Who controls the technology behind a UK construction or property business?
How much this sector depends on technology suppliers it cannot fully control — and where that matters most.
The big picture
For a typical UK contractor, housebuilder or property and facilities manager, seven of the eight technology building blocks are High exposure, with a overall headline score of 3.7. The defining risk is distinctive to this sector: the design and building-information-modelling layer is dominated by a single US supplier, Autodesk, with no UK-controlled alternative at the same scale. The firm’s drawings, models and the common data environment that holds them all sit under US legal reach. Only banking is genuinely UK-controlled, and the one bright spot is that construction commercial-management and property and facilities-management software do have real UK-controlled options.
We looked at the everyday layers of technology a UK construction or property business relies on, from the cloud it runs on to the systems that define the sector. A supplier owned in the United States can be compelled to hand over data under US law — the CLOUD Act[1], and the surveillance powers in Section 702 of the Foreign Intelligence Surveillance Act[2] — even when that data is stored in Britain; a British supplier answers only to UK law. We scored each building block on four things — how few the suppliers are, whose laws they answer to, how hard they are to switch, and how essential they are.
Where the exposure sits
Who controls each layer
The building blocks this sector relies on, coloured by who ultimately controls each one:US-controlledUK-controlled
Only one of the eight layers – business banking – is genuinely UK-controlled. The design and BIM layer is the most exposed, dominated by US Autodesk with no UK alternative at scale. The two operational layers (construction project/commercial management and property/facilities management) are the bright spot: both have genuinely UK-controlled options (COINS, Causeway, Asite, Eque2; Reapit, Goodlord, Dezrez, Concerto) usable as mitigations.
What this means, in plain terms
If a supplier pulled the plug, how fast would it hurt?
| Speed of impact | Layer | What happens |
|---|---|---|
| Immediate | Identity & access (Microsoft Entra) | Staff log-in fails within hours – an instant lockout of every cloud system at once. |
| Fast | BIM & design (Autodesk) | Live design and the common data environment stop within days; with no UK alternative at scale, re-platforming the design suite and converting years of models could take well over a year. |
| Fast | Cloud | Account suspension propagates quickly to everything hosted on it. |
| Medium | Construction project & commercial management | Valuations, cost control and project records stall within weeks; a real UK-controlled alternative exists, so migration is feasible but slow. |
| Medium | Property & facilities management | Rent, maintenance and tenancy operations degrade over weeks; UK-controlled options make a move realistic. |
| Slow | Payments & banking | Low exposure – not a crisis layer for a construction or property business. |
What organisations can do about this
| Building block | Practical steps |
|---|---|
| BIM and design – the hardest problem, so manage it deliberately | There is no UK-controlled BIM suite at Autodesk’s scale, so this is about reducing lock-in rather than replacing the vendor. Always keep exportable copies of models in the neutral open format (IFC, Industry Foundation Classes) so you are never trapped in one supplier’s files, and run the common data environment in the UK region where the supplier offers it. The only large non-US alternative is Germany’s Nemetschek; Bentley is also US-controlled. In our view, treat IFC export discipline as the single most useful protection here. |
| Construction project and commercial management – choose UK at renewal | This is a layer where a UK-controlled choice is real. UK-controlled options in our database include COINS, Causeway, Asite and Eque2. The widely-used Procore and Oracle Aconex are American and RIB is French. Contracts run for years, so renewal is the decision point. |
| Property and facilities management – UK options exist, use them | UK-controlled options in our database include Reapit, Goodlord, Dezrez and Concerto (Concerto hosts in its own UK data centre). The large incumbents MRI, Yardi, Arthur and Fixflo are US-controlled and Aareon is German. Where you hold tenant and resident personal data, prefer a UK-controlled supplier and check where it hosts. |
| Cloud and log-in – reduce the Microsoft concentration | Moving the cloud and/or staff log-in off Microsoft stops one problem taking down email, reporting, log-in and computers together. UK and European cloud options: OVHcloud and Scaleway (France), IONOS (Germany), Civo (UK); the open-source log-in system Keycloak, self-hosted, reduces reliance on a single US provider. |
| Payments and banking – accept and monitor | Already low-risk; business banking and subcontractor payments run over UK rails under UK law. |
Sources
- US CLOUD Act 2018 (18 U.S.C. 2713) – compels US-incorporated providers to produce data in their custody wherever in the world it is stored. https://www.govinfo.gov/content/pkg/USCODE-2018-title18/html/USCODE-2018-title18-partI-chap121-sec2713.htm
- US Foreign Intelligence Surveillance Act, Section 702 (50 U.S.C. 1881a) – a US directed-surveillance authority. https://www.govinfo.gov/app/details/USCODE-2021-title50/USCODE-2021-title50-chap36-subchapVI-sec1881a
- Vendor ownership and hosting – taken from company filings, public registries (including UK Companies House) and suppliers’ own documentation, compiled in the Information Matters UK vendor sovereignty database.
How we did this. We scored each technology layer on four things — supplier concentration, whose laws they answer to, how hard they are to switch, and how essential they are — using the IM Sovereignty Framework and our UK vendor database. Control and hosting facts come from primary sources; the harder-to-quantify judgments are our reasoned view of a typical organisation. Scores are bands, not exact measurements. Full evidence record available on request.
This research consists of the opinions of the Information Matters team — human and AI — and should not be considered statements of fact.
Information Matters · informationmatters.net
If you have any questions or comments about this article please email info@informationmatters.net
