Breaking: 84% of UK’s most critical companies at risk from over-reliance on US Big Tech

Investigation finds 84/100 of the UK’s most essential organisations (including Royal Mail, Thames Water, most of the NHS, and the entire electricity transmission network in England & Wales) clearly depend on US technology companies to function.

If the United States ever decided to cut off the United Kingdom’s access to Microsoft, Google and other technology services (through sanctions, an Executive Order, or a President minded to use technology as leverage in a trade dispute), how much of British daily life would continue working without unprecedented levels of disruption?

Very little, our new investigation suggests.

We checked 100 of the biggest organisations the British public relies on every day: the companies that supply us with electricity, gas and water; the supermarkets where we buy our food; our banks and insurers; our mobile networks; the NHS; the police force; and the government departments that help society function. For each one, we ran a simple, publicly verifiable check on their email domains to see who actually operates their email (and by extension, whose technology their organisation is likely built on).

We found that 84 of the 100 organisations depend on US technology to send and receive email. Just 5 organisations in our list appear to rely on non-US tech. For the remaining 11, we could not verify what lies behind a non-US security gateway, so we’ve classified them as “unknown”.

This means that almost 95% of the organisations for which we were able to determine the company they use to provide email depend on US technology.

Our findings show that the vast majority of the UK’s essential services rely on tech infrastructure controlled by the United States. 

While this may previously not have rung alarm bells, in more recent years, President Trump has repeatedly shown he is willing to use the US’s economic power against the interests of his closest allies. In early 2025, his administration imposed a 10% baseline tariff on nearly all UK goods, alongside a 25% tariff on UK steel and aluminium, as part of a wider trade offensive. In the same year, his administration launched an attack against Iran, leading to increased energy costs and slower economic growth worldwide. And he’s shown he’s not afraid to use access to technology as a political weapon: in early 2025, US sanctions on International Criminal Court officials were followed by reports of the Court’s chief prosecutor losing access to his Microsoft email account and having his bank accounts blocked, even in the UK (his home country). Microsoft denied suspending his account.  Around the same time, Reuters reported that US officials had raised the prospect of cutting Ukraine’s access to Starlink satellite internet unless Kyiv agreed to a minerals deal with Washington (a claim Elon Musk has denied).

If the United States chose to shut off the UK’s access to its technology, the impact on British life could be extreme. The UK government maintains an official list of “critical national infrastructure”: the systems whose loss “could result in major detrimental impact on the availability, integrity or delivery of essential services” or “significant impact on national security”. We used this list to choose which organisations to investigate. What we found is that the critical infrastructure of the United Kingdom depends, overwhelmingly, on the goodwill of the United States.

Our findings: no corner of daily life left untouched 

First, we looked at the UK’s utility companies, and our findings were shocking. 

Every single water company we checked (Thames Water, Severn Trent, United Utilities, Anglian Water, Yorkshire Water and Welsh Water) relies on US technology. Big parts of the electricity grid (National Grid and UK Power Networks) route their email through a single US security company. Many household energy suppliers (British Gas, E.ON, OVO, SSE) are US-reliant too. And every airline we checked (British Airways, easyJet, Jet2 and Virgin Atlantic), as well as Heathrow airport, use email run by US companies.

When we looked at the organisations the British public looks to to keep us safe, the results were equally concerning.

We found that the NHS’s national email service, nhs.net, used by frontline staff across England runs on Microsoft. As does NHS Scotland and NHS Wales. Only Northern Ireland’s NHS service hosts its email on an independent UK server.

The Metropolitan Police, Police Scotland, Greater Manchester Police, West Midlands Police and the British Transport Police all run on Microsoft, as does the National Crime Agency, the UK’s lead national law enforcement agency.

Then we took a look at governmental departments, and found an incredibly high proportion of US reliance in that sector.

HMRC, which collects the taxes that fund public services, runs on Microsoft. So do the Ministry of Justice, the Electoral Commission, and the parliaments of Scotland, Wales and Northern Ireland. 10 Downing Street and the Cabinet Office run on Google. The Home Office has its own mail server addresses, which means it appears independent, but dig a little deeper and those servers turn out to be running on Amazon’s cloud (a US company, and therefore subject to pressure from the US administration).

The UK Parliament’s email runs through Mimecast, a London-headquartered cybersecurity company that acts as a security checkpoint in front of an organisation’s real mailboxes, filtering mail before passing it through. Because Mimecast sits in front like this, we aren’t able to tell exactly which servers actually hold and deliver UK Parliament’s email, or whether they would continue to operate in the event of a restriction on US technology access. It is an example of one of our “unknowns”. Proofpoint, referenced elsewhere in our findings, is also a security checkpoint, but because it is a US company, we’ve classified organisations that use it as “US-reliant” rather than “unknown”.

Just a small number of key governmental departments appear to be safe from US interference: the Driver and Vehicle Licensing Agency (DVLA), Northern Ireland’s health and police services, and the Scottish prison service all have email that is self-hosted, or run by UK-based providers.

Really, no aspect of UK daily life is free from reliance on US technology.

We found that every mail and parcel carrier we examined in the UK is US-reliant: Royal Mail, Evri and Yodel all run on Microsoft; and DPD runs on Google.

We similarly found evidence of heavy reliance in the telecommunications sector: BT, Vodafone and Openreach (the company that owns and maintains the physical phone and internet cables across most of the UK) all run on Microsoft. O2, Three and Sky all route through other US companies. Of the seven telecoms organisations we checked, only TalkTalk did not result in a direct US hit. Instead, TalkTalk (like the UK Parliament) uses Mimecast, a gateway security company that hides the true nature of the servers sitting behind it.

The BBC, our national broadcaster, routes its email through Broadcom, a massive US technology company that designs and supplies semiconductor chips and infrastructure software. ITV runs on Google. Arqiva, which is the sole provider of national terrestrial TV and radio transmission in the UK, runs on Microsoft. Channel 4 is the only broadcast company that does not have a confirmed US link, as it also operates using Mimecast. 

BP, Shell, Esso and Texaco all run their UK operations on email run by US companies. 

The situation is no less alarming when we look at the food and financial sectors.

Nine of the ten biggest supermarket chains (Tesco, Sainsbury’s, Asda, Morrisons, Lidl, Co-op, M&S, Waitrose and Iceland) are US-reliant. Six of the eight biggest banks are too, including Barclays, HSBC, Lloyds and Nationwide. Every major insurer we checked (Aviva, Direct Line, Admiral, Legal & General and AXA UK) relies on US technology. 

Finally, we looked at pharmaceuticals. 

Superdrug, Lloyds Pharmacy, Bupa and Nuffield Health all run their email on Microsoft. Boots runs its email on Cisco, another US company. Both of the biggest pharmaceutical companies - GSK and AstraZeneca - route their email via Proofpoint, which is also US headquartered.

Conclusion

These results are shocking, but perhaps not surprising. 

Each of these 84 organisations made a choice that probably felt safe at the time: US technology companies are familiar, widely-used, and have long been assumed to come with the implicit backing of a reliable ally. But the sum of these individual choices adds up to a national vulnerability. If the US government decided one day to shut off the UK’s access to its technology companies, British life could grind to a halt. Who knows what would happen - how long would we be able to keep accessing the water in our taps, the food in our supermarkets, and the money in our banks? How would we even speak to the people in charge to figure out a solution, if most of our government and telecommunications channels were suddenly rendered inaccessible?

And to make matters worse, just consider that our findings probably understate the level of US dependence in UK life: the “unknown” organisations in our list route through non-US security gateways (like Mimecast and Trend Micro) that could, in principle, sit in front of Microsoft or Google mail servers. Because we have been unable to independently verify which servers sit behind those gateways to a publishable standard, we have not counted them as US reliant. This is a conservative decision, and it means our 84/100 figure is a floor, not a ceiling.

The European Commission is beginning to grapple with this problem, unveiling in June a Tech Sovereignty package designed to reduce Europe’s heavy reliance on non-EU technology. The UK, however, is moving more slowly. In January, 45 MPs signed a motion calling for a UK digital sovereignty strategy, warning that government services, democratic functions and critical infrastructure had become dependent on a small number of foreign providers. In March, a debate on the issue in the House of Commons led the chair of the Science, Innovation and Technology Committee to conclude that the UK government had failed to set out “a coherent strategy for achieving technology sovereignty.” Then in July, Andy Burnham’s government dissolved the Department for Science, Innovation and Technology (DSIT) altogether, splitting its responsibilities three ways: science and innovation moved to a renamed business department (now the Department for Business, Innovation, Science and Trade), AI strategy moved to the Cabinet Office, and digital functions moved to a strengthened Department for Digital, Culture, Media and Sport. As a parliamentary briefing published a month after the DSIT dissolution noted, there is still “no official UK Government position on what digital sovereignty is,” and stakeholders continue to call for a dedicated strategy. Given how serious and how obvious this risk is, this is an extraordinary gap.

We call on the Cabinet Office’s National Security Secretariat (which already coordinates the UK’s preparedness for national security threats and supports the National Security Council) to take ownership of the UK’s digital dependence on US technology, treat it with the same urgency as any other critical national infrastructure risk, and inform the public of its strategy for addressing it.

Methodology

We compiled a list of 100 organisations, both private companies and public bodies, across the UK (set out below). To decide which sectors to include, we used the UK government’s official list of critical national infrastructure sectors, and focussed on the sectors containing organisations that are household names (i.e. energy, water, food, health, finance, transport, communications and government services).

For each organisation, we looked up the MX (mail exchange) records of its email domain in August 2026. MX records are public DNS entries that reveal which company’s servers receive an organisation’s email. We used a mix of DNS Checker and MX Toolbox to do the checks. We classified each provider by its country of headquarters: Microsoft, Google, Cisco, Broadcom/Symantec, Trellix/FireEye and Forcepoint as US; Mimecast and Trend Micro as “unknowns”; and organisations whose email routes through their own / UK servers as “not-US”. We ran additional checks on the “not-US” results using the RIPE database to confirm there were no apparent US links in the IP addresses or Autonomous System Numbers.

As noted above, Mimecast and Trend Micro are security gateways that sit in front of an organisation’s actual mailboxes, which may in turn be hosted by Microsoft or Google. We were unable to verify in each case whose servers actually hosted the emails of those companies that use these gateways. This means our headline figure is most likely understated.

Proofpoint is also a gateway rather than a mailbox host, but it is US-headquartered. As such, mail to and from these organisations must pass through US-controlled infrastructure to be filtered. We’ve therefore classified Proofpoint-routed organisations as “US-reliant”, unlike Mimecast (UK-headquartered) and Trend Micro (Japan-headquartered), which carry no equivalent US jurisdictional exposure.

As stated in the introduction, we only verified the email servers used by these organisations. We cannot prove that the use of a US email provider results in the use of a US cloud provider, though in practice, email provider and wider tech stack usually go hand-in-hand. 

Furthermore, this investigation assessed only which company operates each organisation’s email. It does not assess, and makes no finding about, any organisation’s contingency planning, backup systems or disaster recovery arrangements (which will vary by organisation, and which we did not investigate for this report).

Our approach in this investigation follows the methodology used by Proton’s June 2026 Europe Tech Watch investigation, which found 88% of UK publicly listed companies depend on US tech. 

TABLE OF FINDINGS 

Related Articles

13.11.26

As Microsoft outage disrupts services, new investigation finds 84/100 of the UK’s most essential organisations run on US tech leaving Britain exposed to major security risk

13th November 2026, London –  The vast majority of the organisations the British public relies on every day depend on US technology companies to operate,

Uncategorized

Most Read

05.02.24

Letter to Commissioner Breton: Tackling harmful recommender systems

Civil society organisations unite behind Coimisiún na Meán’s proposal to disable profiling-based recommender systems on social media video platforms

Algorithms

DSA

Fix Our Feeds

08.12.23 3 min read

Prototyping User Empowerment – Towards DSA-compliant recommender systems

What would a healthy social network look like? Researchers, civil society experts, technologists and designers came together to imagine a new way forward

Algorithms

DSA

Fix Our Feeds

Policy paper

23.11.23 1 min read

ESC Big Tech this Black Friday

People vs Big Tech has joined forces with high street brand Lush to raise money for our work to rein in the harmful power of the Big Tech corporations

Algorithms

Privacy

Stop surveillance for profit

Surveillance advertising