, I have often said that organizations are caught in an ever-tightening web. Not all of that web was spun by the vendor. Kelsey Hightower, a Civo board director who spent seven years inside the cloud industry, watched the pattern repeat:

Read the full breakdown in lock-in is not theoretical, and what the regulator did next in our 2026 CMA analysis.

Reason three: Everything is called sovereign now

When every option wears the same label, standing still starts to look like the safe choice.

The demand is real, and it is accelerating. Gartner forecasts worldwide spending on sovereign cloud infrastructure will hit $80 billion in 2026, up 35.6% in a year. It also expects sovereign spending to shift 20% of current workloads from global to local providers.

The hyperscalers noticed. Sovereign regions, sovereign landing zones and partner-operated models now arrive from every major provider, usually at a price. BCG analysis found that sovereign cloud regions still carry a list price premium of 15% to 30% over standard public cloud.

Many of those offers change where the data sits. Far fewer change who the provider ultimately answers to. In 2026, I spoke about the problem on the main stage at Civo Navigate London 2025:

We call it sovereignty washing, and for UK buyers it creates a quiet paralysis. If the incumbent already sells something called sovereign, and the challenger calls itself sovereign too, the only visible difference is the cost of switching. Staying put wins by default.

The way out is to stop judging the label and start checking the layers. A sovereign claim only holds when all four of these are true.

1. The provider, and its parent company, answer to UK law alone.
2. Operations, support staff and encryption keys sit under the same jurisdiction as the data.
3. Data, metadata, logs and backups all stay in country.
4. You can leave without a punishing egress bill or a rewrite of your stack.

And sovereignty does not have to cost extra. Civo prices its sovereign cloud on the same transparent model as the rest of its platform, with no regional markup for control.

Reason four: There was nowhere to land

You cannot migrate to a promise. For AI, the UK alternative had to exist in steel, power and silicon before anyone could move.

Some leaders see through the residency claims and are ready to pay the exit cost. They still hit one final wall. For years, the only credible home for serious AI compute in Britain has been the same US platforms they were trying to leave.

The ambition is not in doubt. 72% of UK IT leaders believe real UK innovation requires domestic infrastructure, and 43% say AI workloads must stay within UK jurisdiction. The government has committed to expand sovereign compute capacity by at least 20 times by 2030, although we have argued the plan needs to go further on who controls that capacity.

AI also changed what a credible destination means. Moving a web app needs Kubernetes and compute. Moving an AI roadmap needs GPUs, power density, and cooling that most UK facilities were never built for.

What changed? Britain got its spark

On 22 September 2026, on stage at Civo Navigate London, Civo unveiled the first of 40 UK edge data centers. The first site, in Hertfordshire, will open at 8 MW and rise to 38 MW on the same plot. Five more sites totaling 150 MW are already secured across Lancashire, Greater Manchester, London and Oxfordshire, and the full network adds up to a combined gigawatt over three years.

Every site is built for direct-to-chip liquid cooling and designed around NVIDIA Vera Rubin. Civo is taking Vera Rubin orders now, with launch targeted for Q1 2027, while B300, B200, H200, and H100 GPUs are available today.

Source: civo.com/unveiling

The edge matters because the future is inference. Agents, robotics, and autonomous systems cannot wait on a round trip to another continent. Forty sites put compute close to the work and under one jurisdiction, so latency and sovereignty become the same decision. It all runs on Civo's own open stack of Kubernetes, compute and inference, governed by UK law from the silicon up.

Watch on YouTube

Read the full story in What is The Spark? and the Navigate London 2026 wrap-up.

How to close your own gap

Sovereignty is not one big migration. It is a series of decisions you stop putting off.

1. Map what you cannot see: Find where your data, metadata, logs and backups really live, and which legal entity controls each one. Only 35% of organizations have full visibility, so this step alone changes the board conversation.
2. Put a number on staying: Price the exit honestly, including egress, retraining, reengineering and downtime risk. Then price the cost of staying locked in for another five years and compare the two.
3. Move the right workload first: Start with greenfield or noncritical work, especially new inference projects. That proves the route and builds confidence before you touch core systems.
4. Build on open standards: Kubernetes and open protocols keep your next move cheap. Kelsey Hightower describes the ability "to move the needle without permission" as a form of sovereignty.
5. Choose parity over compromise: Cloud parity gives you the same platform, API and tools across public cloud, private cloud and your own data center. Where a workload runs becomes a choice, not a rebuild.

Watch on YouTube

The gap closes one decision at a time

The 51-point gap between intent and action is not a failure of will. It is residency mistaken for control, lock-in that compounds, a label that blurs every option and, until now, nowhere real to land. Three of those are fixable with a clear head. The fourth just got fixed.