Guidance

Cloud Challenge Book 2026

Published 7 July 2026

Introduction

This Cloud Challenge Book has been designed by the Department of Science, Innovation and Technology (DSIT), Government Digital Service (GDS), and the Government Commercial Agency (GCA). It has been modelled on the success of the Ministry of Defence’s (MOD) British Army Challenge Set and Digital Targeting Web Challenge Book. 

The aim of this first Cloud Challenge Book is to excite ambitious current and future industry partners to invest and innovate with us as we: 

• build firm national-scale digital foundations on cloud 

• transform the public sector 

• grow the British economy 

Cloud is a critical enabler of the services we all rely on each day. It transforms the way UK businesses, organisations and government deliver services through on-demand compute, storage, processing, networking, and software. 

The UK is one of the largest cloud markets in Europe, with 60% of businesses using cloud services and a cloud market worth over £10.5 billion. This market is currently growing by 30% each year as it’s driven by the rapid advance of AI. The UK’s Modern Industrial Strategy aims to position the UK among the world’s top 3 places to create, invest in, and scale high‑growth technology firms. To lead in a fast‑changing global market, organisations need the right infrastructure, skills, capabilities and commercial models. 

Each of the 5 challenges set out in this book present an ambitious, national‑scale opportunity, spanning legacy, infrastructure, security, and commercial, where government is seeking innovative, scalable solutions from industry to transform the UK’s digital and AI capability. 

Guiding principles 

The challenges in this book are: 

• ambitious – we’re looking to transform and enable a nation, and are seeking proposals which can scale nationally 

• adaptive – we expect to look at new ways to solve problems together, by bringing together seemingly unrelated requirements or customer groups to create new solutions or sufficient scale and maturity 

• urgent – the public desires and deserves positive change when the world and technology are changing fast, because the current status quo is not sustainable 

• enabling – in an AI-era, we cannot predict what the UK will need or build in the future, so open, flexible, and interoperable solutions will gain more traction 

• empowering – to deliver sovereignty and economic growth by building UK capability, such as within supply-chain, skills and cloud adoption

Challenge 1: Zero legacy public sector

To upgrade outdated legacy systems in key public services. Created in partnership with Government Digital Service (GDS).

The UK is the second nation globally to have a Cloud First policy. 60% of government digital services have already migrated to cloud, which makes us a leading public sector internationally compared to similar nations. However, this progress has taken 13 years (so far), and 28% of our estate is legacy, which includes some cloud-based systems and an increasing number of red-rated legacy systems. 

Funding for legacy remediation is greater than it has been in the past, but it’s still insufficient for the size of the challenge and, if discharged in today’s approaches, would quickly run into a shortage of skilled people to do the work. This requires a fundamentally different approach to address the challenge.  

Our key focus areas are: 

Legacy 1

Public sector organisations need to have comprehensive and automated visibility of their assets, including those directly within their control and appropriate access and insight into outsourced services. 

Legacy 2 

Public sector organisations need to rapidly migrate and modernise low‑risk services and have better approaches to accelerating the modernisation of highly-complex and high‑risk systems.  

Legacy 3 

Public sector organisations need existing digital services, including services already in the cloud, to be uplifted to government standards and industry best practice. 

Legacy 4 

Public sector organisations must be able to address the root causes of legacy. They need to be able to adopt cloud‑native approaches so that modernisation and newly-created services do not continually create new legacy.  

Parameters 

1. Avoid bespoke and duplicative contracting.  
2. Introduce minimal overhead to the organisation and promote automation. 
3. Encourage reusable materials and reduce duplication.

“We need to reset our relationship with technology risk so it’s managed effectively, to reduce our dependence on decades-old legacy systems and bolster our inadequate cyber defences - all without slowing down the pace of change” - A blueprint for modern digital government.

Challenge 2: Public digital infrastructure for an AI era

To strengthen and extend our digital and data public infrastructure. Created in partnership with DSIT AI Infrastructure and Sovereign AI teams. 

Highly-secure compute, storage and networking are the lifeblood of a digital and AI economy. The UK is already the home of globally-recognisable AI labs and companies, a permissive regulatory regime, and a research powerhouse through world-leading universities. Meanwhile, the AI Opportunity Action Plan and the AI for Science Strategy, backed by £2 billion of investment between 2026 and 2030, demonstrate the UK’s commitment to remain a global hub for AI and innovation. 

Our public sector, critical national infrastructure, businesses, and their supply chains, need secure and sustainable digital infrastructure that can scale with AI demand and be built and operated to defend against capable adversaries. 

Infrastructure 1 

UK-based organisations and cloud customers will need to scale in an AI-era, which requires an order of magnitude more compute, storage, and networking. 

Infrastructure 2 

The UK has leading technology, AI, and AI hardware companies. We want to enable these companies to scale their products rapidly to global usage. 

Infrastructure 3 

We want UK-based cloud regions to be equal or better in price and capability than the most advanced regions in the world. 

Infrastructure 4 

Single fully-featured regions in-country aren’t sufficient. Those seeking to stay within UK jurisdiction and be multi-region-resilient should have access to at least 2 fully-featured regions. 

Parameters 

1. Infrastructure of this magnitude takes years to build and requires support in prioritisation of grid connections, planning and other requirements. Our AI Growth Zone programme is ready to assist those with new infrastructure investment proposals, and to help us to understand unconstrained possibilities. 
2. We would consider mandating that new public sector workloads be placed in cloud regions outside the south-east of the UK to support geographic resilience. 
3. We need environmentally-responsible infrastructure that can operate efficiently, which also remains committed to the sustainable and transparent use of energy, water and materials across design, operation, and end‑of‑life.

“Building a safe and secure digital public infrastructure that provides a platform for teams across the public sector to drive growth and innovation” - A roadmap for modern digital government.

Challenge 3: Secure-by-default, resilient-by-default cloud

Securing public services so they are trustworthy and resilient. In partnership with Government Cyber Unit (GCU) and the National Cyber Security Centre (NCSC).

Cloud platforms are the foundations on which we build our most critical digital services and store our data. In 2024, the UK government designated data infrastructure, including physical data centres and cloud, as Critical National Infrastructure (CNI), and placed it on a par with priority sectors such as energy, water, and transport. 

As we raise our ambition and dependence on technology, we must also improve the security and resilience of cloud platforms, as well as the defaults and levels of transparency inherited by the public sector and wider economy. Transparency builds trust.  

Cyber 1 

We have a good understanding of some cloud platforms and how they are operated. We want to increase our depth of understanding of cloud platforms in use at scale across the public sector and the broader economy, and work collaboratively with you to improve platform security. 

Cyber 2 

Hyperscale cloud is inherently distributed, but global and shared service management and operational functions can introduce risk. We are interested in co-creating new engineering approaches which reflect this and can shape cloud platform engineering and product decisions.  

Cyber 3 

Not all workloads are equal. Critical national infrastructure, life and safety workloads and incidents that affect multiple customers must receive:

• more in-depth technical engagement 
• faster and more senior responses to incidents 
• prioritisation for recovery or capacity constraints  

Cyber 4 

Public cloud, as implemented today, struggles to defend against the most capable adversaries, but a growing proportion of the public sector and wider economy needs this capability. We need approaches that can mitigate this threat model, which can then be scaled beyond niche central government use cases into the wider economy. 

Cyber 5 

Despite cloud being a distributed technology, hard dependencies on single regions for global services and constant connectivity have been shown to have economy-affecting consequences when disrupted. We need to reduce the likelihood and impact of these risks. These solutions may in turn support additional use-cases, such as where connectivity is only available intermittently, or in the case of entirely disconnected solutions. 

Parameters 

1. We must be able to prioritise the security and resilience of our most critical services.  
2. We must enable public sector organisations to operate sufficiently secure and resilient workloads to protect against the most capable adversaries. 
3. We need suppliers with the people and capability to work with classified material, and to have classified conversations. 
4. We need fully-functional cloud environments that continue to operate with minimal degradation when global connectivity is limited.

“Our infrastructure needs to be resilient and secure against threats if we’re to build and maintain public trust and confidence. Currently, vital systems and services are too exposed to risk: we need to tackle these and embed security by design, at scale” - A roadmap for modern digital government.

Challenge 4: A cloud and AI expert nation

To elevate leadership and invest in talent. In partnership with Government Digital Service (GDS) Digital Workforce and Capability.

The UK is a leading digital services economy, home to an exceptional pool of global talent, and has one of the highest rates of core digital literacy in Europe. However, our digital and AI adoption plans demand we go further. In the public sector, the Prime Minister has set an objective for 1 in 10 civil servants to be digital, data and cyber professionals. We need to grow our cloud and AI skills across the whole spectrum, from young people at all stages of education, including those currently not in education, employment, or training (NEETs), to national experts who build and run critical global-scale digital services.

Skills 1

British employers and the public sector need more cloud and AI practitioners. Investing in a strong cloud, cyber and AI talent pipeline, as well as STEM skills. This presents an opportunity to address growing youth unemployment across the UK and develop high-value digital careers.

Skills 2

As digital transformation and AI change the way businesses are run and create value, we want to give public sector staff the opportunity to transition from non-technical roles into the new opportunities unlocked by these transformations.

Skills 3

As technology becomes more embedded in the public sector and British businesses, we need deep expertise, continuous upskilling, and more senior technical leaders in the UK workforce. However, these training opportunities are often not available in Europe.

Parameters

1. We need to be able to measure the impact of skills interventions on jobs and the British workforce.
2. It is unrealistic for the UK public sector to employ everyone who is being upskilled in this challenge; we want to grow our partners and British subject matter experts.
3. Suppliers should drive investment in the UK talent pipeline and capabilities, for example through digital and cloud apprenticeships and AI engineering academies.

“Change won’t happen without the right people with the right
expertise, working at the right levels, in multidisciplinary teams” - A blueprint for modern digital government.

Challenge 5: Commercial value at national scale

Procuring for growth and innovation.

The UK public sector is one of the largest consumers of cloud services globally. However, we do not consistently act like one. Fragmented demand, locally optimised procurements and bespoke commercial approaches dilute our collective buying power, increase cost and risk, and slows the creation and adoption of better services. 

Smarter organisations, as set out in a blueprint for modern digital government, require more than just agile service teams. They depend on commercial, funding, and governance models that support modern ways of working as the norm and enable the reuse of shared platforms and services at scale. 

Today’s commercial processes reinforce organisational boundaries rather than user needs, and are not fit for purpose for common, commodity services. Even where teams adopt modern delivery practices, legacy procurement, slow drawdown and unclear funding models create friction, duplication, and inconsistency. 

This challenge asks how commercial models can actively enable faster delivery, reuse and shared investment while still respecting departmental accountability and differing delivery priorities. 

Commercial 1

The public sector needs mechanisms to aggregate and clearly forecast demand for cloud services at national scale. This will enable suppliers to invest with confidence and offer materially better pricing, resilience, and capability. 

Commercial 2

Centrally-agreed cloud services and commercial arrangements should be adoptable by default and at pace, which will minimise local procurement, assurance, governance, and integration overhead. Commercial frameworks should enable reuse and convergence as the norm to reduce duplication while remaining proportionate to organisational size and maturity. 

Commercial 3

Clear, transparent, and predictable payment structures are needed so that organisations understand how costs are allocated, controlled and forecast, and so that central and departmental incentives are aligned. 

Parameters 

1. Solutions must respect departmental accountability while also enabling the strong central stewardship of market risk and opportunity. 
2. Drawdown mechanisms must support rapid access to services while also remaining compliant with government commercial and financial controls. 
3. Payment models should clearly distinguish between central investment, shared capability and local consumption. 
4. Incentives should reward behaviours that create national benefit, including reuse, standardisation and long‑term value for money. 
5. Approaches must avoid creating structural lock‑in or barriers to entry for British suppliers and SMEs.

“As the country’s largest digital buyer, we must make use of our scale to unlock greater value and procure in a way that drives creation of responsible, inclusive and secure technologies and benefits the public, public services and UK businesses including SMEs” - A roadmap for modern digital government.