History repeating

In summary, the government wants public sector buyers to save money by ditching legacy providers and moving to the cloud, while offering them access to an online marketplace where they can easily procure the products and services they need from both hyperscale, overseas tech firms and homegrown providers.

For those who have followed the public sector IT market for the past 15 years or so, some of what the government is proposing may sound familiar, as the founding aims of NDX are very similar to those of the G-Cloud framework.

The latter purchasing agreement made its debut in 2012, pitched as a procurement vehicle that would increase the diversity of IT providers serving public sector organisations and would boost the number of small and medium-sized IT suppliers winning business with them.

At the time, the IT supplier landscape was dominated by a handful of systems integrators and large, legacy tech providers that stood accused of locking public sector organisations into lengthy and expensive contracts.

G-Cloud was hailed as the remedy to that in much the same way that NDX is being spoken about today, except G-Cloud introduced a new way for public sector organisations to procure IT services – and there was no other framework like it out there.

The services listed on it, for example, were pre-approved and transparently priced to ensure all public sector users were charged the same. Contract lengths were initially capped at 12 months to guard against supplier lock-in and to encourage competition.

Over the years, the terms and conditions that G-Cloud operates under have markedly changed from when it was originally introduced, and the government is currently in the throes of preparing to launch the framework’s 15^th iteration in spring 2026.

In light of all that, the question is whether the government is risking duplicating effort by simultaneously working on the roll-out of NDX at the same time, given both procurement vehicles appear – at least on paper – to be intent on achieving the same thing.

Nicky Stewart, senior adviser to Open Cloud Coalition (OCC), which is an advocacy body calling for the creation of a diverse and competitive European cloud market, said DSIT’s vision for NDX does sound promising.

“The OCC welcomes any initiative that aims to open up the government digital market to new players – whether they are SMEs, homegrown suppliers or challenger providers,” she told Computer Weekly. “A diverse market is a healthy and resilient market. We urge all providers with an interest to get behind this important initiative to help DSIT realise its ambitions.”

However, Owen Sayers, an independent security architect and data protection specialist with a long history of working in the public sector, has some reservations about what it is the government is trying to achieve with NDX.

Before floating the idea that DSIT could be lining up NDX to eventually replace G-Cloud, Sayers said that he cannot see how running both frameworks side-by-side will be commercially viable long term.

“If both frameworks run, the civil servants will default to what they know, and what they know is G-Cloud, and NDX will be doomed to failure,” he said.

While this might sound like scaremongering, it is worth bearing in mind the roll-out of the first iteration of the hyperscale-focused Cloud Compute framework in 2021. This was introduced as an alternative procurement vehicle for public sector IT buyers that had large-scale cloud projects to deliver that had previously been pushed through the more SME-focused G-Cloud framework.

A Computer Weekly investigation later revealed that just £750,000 of business had seemingly been put through the first iteration of the Cloud Compute framework, with sources claiming this was due to the fact public sector buyers found G-Cloud more familiar and easier to use. 

“If NDX is the ‘new thing’, the government will need to tender it – with terms suitable for that type of competitive feedback-driven marketplace – and, having done so, will presumably retire G-Cloud,” said Sayers.

If this sequence of events does come to pass, it could take several years before the financial benefits generated by NDX are realised, given that contracts called-off under G-Cloud can be up to 48 months in length, he added.

“Many government agencies will have forward-committed spend contracts under G-Cloud, and they won’t want or be able to change them,” he said. “Cancelling live G-Cloud contracts will incur huge costs – certainly enough to wipe out a £1.2bn saving – and so they will persist for their full contract term.

“It will take two-to-four years for NDX to replace G-Cloud and gain traction, and we are unlikely to see any benefit of this type of change in the lifetime of this parliament [given the G-Cloud contract lengths] and nor are the government likely to see many of those projected savings.”

Computer Weekly put Sayers’ concerns to DSIT, and a spokesperson responded with the following statement: “The National Digital Exchange builds on G-Cloud’s success while introducing AI-powered supplier matching, real-time user reviews and pre-negotiated deals that slash procurement time from months to hours – delivering £1.2bn annual savings.

“G-Cloud remains an important procurement route alongside NDX, with transparent pricing and capability-based matching ensuring SMEs can compete on innovation rather than administrative complexity. The platform is designed to open the market to more UK tech firms, with a target to boost small business involvement in government contracts by 40% within three years.”

No checks or balances

Even so, Sayers has some misgivings about the approach DSIT is taking with NDX: “Principally, it looks like they are trying to streamline decisions that already suffer from far too little diligence, and the trade-off of centrally negotiated general deals is that the NDX will undoubtedly be made up of generic commodity products.”

With its emphasis on offering public sector buyers access to pre-approved technology deals, there is also a fear that the government might be taking a “one-size-fits-all” approach with NDX, which rarely works in the public sector, he continued.

“There seems to continue to be a lack of appreciation in central government that each department is different, each vertical part of government is different, and each nation in the UK is different in terms of their applicable legislation, regulation, needs and forms of delivery,” said Sayers.

Mark Boost, CEO of London-based cloud services provider Civo, told Computer Weekly that he is broadly supportive of what the government is trying to do with NDX, particularly its pledge to champion homegrown IT providers through the initiative.

However, given how much business the UK government already puts the way of big tech providers, such as Amazon Web Services (AWS), Microsoft and Google, he has reservations about how DSIT will ensure a level playing field for all suppliers who participate in NDX.

“Any initiative explicitly aiming to make it easier for UK tech suppliers of all sizes to win government contracts is worth celebrating,” he said. “If the policy truly manages to develop and maintain appropriate safeguards to ensure a level playing field for British tech, then we can expect a huge boost to our homegrown tech ecosystem. That said, DSIT’s apparent enthusiasm for ‘big tech’ will give many UK IT leaders pause.”

Particularly in light of how entrenched the cloud technologies of AWS and Microsoft, specifically, have become within the public sector since both parties opened their UK datacentre regions in late 2016. At the time, the UK was home to a thriving ecosystem of homegrown SME cloud providers, many of whom were successfully selling their wares through the G-Cloud framework to the public sector.

However, over the months and years, the number of these SMEs in operation began to dwindle – as some went out of business or merged with others – as more of the public sector deals they previously secured went to AWS and Microsoft instead. So much so, AWS is now the top seller of cloud services to the public sector through the SME-focused G-Cloud framework, with the government’s own Digital Marketplace figures putting its total spend through the framework at more than £1bn.  

And having so much of the UK’s public sector IT infrastructure hosted in the clouds of US-based cloud providers is a risk, said Boost, adding: “Relying on a handful of overseas providers for our digital infrastructure presents a substantial risk, especially when changes in the geopolitical winds can result in sudden software sanctions and shutdowns.

“On top of this, the US Cloud Act remains in force, and any large US provider involved in public sector IT might, at any time, be compelled to hand over British citizens’ sensitive information to US law enforcement. Proper consideration for the UK’s thriving cloud and AI ecosystems will help to rectify this – and I hope the NDX will live up to its promises.”