A Public Accounts Committee report has put a number on what many public sector IT buyers already suspected: Whitehall's AI ambitions are racing ahead of its ability to secure the creaking systems underneath them. For anyone procuring infrastructure into government or regulated sectors, the gap between ambition and resilience is now the headline risk.
View the data behind this chart
| NS&I | Bank of England | |
|---|---|---|
| Final project cost | £m3000 | £m431 |
A watchdog puts a figure on Whitehall's two-speed problem
The Public Accounts Committee, chaired by Conservative MP Sir Geoffrey Clifton-Brown, has used its second annual report to warn that government departments are chasing AI capability while leaving ageing IT estates largely untouched. His framing is stark: "AI is approaching government like a tsunami, and I remain sceptical that government is prepared for the enormity of this challenge."
For buyers watching from outside Whitehall, the message matters beyond central government. Any organisation that transacts with, supplies into, or depends on public sector systems inherits some of that exposure — whether through shared data pipelines, supply chain contracts, or simply the precedent that under-investment in legacy infrastructure sets for an entire sector.
The digital skills shortfall behind the numbers
Only 6 percent of civil servants currently work in digital and data roles, against a government target of 10 percent, and the PAC notes that senior specialists are in particularly short supply. Hitting the target, the committee warns, will depend on recruiting and retaining far more of them — a problem that compounds every other weakness in the report, because skills gaps are exactly what slow down patching, migration and secure-by-design decisions. Clifton-Brown has also voiced concern that another Whitehall reshuffle, this time involving the creation of the Department for Business, Innovation, Science and Trade, could make matters worse rather than better.
This isn't unique to government. Across UK organisations juggling legacy estates and new AI tooling, the shortage of people who understand both domains is often the real bottleneck, not budget. It's one reason many buyers are shifting routine detection and response work to specialist partners rather than trying to build that capability in-house — see our breakdown of managed detection and response for how that trade-off plays out in practice.
Legacy IT is the vulnerability window, not a footnote
The report is blunt on this point, stating that government is "showing a worrying lack of urgency in addressing the long-standing issue of legacy IT systems, which create significant risks for its cyber security and mean it cannot reap the benefits of new technologies." That's a dual cost: legacy systems are both harder to defend and harder to modernise, which means the exposure window doesn't close on its own — it widens as attackers get better tools.
For infrastructure buyers, this is the practical takeaway: legacy platforms deserve the same scrutiny as any other attack surface, not a permanent exemption because replacement looks expensive or disruptive. Mapping where zero trust principles can be applied to older systems, and where ransomware protection needs to assume compromise is already possible, is a more realistic posture than waiting for a full rip-and-replace that may never arrive on schedule.
AI-powered fraud and the Home Office's asylum tech gamble
The PAC warns that generative AI is giving fraudsters increasingly sophisticated tools just as government departments risk falling further behind. Fraud and error already costs taxpayers an estimated £55 billion to £81 billion a year. The Department for Work and Pensions reckons it overpaid £9.9 billion in benefits through fraud and error in 2025-26 — 3.2 percent of its spending — and aims to bring that down to 2.8 percent by 2028-29. Clifton-Brown's response is pointed: even on that best case, billions will still go out the door.
The Home Office fares no better in the report, with asylum backlogs and costs prompting what Clifton-Brown calls "counterproductive quick fixes." The Home Office and Ministry of Justice spent around £4.9 billion on asylum in 2024-25, and ministers have promised a new system without detailing how it will work — a gap that has already drawn criticism from Open Rights Group, which wants Home Office AI asylum tools scrapped over accuracy, transparency and human oversight concerns. For any organisation deploying AI into high-stakes decision workflows, this is a cautionary tale about shipping automation faster than the governance around it.
NS&I versus the Bank of England: a procurement lesson
The report's most useful comparison for buyers isn't about AI at all — it's about how two public bodies handled IT modernisation. National Savings & Investments began overhauling its IT in 2020 to cut running costs; by December 2024 the bill had reached £3 billion, £1.3 billion over the original estimate, and the project has been rated red since 2022-23, meaning successful delivery is considered unlikely. NS&I couldn't even give MPs a current spend figure or a realistic finish date.
Contrast that with the Bank of England's overhaul of its Real-Time Gross Settlement system, delivered for £431 million and completed in April 2025. The PAC was impressed enough to aim its recommendations at Whitehall generally rather than at the Bank specifically — effectively telling other departments to study how it was done. For organisations weighing their own legacy migration business case, that gap between £3 billion and £431 million is the clearest illustration yet of why scoping discipline matters more than ambition; our IT finance calculator is built for exactly that kind of reality check before a modernisation programme is signed off.
What this means for UK infrastructure buyers
None of this is solely a Whitehall problem. Any organisation still running infrastructure that's approaching end of support — including the wave of estates affected by the ongoing VMware alternatives conversation following Broadcom's licensing changes — faces the same dynamic the PAC describes: attackers innovating faster than defenders can migrate. The committee's warning about AI accelerating both the sophistication of fraud and the urgency of legacy replacement applies just as directly to regulated private sector estates as it does to government departments.
The practical response isn't to wait for a perfect modernisation roadmap. It's to treat legacy exposure as an active risk to be managed now, while planning the replacement properly rather than announcing reforms without a delivery plan — the exact criticism Clifton-Brown levels at ministers. Buyers reviewing their own exposure before the next budget cycle can talk to a Servnet engineer about where to prioritise, informed by what's gone right and wrong in these public sector case studies.
- 01The Register — UK government chases AI while ageing IT leaves it exposed, PAC chair warns · 14 October 2026
- 02National Audit Office — reports on government IT and major programme delivery · 14 October 2026
- 03UK Parliament Committees — Public Accounts Committee reports · 14 October 2026