Policy as control: America First has reached the IT stack

Why UK IT leaders are rethinking their reliance on US technology

We all know technology moves quickly, while politics has been infamously slow-moving. That’s no longer the case in 2026.

“My slide deck has had to change almost overnight,” said consulting CTO Mark Ridley, speaking at Computing’s Security Leaders Summit today on the topic of rooting out potentially unreliable US tech from your stack.

“I’m going to move quickly, though probably not as quickly as the American President deciding which country to invade.” A joke, but one the audience understood was rooted in serious concerns about sovereignty and reliability.

Behind the humour is a geopolitical shift now landing squarely on the desks of CIOs and CISOs. Trade tariffs are increasingly being used as leverage for digital policy compliance. There are open discussions about “digital kill switches” that could restrict access to US-based services. NATO tensions are rising, and “America First” has evolved from a slogan into a strategy where US technological dominance is explicitly weaponised.

It is “highly unlikely” that the US would ever fully withdraw from the global internet, as Russia has done – although “we know that there are certain Presidents that see what other people are doing that might be fun and decide to copy it” - but they could do, and that’s a problem.

Until recently, few UK organisations (though perhaps a few more in Europe) would have considered the US a competitor. Now, that assumption looks complacent. As UCL professor Francesca Bria put it bluntly, Europe “cannot afford to remain a digital tenant in systems it doesn’t control.”

That dependence is hard to overstate. Almost every organisation relies on US technology at multiple layers: Microsoft or Google for email, Salesforce to sell, Google to search. Collaboration is via Slack or Notion, identity through Okta, and security tooling layered on top. “It is very, very difficult,” Ridley said, to unwind that web. “The scale of our dependency on US technology is alarming.”

The imbalance isn’t just technological, but economic. Nine of the world’s ten largest companies are tech firms, and eight of them are American. In the US stock market, a third of the S&P 500’s total value is concentrated in the so-called Magnificent Seven. No modern economy has ever been so dependent on so few firms, and that concentration of power is a systemic risk.

Research from Swiss privacy firm Proton suggests around 90% of Europe’s digital infrastructure is controlled by US companies. In the UK, 88% of listed firms rely on US email providers, rising to 100% for companies with revenues above £200m. That matters not just economically, but legally.

The 2023 Storm-0558 incident was a wake‑up call. A stolen Microsoft signing key allowed a suspected Chinese threat actor to impersonate any Microsoft 365 account it chose, enabling large‑scale espionage.

That forced governments to confront an uncomfortable reality: their national identity systems were effectively being managed by a private company in Redmond.

Overlay that with the US CLOUD Act and FISA’s Section 702, both of which can compel US companies to hand over data – even when it is hosted overseas – and the conflict with GDPR becomes unavoidable.

As Microsoft executives have acknowledged under oath in the French Senate, US firms can be legally required to comply with demands European law explicitly forbids.

So, what can organisations do? A full exit from US technology is unrealistic for most. Hardware, in particular, remains deeply tied to US silicon. And as Mark noted, “the hardest thing I’ve ever found in a migration is getting the CFO to give up Excel.”

But alternatives do exist, especially if organisations think pragmatically. Cloud providers such as OVHcloud, Civo and Hetzner; security firms like Bitdefender, Sophos and Nord; collaboration tools including Element and Wire; and ERP and payments platforms from companies like SAP, Sage and Adyen can all reduce exposure at the margins.

Politics might be renowned for moving slowly, but governments are already reacting to the challenge. Departments and local government in Denmark, Germany and France are replacing US tech as we speak, and the International Criminal Court has taken on OpenDesk. Private companies are in the unusual position of following where the public sector leads.

The message was not to panic, but to start thinking pragmatically. Whether aiming for wholesale change or careful diversification, now is the moment to understand where the real points of dependency – and leverage – lie.