Sixty-seven percent of UK IT leaders told Red Hat they have an exit plan ready if their main AI provider cuts them off. Forty-three percent of the same group said switching would cause moderate to significant business disruption. Both numbers can't really be true at once.
The survey – 500 IT decision makers across the UK, Netherlands, France, Germany, and Italy, run by Censuswide in late March – landed the same month the UK government launched its £500 million Sovereign AI Unit. The political and commercial conversations have converged on the same word: sovereignty. The practical question underneath it is whether any of this is actually executable.
What the numbers are really saying
Eighty-seven percent of UK respondents are already running agentic AI – systems that take actions on their behalf, not just answer questions. Twenty-five percent say they have strong governance around it. Fewer than half have complete visibility of where their data is stored and processed.
So the typical UK organisation is handing decisions to an AI system, doesn't fully know where the data goes, doesn't have strong rules for what the system is allowed to do, and has an exit plan that it quietly believes would hurt if triggered. That is not sovereignty. That is a dependency with a Post-it note stuck to it.
The government angle
On 16 April, Technology Secretary Liz Kendall launched the Sovereign AI Unit – a £500 million fund with an initial £80 million of procurement opportunities, chaired by James Wise of Balderton. The stated goal is to reduce the structural reasons UK AI firms end up on US cloud infrastructure by the default of where the compute is.
It's a reasonable policy response. It does not, on its own, change anything for an SME using Copilot, Gemini, or Claude through a US-hosted API today. The House of Commons Library has counted roughly £8 billion in active government contracts with US big tech. The dependency is not going to unwind quickly, and your business is downstream of the same infrastructure.
What sovereignty means for a smaller business
For most SMEs, "sovereign AI" is not a realistic procurement category yet. The useful version of the question is narrower: if your AI provider raised prices sharply, suspended your account, or had its service restricted for reasons outside your control, what would actually happen on Monday morning?
Three practical checks:
- Where does the data go, and who can see it? If you can't answer that in one sentence per system, you don't have governance – you have a subscription.
- What could you switch to, and how long would it take? Not in theory. A real test: could a different model, accessed through a different provider, do the job your team relies on? Have you tried?
- What have you given the AI permission to do? Read-only access to a mailbox is very different from write access to a CRM or a payments system. Agentic AI blurs this line fast.
None of this requires a sovereignty strategy. It requires knowing what you've plugged in.
The honest position
Avoiding US-hosted AI entirely is not realistic for most UK businesses right now, and pretending otherwise helps nobody. But an exit plan that nobody has tested is the security equivalent of a fire drill nobody has run. The 43 percent who admitted switching would disrupt them are the honest ones. The gap between the two numbers in that survey is where the real work is.
How Steelwise can help
Working out what you've plugged in, where the data goes, and what would actually happen if you had to switch is the kind of review we do. No sovereignty strategy required – just a clear picture of what you depend on. Get in touch.
Further reading
- IT Pro's write-up of the Red Hat survey
- Computer Weekly on the governance gap
- The Register on the Sovereign AI Unit launch
- House of Commons Library briefing on digital sovereignty