New UK cloud oversight majors on the wrong risk

On July 13, the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority began formal oversight of four leading cloud providers for the first time. This follows their designation as “critical third parties” (CTPs) by the Treasury. The firms – Microsoft, AWS, Google and Oracle – now have regulatory obligations around testing, information sharing and incident management. The new regime is “focused on the resilience of the critical services they provide to the UK financial sector,” according to a statement from the Bank. This looks outdated. Certain EU member states increasingly view U.S. cloud providers and IT contractors like Palantir Technologies PLTR.O as a threat to strategic autonomy, rather than a point of operational failure. It’s not just a problem that critical IT services are provided by a handful of companies, but that those firms are foreign-owned and data stored with them is potentially subject to extraterritorial laws. Britain’s neighbours, including France and [Germany](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/C3A/C3A_node.html), seem to have a better sense of the risk. France asks government bodies and organisations handling government data to adhere to so-called "SecNumCloud" trusted-cloud rules, which say cloud providers must store and manage sensitive data within the EU, with foreign companies owning no more than a small stake in providers. Businesses in critical industries (energy, water, transport, telecoms) are expected to abide by the same rules. France's domestic intelligence agency recently distanced itself from Palantir, while Airbus AIR.PA is turning to local cloud provider Scaleway, owned by telecoms group Iliad, to host some sensitive workloads. Advances in technology make sovereignty issues look even more pressing. U.S. hyperscalers have already established their dominance in AI infrastructure: research group Epoch AI estimated that the big four cloud players plus Meta Platforms META.O collectively [controlled nearly three-quarters](https://epoch.ai/data-insights/hyperscalers-control-most-compute) of global AI compute at the end of last year. As with cloud, European politicians and regulators can either champion homegrown players and accept that their services may not rival Silicon Valley’s – or duplicate the same dependencies. Britain’s new oversight emphasis suggests it’s opting for the latter, and crossing its fingers. Government angst about the UK’s cloud market is nothing new. As long ago as 2019, Britain's Treasury Select Committee [warned](https://publications.parliament.uk/pa/cm201919/cmselect/cmtreasy/224/224.pdf) that large cloud providers risked becoming a single point of systemic failure, and described the case for their regulation as "overwhelming". Hence a new formal UK oversight regime to scrutinise the so-called big four – Amazon Web Services (AWS), Microsoft MSFT.O, Google Cloud and Oracle ORCL.N – makes sense. AWS and Microsoft alone [account for up to 80%](https://www.gov.uk/government/news/cma-independent-inquiry-group-publishes-provisional-findings-in-cloud-services-market-investigation?utm_source=openai) of UK revenues from core cloud services, according to Britain's Competition and Markets Authority. But the regime doesn’t solve for the full risk. Under the new system, the Treasury designates so-called “critical third parties”, whose services to the financial sector are then overseen by the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority. Their charges are now required to explain which of their services are vital, then prove their resilience through testing and self-assessments. The regime also asks the cloud firms to report major disruptions and fix a given weakness once it has been identified. It’s all sensible stuff, if a bit late. The European Union’s financial IT oversight regime, the Digital Operational Resilience Act, has been in force since January 2025. Still, both rulebooks are focused on managing an entrenched reliance on U.S. hyperscalers, rather than diversifying away from them.

New UK cloud oversight majors on the wrong risk

Context on the new regime

Questions over sovereignty and AI infrastructure

UK oversight regime targets major cloud providers

Related News

Jack in the Box schedules Q3 2026 earnings webcast

Evaxion to present three-year phase 2 EVX-01 melanoma vaccine efficacy data at ESMO 2026

Southland wins $25 million in marine and water infrastructure contracts

Ridgepost Capital updates financial calendar for Q2 results release and investor call

Solstice Advanced Materials declares $0.075 quarterly dividend per share