The Global Centre for Risk and Innovation (GCRI)
Computing now spans hyperscale cloud regions, national and private data centres, and processing at the edge of networks, near sensors and users. The arrangement decides latency, cost, control over data, resilience and dependence on a few providers. This page sets out how cloud and edge systems are organized and where they concentrate risk, how they are measured, and what evidence serves the public institutions choosing among them.
GCRI · In development · service level R0
Cloud and edge computing are arrangements that deliver computing from large provider data centres and from sites near where data are produced. For public institutions they bring capability along with concentration on a few providers, questions of data location and jurisdiction, and switching costs that need deliberate design.
For cloud and edge systems, in GCRI's spatial-intelligence reading, the map opens on night lights, true-colour imagery and population density with true colour from NASA GIBS, framed on the contiguous United States; every other NASA layer, live feed and forecast waits in the layer list.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Connected activity, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
For cloud and edge systems, in GCRI's spatial-intelligence reading, the map opens on night lights, true-colour imagery and population density with true colour from NASA GIBS, framed on the contiguous United States; every other NASA layer, live feed and forecast waits in the layer list.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place; claim ceiling INTEGRATED.
Layers and dates
Hybrid, local and sovereign computing options. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Economies of scale give a small number of providers most of the cloud market. Public bodies gain capability and inherit shared dependencies.
Where data are stored and processed affects which laws apply, who can compel access and how quickly services respond.
Processing at base stations, gateways and devices reduces latency and bandwidth, but adds many distributed systems to secure and maintain.
Proprietary services, data egress charges and skills tie customers to providers. Portability and interoperability reduce lock-in but take deliberate design.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Hyperscale cloud | Very large cloud platforms operated by a few providers across many regions. |
| Data egress | Transfer of data out of a provider's network, often charged. |
| Portability | The ability to move data and workloads between providers with limited effort. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Public sector workloads in cloud | percent of workloads | annual | Government digital strategy reporting | REPORTED |
| Cloud market share of largest providers | percent | annual | Market studies | ESTIMATED |
| Cloud regions per country | count | annual | Provider documentation | DECLARED |
| Workloads with tested exit plans | percent of critical workloads | per assessment | Exit plan records | REPORTED |
| Data egress charges | currency per gigabyte | per change | Provider price lists | DECLARED |
| Edge sites deployed | count | annual | Operator reports | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| Competition authority cloud market investigations | Market structure, switching barriers and remedies | Public records, licence per authority |
| Provider region and service documentation | Locations and services offered | Public, terms per provider |
| Government cloud strategies and frameworks | Public sector cloud policies and procurement | Public records, licence per government |
| OECD digital economy reports | Cloud adoption by firms and governments | Public, OECD terms |
| Eurostat cloud computing usage in enterprises | Share of enterprises using cloud services | Open, Eurostat reuse policy |
Data and Compute prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Government digital and procurement agencies | Which workloads to move to cloud and under what terms | Dependency analyses; exit assessments |
| Competition and data protection authorities | Whether market structure or data transfers need intervention | Market and jurisdiction evidence |
| Network operators and city authorities | Where edge computing serves public needs | Edge trade-off studies |
No point on the continuum is best for everything. The same institution often runs sensitive records on its own systems, bursts large analyses to cloud, and processes sensor data at the edge. The risk lies less in any single choice than in dependencies that accumulate without anyone deciding on them.
Elastic capacity and managed services, with dependence on a few large providers and their regions.
Direct control and jurisdiction, with responsibility for operation, security and refresh.
Low latency and local resilience, with challenges in management, security and power at many small sites.
Matching requirements for performance, data residency and resilience to locations. Limits: requirements change and are often unclear at the start.
Identifying reliance on specific providers, regions and services. Limits: providers' internal dependencies are not fully visible.
Threat modelling and controls across the continuum, using cybersecurity and cryptography. Limits: shared responsibility models can leave gaps.
Comparing lifetime costs including staff, energy and exit. Limits: sensitive to assumptions about use and pricing.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.