Who controls the technology behind a UK media or creative business?
How much this sector depends on technology suppliers it cannot fully control — and where that matters most.
The big picture
For a typical UK media, creative, marketing or publishing business, five of the eight building blocks score High exposure, and the sharpest of all is the one the work is actually made in: creative production software, where Adobe holds a near-monopoly and its proprietary file formats make leaving genuinely hard. The cloud, office software, the creative tools and the staff log-in are all US-controlled. Payments is the one low-risk layer. The defining problem is not data loss but dependency: the craft itself runs on one American supplier’s tools and file formats.
We looked at the everyday layers of technology a UK media, creative or marketing business relies on, from the cloud it runs on to the systems that define the sector. A supplier owned in the United States can be compelled to hand over data under US law — the CLOUD Act[1], and the surveillance powers in Section 702 of the Foreign Intelligence Surveillance Act[2] — even when that data is stored in Britain; a British supplier answers only to UK law. We scored each building block on four things — how few the suppliers are, whose laws they answer to, how hard they are to switch, and how essential they are.
Where the exposure sits
Who controls each layer
The building blocks this sector relies on, coloured by who ultimately controls each one:US-controlledUK-controlled
Genuinely UK-controlled options in our data are thin in the layers that matter most. Creative tooling: the strongest UK-origin product, Affinity (Serif, Nottingham), is now Australian-owned (Canva, 2024) — ownership, not origin, is the test; Synthesia and Blackbird are UK-controlled but narrower tools. Content management: self-hosted WordPress (open-source) hosted in the UK is the clearest lever; EU-controlled options are Contentful and Cinegy (Germany), Umbraco (Denmark). Marketing/PR: Roxhill Media (UK), Meltwater (Netherlands). The defining gap is design and video editing, where there is no full-parity UK-controlled alternative to Adobe — open-source (GIMP, Krita, Inkscape, Blender) and the Australian DaVinci Resolve are the realistic non-US routes, with feature and format trade-offs.
What this means, in plain terms
If a supplier pulled the plug, how fast would it hurt?
| Speed of impact | Layer | What happens |
|---|---|---|
| Hours–days | Identity & log-in | Staff are locked out of every connected system at once; fastest failure, gates access to the cloud, files and creative tools. |
| Days | Creative production software (Adobe) | Subscription suspension locks the studio out of the tools the work is made in. Re-tooling onto open-source or Affinity is possible but means retraining and re-working files trapped in proprietary formats — weeks to months, and quality/feature gaps remain. |
| Days | Cloud & compute | Account suspension propagates quickly; hosting, rendering and storage degrade. Migration is a multi-month project. |
| Days | Office & productivity | Email and shared documents stop; the office cannot coordinate. Recoverable but disruptive. |
| Weeks–months | Content & asset management (CMS / DAM) | The website and asset library degrade slowly; published content stays live for a while, but a forced migration of a CMS or DAM is one of the deepest projects on the board. |
What organisations can do about this
| Building block | Practical steps |
|---|---|
| Creative production software — the defining layer | Treat the Adobe format lock-in as the priority, because it is the deepest and most specific to this sector. Keep working files exported in open or interchangeable formats where the workflow allows (TIFF, PNG, SVG, PDF/X, ProRes) so the archive is not trapped in PSD/AI/INDD. Weigh Affinity (now Canva/AU-owned — lowers lock-in and subscription dependence, but ownership is Australian, not British) and open-source tools (GIMP, Krita, Inkscape, Blender, DaVinci Resolve) for parts of the workflow that do not need full Adobe parity. Our analysts’ view: full repatriation is not realistic today, but reducing format lock-in is, and it is the move that matters most. |
| Content & asset management | Self-host WordPress in the UK (open-source — a genuine sovereignty lever), or prefer EU-controlled options such as Contentful (Germany), Umbraco (Denmark) or Cinegy (Germany) at the next platform decision. This lowers jurisdiction one rung (US→4 to EU→2–3) or, for UK-hosted open-source, towards 1 — but only at a re-platforming, which is slow, so the renewal is the moment to choose. |
| Marketing, social & ad-tech | This layer has the most painless UK/EU choice because switching costs are lower. Meltwater (Netherlands) and Roxhill Media (UK) are non-US options for PR and media monitoring in our data. Where US tools (HubSpot, Salesforce, Brandwatch, Cision) are kept, insist on UK/EU data residency and UK/EU-law contracting — this lowers the practical blast radius but does not remove US legal reach under the CLOUD Act. |
| Cloud, office, identity & concentration | Avoid taking cloud, office software, log-in and analytics all from one US giant — splitting them reduces the single-vendor blast radius even if every part is still foreign. UK and European cloud options (OVHcloud, Scaleway, IONOS) and the open-source log-in system Keycloak, self-hosted, reduce reliance on a single US provider. |
| Payments & banking | Already low-risk for a typical creative business — accept and monitor. Only a subscription or e-commerce publisher with heavy card dependence needs to revisit this layer. |
Sources
- US CLOUD Act 2018 (18 U.S.C. 2713) – compels US-incorporated providers to produce data in their custody wherever in the world it is stored. https://www.govinfo.gov/content/pkg/USCODE-2018-title18/html/USCODE-2018-title18-partI-chap121-sec2713.htm
- US Foreign Intelligence Surveillance Act, Section 702 (50 U.S.C. 1881a) – a US directed-surveillance authority. https://www.govinfo.gov/app/details/USCODE-2021-title50/USCODE-2021-title50-chap36-subchapVI-sec1881a
- Vendor ownership and hosting – taken from company filings, public registries (including UK Companies House) and suppliers’ own documentation, compiled in the Information Matters UK vendor sovereignty database.
How we did this. We scored each technology layer on four things — supplier concentration, whose laws they answer to, how hard they are to switch, and how essential they are — using the IM Sovereignty Framework and our UK vendor database. Control and hosting facts come from primary sources; the harder-to-quantify judgments are our reasoned view of a typical organisation. Scores are bands, not exact measurements. Full evidence record available on request.
This research consists of the opinions of the Information Matters team — human and AI — and should not be considered statements of fact.
Information Matters · informationmatters.net
If you have any questions or comments about this article please email info@informationmatters.net
