A law firm’s most confidential asset — privileged client work and decades of case files — lives with mostly US-controlled suppliers, reachable under US law; even the “separate” document system often runs on Microsoft’s cloud. The legal-AI layer carries the sharpest confidentiality risk and is the cheapest to fix. The one clear exception is the firm’s own banking, which sits under UK law.

A typical mid-size financial firm runs on a handful of mostly US-owned suppliers — and roughly two-thirds of the most critical parts trace back to a single company, Microsoft. There is no easy way to switch the core layers, and no home-grown alternative ready to step in. The brightest spot is the firm’s own banking, which sits under UK law.

UK retail and small-business banking runs on a small number of mostly US suppliers, with cloud and login the most exposed layers and no UK alternative at scale. But the everyday payment system is more home-grown than people assume — the bank-to-bank rails are UK-run and growing fast — and core banking software has real UK and European choices.