UK Sovereign AI Infrastructure 2026 Risk: Build or Rent

Anxiety is high, readiness is low

Proton's survey, covering 1,500 businesses in the UK, France and Germany, found that nearly three in four respondents — 73.9% — are concerned the US government could cut off their access to American technology providers, with only one in twenty expressing no concern at all. That anxiety is not evenly matched by preparation: just 44% of respondents said they have a documented business continuity plan that they actually test on a regular basis, leaving the majority relying on hope rather than a rehearsed fallback.

The exposure is severe if the worst happens. More than half of respondents, 54.5%, said they could keep operating for no more than a single business day if they lost access to cloud and digital services entirely. Among large businesses, 28.7% put the cost of a single day offline above €100,000, and 45% estimated damage above €50,000 — numbers that turn a procurement debate into a boardroom risk register item.

Why the kill switch stopped being hypothetical

Proton COO Raphaël Auphan frames this shift bluntly: "The kill switch is no longer an abstract geopolitical concern but a business continuity crisis." The trigger for renewed attention is an actual US export control directive that blocked non-US citizens from accessing certain Anthropic AI models — a live demonstration that Washington can, and will, restrict access along national-identity lines rather than commercial terms.

This matters well beyond email and office software. Identity and Access Management, the layer that authenticates every user and authorises every access decision, is dominated by US vendors, meaning the mechanism controlling entry to a company's entire digital estate is typically incorporated in the United States and subject to American law. A cut-off at that layer would not just disrupt one application — it could lock organisations out of everything at once.

The sovereign alternative gap

The appetite to switch exists — 67.8% of respondents said they would move providers if government action cut off access — but the market has little to switch to. A prior Proton study found more than 74% of publicly listed European companies depend on US-based tech services, and Synergy Research data shows local operators hold only around 15% of the European cloud infrastructure market, with the American hyperscalers controlling the rest.

This is not a new anxiety. A former UKCloud CEO and other industry figures have described growing unease since 2016 about AWS's dominance of the UK market, and UK public-sector guidance issued at the start of 2025 explicitly permits departments to keep using non-UK cloud for resilience, capacity and innovation reasons — implicitly acknowledging that a domestically-owned alternative pool has, in the words of one industry analysis, all but dried up.

Build vs rent: the calculation UK buyers now face

Gartner's advice to government CIOs is to assess cloud workloads by legal jurisdiction rather than physical location — a useful reframe for UK buyers weighing sovereignty against convenience. Renting US hyperscale capacity remains fast to deploy and backed by deep skills and mature tooling, but it inherits US legal exposure. Building UK-based capacity removes that exposure but demands capital, time and specialist skills that are still scarce.

Separate research has calculated that if all of Europe moved onto public cloud today, it would still take roughly 20 years at historical build rates to create enough datacentre capacity to meet existing demand — a reminder that capacity, egress costs, platform skills and breadth of service all stack up as real barriers to a fast exit. A structured AI inference build vs. rent break-even analysis is the sensible starting point before committing capital either way.

• •73.9% of surveyed firms fear a US-driven cut-off, but only 44% have a tested continuity plan
• •Local providers hold roughly 15% of the European cloud infrastructure market
• •67.8% say they would switch providers given a government-triggered disruption, but few can do so quickly

What UK buyers should actually do now

Every respondent in Proton's survey reported at least one disruption in the past 12 months, from outages to cyberattacks to lost service access — proof that resilience planning is not a paranoid exercise but ordinary risk management that has simply been under-resourced. UK buyers should treat this survey as a prompt to stress-test their own single-day exposure figure, not just their IT team's, but finance's and operations' too.

Practical steps include mapping which workloads sit under US legal jurisdiction regardless of where the data physically resides, piloting UK-hosted alternatives for the highest-risk systems, and reviewing capital options through finance options for AI servers so that sovereign capacity doesn't require an unaffordable lump-sum outlay. Teams starting from scratch should also look at practical guidance on building a UK on-premise AI cluster before assuming a full migration is the only route to reduced exposure.

The bottom line for procurement teams

The Proton findings turn geopolitical risk into a line item: a majority of firms could not survive more than a day without US cloud and digital services, and less than half have rehearsed what happens if that day arrives. That is a resilience gap procurement and infrastructure teams can close incrementally — hybrid architectures, jurisdiction-aware workload mapping and staged sovereign builds — without waiting for a crisis or a policy mandate to force the decision.