Industry voices, MPs and policy analysts say the government has been “too cautious” in exercising new powers to oversee cloud infrastructure deemed critical to the financial system and wider digital economy.

The criticism comes as Amazon Web Services (AWS) and Microsoft continue to dominate UK cloud workloads, including public-sector systems and banking platforms, with limited switching between providers.

Under the Financial Services and Markets Act 2023, HM Treasury can designate “critical third parties” supplying essential services to financial institutions, enabling regulators such as the Bank of England and Financial Conduct Authority (FCA) to scrutinise operational resilience and impose standards.

Cloud giants were widely expected to be among the first to fall under this regime. Yet more than two years on, no provider has been formally designated.

Frustration has mounted in recent months after a major AWS outage in late 2025 impacted government services and financial institutions. Lawmakers said the incident showed the need for faster regulatory intervention and greater clarity on cloud resilience.

The government insists action is coming. City minister Bim Afolami told Parliament the first round of critical-third-party designations is expected in 2026. But critics argue that pace is inadequate given the UK’s dependence on a small number of hyperscalers and the increasingly complex digital services they power, including AI-driven workloads.

“The UK cannot afford to be reactive,” said one industry analyst. “Cloud is already systemic across critical national infrastructure. We need visibility into operational risk, outage readiness, and concentration exposure now.”

Alongside resilience concerns, competition issues are rising up the agenda. The Competition and Markets Authority (CMA) is examining the UK cloud market following a referral from Ofcom, with initial findings highlighting switching barriers, data egress fees, and contractual lock-ins that make it difficult for enterprises to move workloads.

Less than 1% of UK cloud customers switch provider annually, a statistic regulators see as a red flag in such a strategic industry.

Microsoft and AWS have pushed back against claims of harmful dominance, arguing that cloud customers enjoy wide choice and flexibility. However, the CMA has signalled it is prepared to recommend remedies if necessary, including restrictions on egress fees or interventions to ensure interoperability. Decisions are expected in 2026.

For telecom-data infrastructure players, the regulatory debate carries major implications. Multi-cloud strategies and edge deployments increasingly intersect with network operators’ growth plans, particularly as AI accelerates demand for compute-adjacent connectivity and data sovereignty becomes more politically sensitive.

Analysts say cloud concentration risks mirror those seen in subsea cable routes and data-centre markets, where the UK has taken steps to build resilience and encourage diversification. A similar approach may now be required for hyperscale cloud, they argue, including stronger procurement guidance for the public sector and incentives for alternative providers.

International context also looms large. The EU is advancing digital sovereignty rules and operational-resilience requirements for critical cloud suppliers under DORA, while the US is debating federal standards for cloud used in government functions.

For now, industry figures warn that regulatory hesitancy could undermine resilience ambitions and leave the UK exposed. As demand for AI compute, high-capacity cloud networking and sovereign hosting grows, the question is seemingly no longer if the market needs oversight, but how quickly the UK can deliver it.

RELATED STORIES

Data: UK IT leaders warn against US cloud dependence

Outage, outrage and no plan B, AWS failure shows Europe is flying without a safety net