Who controls the technology behind a UK energy supplier?
How much this sector depends on technology suppliers it cannot fully control — and where that matters most.
The big picture
For a typical UK energy supplier, six of the eight technology building blocks are High or upper-Medium exposure, with a overall headline score of 3.4. This is the first sector we have profiled where the defining system has a genuine British leader: the customer information system (CIS) that bills households has a UK-controlled market leader, Kraken Technologies (spun out of Octopus Energy), and the trading and flexibility / demand-side response (DSR) layer is unusually British too. But the same billing layer also includes Gentrack (New Zealand), Hansen (Australia), SAP (Germany) and Itron (United States), and beneath almost everything sits a US hyperscaler – Kraken and Gentrack both run on Amazon, the leading meter-data system (Itron) runs on Microsoft – so British control of the software does not clear US legal reach at the substrate.
We looked at the everyday layers of technology a UK energy supplier or utility relies on, from the cloud it runs on to the systems that define the sector. A supplier owned in the United States can be compelled to hand over data under US law — the CLOUD Act[1], and the surveillance powers in Section 702 of the Foreign Intelligence Surveillance Act[2] — even when that data is stored in Britain; a British supplier answers only to UK law. We scored each building block on four things — how few the suppliers are, whose laws they answer to, how hard they are to switch, and how essential they are.
Where the exposure sits
Who controls each layer
The building blocks this sector relies on, coloured by who ultimately controls each one:US-controlledMixed / otherUK-controlled
This is the first profile where the defining layer (the billing customer information system) has a genuine UK-controlled market leader (Kraken Technologies), and the trading/flexibility (DSR) layer plus the central market-data infrastructure (Correla, ElectraLink) are UK-controlled too. But cloud, productivity, identity and reporting remain US-dominated, the billing layer also includes NZ/AU/DE/US vendors, and the substrate beneath the British software is still a US hyperscaler (Kraken and Gentrack on AWS; Itron meter data on Azure).
What this means, in plain terms
If a supplier pulled the plug, how fast would it hurt?
| Speed of impact | Layer | What happens |
|---|---|---|
| Immediate | Identity & access (Microsoft Entra / Okta) | Staff log-in fails within hours – an instant lockout of every cloud system at once. |
| Fast | Billing / customer information system (CIS) | The meter-to-cash heart; billing and customer management stop within days, and replacing a CIS is a multi-year re-implementation – the deepest re-platform on the profile. |
| Fast | Meter data & grid operations | Billing-grade meter reads and regulated market interactions stop within days; settlement breaks. |
| Fast | Cloud | Account suspension propagates quickly to everything hosted on it. |
| Medium | Payments | Direct-debit collection is the cash engine; card and open-banking flows have a UK fallback. |
| Medium | Data & BI | Reporting degrades but operations continue for a while. |
| Slow | Trading & flexibility / DSR | Most UK-controlled and most replaceable – the lowest-exposure technology layer. |
What organisations can do about this
| Building block | Practical steps |
|---|---|
| Billing system (CIS) – favour the British leaders | At the point of choosing or replacing a customer information system, the UK-controlled options in our database are Kraken Technologies and ENSEK (Centrica-owned); Gentrack (New Zealand), Hansen (Australia), SAP (Germany) and Itron (United States) are not UK-controlled. Note that Kraken still runs on Amazon’s cloud, so choosing it lowers the jurisdiction risk rather than removing it. |
| Meter data – prefer the British market systems where you can | Britain’s own central market-data infrastructure – Correla (gas) and ElectraLink (electricity Data Transfer Service) – is UK-owned and UK-run; the widely-used meter-data-management system Itron is American and runs on Microsoft’s cloud. UK-controlled options in our database also include Stark and Smarter Technologies. |
| Trading and flexibility (DSR) – protect a position of strength | This layer is already UK-rich: Flexitricity, Kaluza, Kraken Flex and Lunar Energy are UK-controlled. Accept and monitor, and keep an eye on ownership changes – Limejump was acquired by Shell – but this is the sector’s strongest sovereignty position. |
| Cloud and log-in – reduce the American concentration | Moving the cloud and/or staff log-in off Microsoft stops one problem taking down email, reporting, log-in and the meter-data system together. UK and European cloud options in our database: OVHcloud and Scaleway (France), IONOS (Germany), Civo (UK); the open-source log-in system Keycloak, self-hosted, reduces reliance on a single US provider. |
| Payments – accept and monitor | Keep direct debit over UK banking rails as the main collection method; it is already low-to-medium risk and runs under UK law. The tail is the US card networks behind card payments. |
Sources
- US CLOUD Act 2018 (18 U.S.C. 2713) – compels US-incorporated providers to produce data in their custody wherever in the world it is stored. https://www.govinfo.gov/content/pkg/USCODE-2018-title18/html/USCODE-2018-title18-partI-chap121-sec2713.htm
- US Foreign Intelligence Surveillance Act, Section 702 (50 U.S.C. 1881a) – a US directed-surveillance authority. https://www.govinfo.gov/app/details/USCODE-2021-title50/USCODE-2021-title50-chap36-subchapVI-sec1881a
- Vendor ownership and hosting – taken from company filings, public registries (including UK Companies House) and suppliers’ own documentation, compiled in the Information Matters UK vendor sovereignty database.
How we did this. We scored each technology layer on four things — supplier concentration, whose laws they answer to, how hard they are to switch, and how essential they are — using the IM Sovereignty Framework and our UK vendor database. Control and hosting facts come from primary sources; the harder-to-quantify judgments are our reasoned view of a typical organisation. Scores are bands, not exact measurements. Full evidence record available on request.
This research consists of the opinions of the Information Matters team — human and AI — and should not be considered statements of fact.
Information Matters · informationmatters.net
If you have any questions or comments about this article please email info@informationmatters.net
