Our View: New UK Government Guidance on Multi-Region Cloud & SaaS

Tom Burton


Subscribe Contact us

Well Intended Guidance Leaves more Questions than Answers


The UK Government Digital Services – part of the Department for Science, Innovation and Technology – has recently published guidance for how the public sector should adopt a multi-region approach to cloud technology. At first sight this appears encouraging. Any unnecessary constraints on hosting arrangements (or any other non-functional requirements) reduce the available market of providers, constrain competition, and therefore inevitably reduce value for money. If parts of Government, whether central, regional or local, have felt that everything must be hosted in the UK then it makes sense to produce guidance that clarifies this perception and helps to open their options up.


But for guidance to be useful it should guide. It should make it easier for people to take actions that they previously would have discounted. The guidance in this case, which at 1420 words is almost as short as this article, probably leaves the reader with more questions than answers. It may reveal some unknowns, but without increasing certainty.


The Guidance in a Nutshell


A summary of the guidance is as follows:


  • Look wider than UK: Many cloud solutions may not offer UK hosting, particularly new innovative solutions that haven’t scaled up yet. Irrespective, their staff are likely to be distributed around the world if the service is supported 24/7. There may also be other benefits in looking wider than UK hosting, such as enabling better business continuity and disaster recovery options if the vendor only has one UK site.


  • Get legal advice: Before you even consider a non-UK option you need to seek advice from your own legal advisors and your Data Protection Officer (DPO).


  • Ensure compliance with ICO guidance: Before you even consider a non-UK option you need to check and make sure that any international transfer of personal data will be compliant with the Information Commissioner’s Office (ICO) guidance, and you should get further guidance from your own legal advice and DPO.


  • Do a full review of vendor security: Before you even consider a non-UK option you need to make sure the vendor and solution are compliant with your own security policies.


In a nutshell, it says: 'you should consider options outside of the UK but only if you have checked everything is legal and secure'. This seems to be verging on a statement of the obvious; the real difficulty in going offshore is covering all of the legal, regulatory and security compliance aspects.


Adequacy is a Moment in Time


On point 3, the guidance points out data protection compliance is easier if the country in question is considered by the ICO to be adequate – having equivalent regulations for data protection to the UK. Sound advice. But even this is not that simple. For instance, the USA is not considered adequate unless it is under an extension of the EU-US Data Privacy Framework. This framework is dependent on an Executive Order that the Biden administration put in place, and it is entirely possible that it will be revoked by the current administration. If such an action was taken, or if for any other reason the EU decides that adequacy is no longer met (also not unlikely given Herr Schrems has achieved this twice already and has stated he plans to challenge the DPF), then the vendor will no longer be considered compliant.


Consideration is Far Wider than Residency


Security is far wider than data residency though. This is where point 4 both states the obvious and understates the complexity. Managing risk in the supply chain is inherently difficult. Cloud providers, and particularly SaaS solutions, aggravate this challenge by an order of magnitude. By their nature they are solutions designed for a broad and varied range of customers. This means they will always involve compromise. If they tried to meet the most demanding requirements, they would price themselves out of the scale marketplace. If they went for the lowest common denominator, they would be unable to meet the requirements of the majority. An individual customer can rarely dictate a specific security requirement for themselves.


They are also highly opaque. The vendor presents their service as a black box. The features delivered to the customer are defined, but much of the underlying design and the means the vendor uses to manage it in operation are hidden. This makes assessing the risk far more of a judgement call than when the design and delivery is conducted under your control. Depending on the supplier, and the leverage that the customer has over them, it may be possible to get some information and assurances; but the right questions need to be asked, and the answers need to be interpreted correctly. Third party certifications and audits, such as the ISO27000 series of standards or the SOC1, SOC2 and SOC3 reports, can also provide some additional assurances. But only the customer will be able to decide the extent to which they can mitigate the risk, and the confidence they have in the supplier to manage their own. This is a business decision informed by the specifics and nuances of the risks being considered.


Summary


It is important to minimise the non-functional requirements and keep an open mind about potential solutions and vendors. This includes looking wider than just the UK when national security requirements are not paramount. But this is not something that can be distilled onto a single sheet of A4 in any meaningful way. Yes, there are legal and regulatory issues that need to be reviewed. And geopolitical risk needs to be factored in, considering how you would respond to future external changes that are outside of the UK’s control. 


But from experience, the greatest challenge is getting comfortable that the vendor’s organisation and their solution have adequate security – this applies equally whether the solution is hosted in the UK or overseas. The SaaS world is opaque, and balances priorities across a broad and varied customer base. The public sector needs to increase its adoption of cloud and SaaS solutions to remain efficient and relevant, in the same way that the private sector has had to. But the route to responsible adoption is more nuanced, requiring candid conversations with suppliers, and ultimately an informed but subjective judgement by the customer’s leadership.


Sources/Links:


DSIT Guidance for Multi-region cloud and software-as-a-service ↩︎


ICO Guide to International Transfers ↩︎


Executive Order (E.O.)14086 of October 7, 2022, on Enhancing Safeguards for United States Signals Intelligence Activities ↩︎



Note: This article originally appeared on Tom Burton's personal blog at https://digility.net/insights/


Contact - Partner Spotlight - Darren Sheppard

Subscribe to our Newsletter

Blog Subscribe

SHARE CONTENT

Neon letters 'Ai' made from stacks of blocks like a 3D bar graph
by Darren Sheppard 4 December 2025
What is the Contract Lifecycle Management and Why does it Matter? The future success of your business depends on realising the value that’s captured in its contracts. From vendor agreements to employee documents, everywhere you look are commitments that need to be met for your business to succeed. The type of contract and the nature of goods or services it covers will determine what sort of management activities might be needed at each stage. How your company is organised will also determine which departments or individuals are responsible for what activities at each stage. Contract Lifecycle Management, from a buyer's perspective, is the process of defining and designing the actual activities needed in each stage for any specific contract, allocating ownership of the activities to individuals or groups, and monitoring the performance of those activities as the contract progresses through its lifecycle. The ultimate aim is to minimise surprises, ensure the contracted goods or services are delivered by the vendor in accordance with the contract, and realise the expected business benefits and value for money. The Problem of Redundant Spend in Contracts Despite the built-in imbalance of information favoring suppliers, companies still choose to oversee these vendors internally. However, many adopt a reactive, unstructured approach to supplier management and struggle to bridge the gap between contractual expectations and actual performance. Currently, where governance exists, it is often understaffed, with weak, missing, or poorly enforced processes. The focus is primarily on manual data collection, validation, and basic retrospective reporting of supplier performance, rather than on proactively managing risk, relationships, and overall performance. The amount of redundant spend in contracts can vary widely depending on the industry, the complexity of the contracts, and how rigorously they are managed. For further information on this, Cambridge MC’s case studies provide insights into typical ranges and common sources of redundant spend. As a general estimate, industry analysts often state that redundant spend can account for as much as 20% of total contract value. In some cases, especially in poorly managed contracts, this can be much higher. What is AI-driven Contract Management? Artificial Intelligence (AI) is redefining contract management, transforming a historically time-consuming and manual process into a streamlined, efficient, and intelligent operation. Traditionally, managing contracts required legal teams to navigate through extensive paperwork, drafting, reviewing, and monitoring agreements — a process prone to inefficiencies and human error. With the emergence of artificial intelligence, particularly generative AI and natural language processing (NLP), this area of operations is undergoing a paradigm shift. This step change is not without concerns however, as there are the inevitable risks of AI hallucinations, training data biases and the threat to jobs. AI-driven contract management solutions not only automate repetitive tasks but also uncover valuable insights locked up in contract data, improving compliance and reducing the risks that are often lost in reams paperwork and contract clauses. Put simply, AI can automate, analyse, and optimise every aspect of your contract lifecycle. From drafting and negotiation to approval, storage, and tracking, AI-powered platforms enhance precision and speed across these processes; in some cases reducing work that might take several days to minutes or hours. By discerning patterns and identifying key terms, conditions, and concepts within agreements, AI enables businesses to parse complex contracts with ease and efficiency. In theory, this empowers your legal and contract teams (rather than reducing them), allowing personnel to focus on high-level tasks such as strategy rather than minutiae. However, it is important to recognise that none of the solutions available in the marketplace today offer companies an integrated supplier management solution, combining a comprehensive software platform, capable of advanced analytics, with a managed service. Cambridge Management Consulting is one of only a few consultancies that offers fully integrated Contract Management as a Service (CMaaS). Benefits of Integrating AI into your Contract Lifecycle Management Cambridge MC’s Contract Management as a Service (CMaaS) 360-degree Visibility: Enable your business to gain 360-degree visibility into contracts and streamline the change management process. Real-time Data: Gain real-time performance data and granularly compare it against contractually obligated outcomes. More Control: Take control of your contracts and associated relationships with an integrated, centralised platform. Advanced meta data searches provide specific information on external risk elements, and qualitative and quantitative insights into performance. Reduces Costs: By automating manual processes, businesses can significantly reduce administrative costs associated with contract management. AI-based solutions eliminate inefficiencies in the contract lifecycle while minimising reliance on external legal counsel for routine tasks. Supplier Collaboration: Proactively drive supplier collaboration and take a data-driven approach towards managing relationships and governance process health. Enhanced Compliance: AI tools ensure that contracts adhere to internal policies and external regulations by flagging non-compliant clauses during the drafting or review stage. This proactive approach reduces the risk of costly disputes or penalties. Reduces Human Errors: In traditional contract management processes, human errors can lead to missed deadlines and hidden risks. AI-powered systems use natural language processing to identify inconsistencies or inaccuracies in contracts before they escalate into larger issues. Automates Repetitive Tasks: AI-powered tools automate time-consuming tasks such as drafting contracts, reviewing documents for errors, and extracting key terms. This frees up legal teams to focus on higher-value activities like strategic negotiations and risk assessment. We can accurately model and connect commercial information across end-to-end processes and execution systems. AI capabilities then derive and apply automated commercial intelligence (from thousands of commercial experts using those systems) to error-proof complex tasks such as searching for hidden contract risks, determining SLA calculations and performing invoice matching/approvals directly against best-in-class criteria. Contract management teams using AI tools reported an annual savings rate that is 37% higher than peers. Spending and tracking rebates, delivery terms and volume discounts can ensure that all of the savings negotiated in a sourcing cycle are based on our experience of managing complex contracts for a wide variety of customers. Our Contract Management as a Service, underpinned by AI software tooling, has already delivered tangible benefits and proven success. 8 Steps to Transition Your Organisation to AI Contract Management Implementing AI-driven contract management requires a thoughtful and structured approach to ensure seamless integration and long-term success. By following these key steps your organisation can avoid delays and costly setbacks. Step 1 Digitise Contracts and Centralise in the Cloud: Begin by converting all existing contracts into a digital format and storing them in a secure, centralised, cloud-based repository. This ensures contracts are accessible, organised, and easier to manage. A cloud-based system also facilitates real-time collaboration and allows AI to extract data from various file formats, such as PDFs and OCR-scanned images, with ease. Search for and retrieve contracts using a variety of advanced search features such as full text search, Boolean, regex, fuzzy, and more. Monitor upcoming renewal and expiration events with configurable alerts, notifications, and calendar entries. Streamline contract change management with robust version control and automatically refresh updated metadata and affected obligations. Step 2 Choose the Right AI-Powered Contract Management Software: Selecting the right software is a critical step in setting up your management system. Evaluate platforms based on their ability to meet your organisation’s unique contracting needs. Consider key factors such as data privacy and security, integration with existing systems, ease of implementation, and the accuracy of AI-generated outputs. A well-chosen platform will streamline workflows while ensuring compliance and scalability. Step 3 Understand How AI Analyses Contracts: To make the most of AI, it’s essential to understand how it processes contract data. AI systems use Natural Language Processing (NLP) to interpret and extract meaning from human-readable contract terms, while Machine Learning (ML) enables the system to continuously improve its accuracy through experience. These combined technologies allow AI to identify key clauses, conditions, and obligations, as well as extract critical data like dates, parties, and legal provisions. Training your team on these capabilities will help them to understand the system and diagnose inconsistencies. Step 4 Maintain Oversight and Validate AI Outputs: While AI can automate repetitive tasks and significantly reduce manual effort, human oversight is indispensable. Implement a thorough process for spot-checking AI-generated outputs to ensure accuracy, compliance, and alignment with organisational standards. Legal teams should review contracts processed by AI to verify the integrity of agreements and minimise risks. This collaborative approach between AI and human contract management expertise ensures confidence in the system. Step 5 Refine the Data Pool for Better Results: The quality of AI’s analysis depends heavily on the data it is trained on. Regularly refine and update your data pool by incorporating industry-relevant contract examples and removing errors or inconsistencies. A well-maintained data set enhances the precision of AI outputs, enabling the system to adapt to evolving business needs and legal standards. Step 6 Establish Frameworks for Ongoing AI Management: To ensure long-term success, set clear objectives and measurable goals for your AI contract management system. Define key performance indicators (KPIs) to track progress and prioritise features that align with your organisation’s specific requirements. Establish workflows and governance frameworks to guide the use of AI tools, ensuring consistency and accountability in contract management processes. Step 7 Train and Empower Your Teams: Equip your teams with the skills and knowledge they need to use AI tools effectively. Conduct hands-on training sessions to familiarise users with the platform’s features and functionalities. Create a feedback loop to gather insights from your team, allowing for continuous improvement of the system. Avoid change resistance by using change management methodologies, as this will foster trust in the technology and drive successful adoption. Step 8 Ensure Ethical and Secure Use of AI: Tools Promote transparency and integrity in the use of AI-driven contract management. Legal teams should have the ability to filter sensitive information, secure data within private cloud environments, and trace data back to its source when needed. By prioritising data security and ethical AI practices, organisations can build trust and mitigate potential risks. With the right tools, training, and oversight, AI can become a powerful ally in achieving operational excellence as well as reducing costs and risk. Overcoming the Technical & Human Challenges While the benefits are compelling, implementing AI in contract management comes with some unique challenges which need to be managed by your leadership and contract teams: Data Security Concerns: Uploading sensitive contracts to cloud-based platforms risks data breaches and phishing attacks. Integration Complexities: Incorporating AI tools into existing systems requires careful planning to avoid disruptions and downtime. Change Fatigue & Resistance: Training employees to use new technologies can be time-intensive and costly. There is a natural resistance to change, the dynamics of which are often overlooked and ignored, even though these risks are often a major cause of project failure. Reliance on Generic Models: Off-the-shelf AI models may not fully align with your needs without detailed customisation. To address these challenges, businesses should partner with experienced providers who specialise in delivering tailored AI-driven solutions for contract lifecycle management. Case Study 1: The CRM That Nobody Used A mid-sized company invests £50,000 in a cutting-edge Customer Relationship Management (CRM) system, hoping to streamline customer interactions, automate follow-ups, and boost sales performance. The leadership expects this software to increase efficiency and revenue. However, after six months: Sales teams continue using spreadsheets because they find the CRM complicated. Managers struggle to generate reports because the system wasn’t set up properly. Customer data is inconsistent, leading to missed opportunities. The Result: The software becomes an expensive shelf-ware — a wasted investment that adds no value because the employees never fully adopted it. Case Study 2: Using Contract Management Experts to Set Up, Customise and Provide Training If the previous company had invested in professional services alongside the software, the outcome would have been very different. A team of CMaaS experts would: Train employees to ensure adoption and confidence in using the system. Customise the software to fit business needs, eliminating frustrations. Provide ongoing support, so issues don’t lead to abandonment. Generate workflows and governance for upward communication and visibility of adherence. The Result: A fully customised CRM that significantly improves the Contract Management lifecycle, leading to: more efficient workflows, more time for the contract team to spend on higher value work, automated tasks and event notifications, and real-time analytics. With full utilisation and efficiency, the software delivers real ROI, making it a strategic investment instead of a sunk cost. Summary AI is reshaping the way organisations approach contract lifecycle management by automating processes, enhancing compliance, reducing risks, and improving visibility into contractual obligations. From data extraction to risk analysis, AI-powered tools are empowering legal teams with actionable insights while driving operational efficiency. However, successful implementation requires overcoming challenges such as data security concerns and integration complexities. By choosing the right solutions, tailored to their needs — and partnering with experts like Cambridge Management Consulting — businesses can overcome the challenges and unlock the full potential of AI-based contract management. A Summary of Key Benefits Manage the entire lifecycle of supplier management on a single integrated platform Stop value leakage: as much as 20% of Annual Contract Value (ACV) Reduce on-going governance and application support and maintenance expenses by up to 60% Deliver a higher level of service to your end-user community. Speed without compromise: accomplish more in less time with automation capabilities Smarter contracts allow you to leverage analytics while you negotiate Manage and reduce risk at every step of the contract lifecycle Up to 90% reduction in creating first drafts Reduction in CLM costs and extraction costs How we Can Help Cambridge Management Consulting stands at the forefront of delivering innovative AI-powered solutions for contract lifecycle management. With specialised teams in both AI and Contract Management, we are well-placed to design and manage your transition with minimal disruption to operations. We have already worked with many public and private organisations, during due diligence, deal negotiation, TSAs, and exit phases; rescuing millions in contract management issues. Use the contact form below to send your queries to Darren Sheppard , Senior Partner for Contract Management. Go to our Contract Management Service Page
Sun through the trees
by Scott Armstrong 26 November 2025
Nature means something different to everyone. For some, it is a dog-walk through the park; for others, it is hiking misty mountains in Scotland, swimming in turquoise waters, or exploring tropical forests in Costa Rica.
Aerial view of Westminster, London.
by Craig Cheney 25 November 2025
With the UK Budget being published tomorrow, councils are facing intense financial pressure. Rising demand for adult and children’s social care, homelessness services, and temporary accommodation has left little room for manoeuvre.
by Cambridge Management Consulting 20 November 2025
Press Release
Lightning strike in dark sky
by Scott Armstrong 17 November 2025
Non-commodity charges are driving UK energy costs higher. Discover what’s changing, why it matters, and the steps businesses should take to protect budgets | READ NOW
Futuristic building with greenery growing out of it.
by Cambridge Management Consulting 10 November 2025
Over the last few decades, carbon offsetting has become a go-to strategy for businesses looking to demonstrate sustainability commitments and enhance their external credibility. Offsetting takes many forms, from tree planting and forest conservation to providing communities with clean cookstoves and renewable energy.
Aerial view of solar panels in a green field.
by Drew Davy 7 November 2025
In today's rapidly evolving business landscape, Environmental, Social, and Governance (ESG) factors have moved from niche considerations to critical drivers of long-term value, investor confidence, and societal impact.
Two blocks of data with bottleneck inbetween
by Paul Brooker 29 October 2025
Read our article on hidden complexity and find out how shadow IT, duplicate tools and siloed buying bloat costs. See how CIOs gain a single view of IT spend to cut waste, boost compliance and unlock 5–7% annual savings | READ FULL ARTICLE
More posts