GCRI · Digital Public Infrastructure
Public cloud and concentration
Many public digital systems run on commercial cloud platforms or a few national data centres. This brings scale and capability, and it creates dependence on a small number of providers, questions of jurisdiction over data, and shared points of failure. This page sets out how hosting choices shape the risk of public digital infrastructure, how concentration is measured, and what evidence serves the governments and regulators who make these choices.
Public cloud and concentration on the record.
Public cloud and concentration: how the risk develops.
Vendor dependency and continuity. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
A few providers host much
Cloud markets are concentrated, so many public services depend on the same providers and regions.
Jurisdiction follows the provider
Foreign providers may be subject to laws that compel data access, raising sovereignty concerns for sensitive public data.
Exit is hard
Proprietary services and data transfer costs make it difficult to move systems between providers or back in-house.
Concentration is a shared vulnerability
An outage or compromise at one provider or region can disrupt many public services at once.
DPI service health.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
DPI service health
Public cloud and concentration · Payment switch · Today
- Transactions today3,217,1006Active
- Authentication success, %98.1Normal
- Availability, % this month99.60Normal
- Grievances open562Watch
Throughput
Rails
| Identity verify | 138 | 0.8 | Normal |
| Instant payment | 567 | 0.4 | Normal |
| Data exchange | 365 | 1.1 | Degraded |
| Offline fallback | n/a | n/a | Standby |
Concentrated cloud services are a common mode for public services.
Findings are designed for the Strategic Systems series. DORA (2022) introduced oversight of critical providers to finance; the Global Centre for Risk and Innovation (GCRI) rates no provider.
- Dependency maps under terms.
- Exit plan evaluations.
How public cloud and concentration is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
Datasets and provenance
The data classes behind public cloud and concentration and what is recorded about each before it is used.
| Data class | Provenance recorded | Resolution stated | Licence checked |
|---|---|---|---|
| Satellite imagery, optical and radar | sensor, processing level, acquisition date | pixel size and revisit | per scene |
| Reanalysis and climate model output | model, experiment, member, version | grid and time step | per release |
| In-situ sensors and gauges | station, instrument, calibration record | point and sampling rate | per network |
| Population and asset exposure | method, vintage, input sources | cell size and unit | per release |
| Boundaries and reference geography | producer, edition, date | scale | per edition |
- Lineage
- W3C PROV record from source to figure
- Principles
- FAIR: findable, accessible, interoperable, reusable
- Gaps
- shown as missing, never filled silently
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Public workloads by hosting type | percent of workloads | per assessment | Government inventories | DECLARED |
| Share of public cloud spend with the largest provider | percent | annual | Procurement data | OBSERVED |
| Critical systems with tested exit plans | percent | per assessment | Exit plan records | REPORTED |
| Sensitive data hosted under domestic jurisdiction | percent of sensitive datasets | per assessment | Data classification records | DECLARED |
| Provider outages affecting public services | count and hours | annual | Incident records | OBSERVED |
| Sovereign cloud offerings available | count | per assessment | Market review | REPORTED |
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| Government cloud strategies and procurement frameworks | Policies and contracts for public cloud | Public records, licence per government |
| Competition authority cloud market studies | Market concentration and switching barriers | Public records, licence per authority |
| Public procurement data portals | Spending by supplier | Open data, licence per portal |
| EU Data Act provisions on cloud switching | Rules on switching and egress charges | Public, EU terms |
| Provider status histories | Records of outages | Public, terms per provider |
Who decides, and what the evidence serves.
Digital Public Infrastructure prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Government digital and procurement agencies | Where to host which systems and under what terms | Dependency maps; exit assessments |
| Competition and data regulators | Whether concentration or transfers need intervention | Concentration and jurisdiction evidence |
| Security agencies | Which data must stay under domestic control | Data classification reviews |
Outputs this topic produces
- Hosting dependency maps for public services
- Concentration analyses of public cloud spending
- Jurisdiction and data classification reviews
- Exit and portability assessments
What experts ask.
Public services must continue regardless of the commercial fortunes or policy choices of any one supplier. When many government functions depend on the same provider, a technical failure, contract dispute, price change or legal order affecting that provider can disrupt services across the state. Concentration also affects bargaining power and the state's ability to change course.
- Which public services depend on which cloud and software providers, and how concentrated are those dependencies?
- Can a service be moved to another provider or run on-premises if necessary, and how long would that take?
- Which laws apply to data held by a provider, and could foreign legal orders affect access?
- What contractual terms protect continuity, data return and exit?
Drivers and processes.
Concentration risk has technical, commercial and legal dimensions.
Shared failure
Outages at a major provider affect all services hosted there. Architecture across regions or providers can reduce but not remove this risk.
Lock-in
Proprietary services and data formats make migration costly. Pricing and terms can change after dependency has grown.
Jurisdiction
Providers are subject to the laws of the countries where they are based and operate, which may conflict.
The most common weakness is not the choice of cloud but the absence of a tested way out. Exit plans that exist only on paper, data held in formats only one provider can read and skills concentrated in a supplier's staff all leave the state dependent. Building portability in from the start is cheaper than recovering it under pressure.
How the evidence is built, and its limits.
- 01
Dependency inventories
Registers of providers behind public services. Often incomplete, especially for software components.
- 02
Exit testing
Practical tests of migration and data return. Rarely carried out, so exit plans are often untested.
- 03
Contract analysis
Review of continuity, data and exit clauses. Standard terms may give governments little leverage.
- 04
Architecture analysis
Assessment of designs for portability and resilience, applying high-performance, cloud and edge computing.
How it is studied, and what the methods cannot say.
- 01High-performance, cloud and edge computingCapacity planning for peaks · Multi-site and multi-provider hosting · Portability engineeringApplied here
- 02Cybersecurity and cryptographyThreat modelling DPI components · Protecting identity databasesApplied here
- 03Data engineering, interoperability and stewardshipSecure data exchange layers · Common data models · Consent-based sharingApplied here
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Questions and answers.
What is sovereign cloud?
Why is cloud concentration a risk for governments?
What is cloud exit?
Should governments avoid commercial cloud?
Does the platform assess providers?
How can exit be made realistic?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.