Britain’s New AI Framework Puts Sovereignty First. What That Means for Data, Compute and Compliance Teams

The UK government has settled on a short phrase to describe how it wants artificial intelligence to develop in Britain: control and sovereignty. According to the Financial Times, Prime Minister Andy Burnham and senior ministers have agreed a framework of seven principles to guide the adoption of AI and the infrastructure needed to run it. The full list has not been published. The principles reported so far say that AI must work in the interests of the British people, that control and sovereignty matter, and that infrastructure must serve a national purpose and deliver for the communities that host it.

The framework arrives a week after the Budget, which paired hundreds of millions of pounds for AI security with a new deal for data centre developers: faster grid connections and planning help in return for meeting tests on energy, water, local investment and security. For companies that build, buy or host AI in the UK, the combination is a signal about where policy is heading. For privacy and compliance teams, it raises a practical question that the word “sovereignty” tends to hide. Sovereign over what, exactly: the buildings, the chips, the models, or the data?

What has been agreed, and what has not

It helps to separate three things that are being reported together.

• The seven-principle framework. Reported by the Financial Times on November 2, 2026, after Cabinet-level discussions led by the Minister for Artificial Intelligence, Kanishka Narayan. Only some principles are public. It is a statement of policy direction, not legislation, and it creates no new legal duties by itself.
• The Data Centre Covenant. A published HM Treasury policy paper dated October 28, 2026, released with the Budget. This is where the trade of standards for grid access and faster planning actually sits.
• The Budget’s AI package. Funding announcements for AI security, cyber defence and domestic capability, set out by the Chancellor, John Healey.

Early summaries of the FT report described the framework as requiring “AI developers” to meet environmental and community conditions in exchange for priority grid access and fast-tracked planning. That is not quite right. The bargain is in the Covenant, and it is aimed at data centre developers, specifically projects the government designates as “strategic data centres.” AI model developers are not directly bound by it unless they build or operate such a facility.

The FT also reported differences of emphasis inside government. The Secretary of State for Digital, Culture, Media and Sport, Lisa Nandy, was said to favour a more cautious approach after creative industries raised concerns about unauthorised scraping of copyrighted work to train AI systems, while the Department for Business, Innovation, Science and Trade was said to favour faster adoption to support growth. Officials have described ministers as aligned on public trust and responsible adoption. These accounts come from press reporting on internal discussions and should be read that way.

The deal on offer to data centre developers

The Data Centre Covenant starts from a capacity estimate. The government says protecting the national interest will require 6 GW of AI data centre capacity by 2030, and argues that the UK “cannot rely entirely on infrastructure located overseas” as AI becomes part of the NHS, defence and other critical services.

It then sets five tests. All data centres are “encouraged” to meet them. Strategic data centres “must” meet them to qualify for extra government help:

• Lower electricity bills: pay a fair share of the energy system costs they create and support grid flexibility and resilience.
• Invest in local communities: strategic sites should agree a Local Benefit Plan, linked to the development’s size and shaped with the community, on top of existing planning obligations.
• Environmental standards: new facilities designed for a Power Usage Effectiveness of 1.3 or better, reduced reliance on public water supplies, waste-heat reuse where there is a local user, and annual reporting on energy and water use, emissions and heat reuse.
• Jobs and reindustrialisation: local hiring, paid apprenticeships, priority for UK suppliers, and for the most strategic sites a “meaningful contribution” to British AI hardware.
• Security: secure UK access to compute for public services, work with national technical authorities including the National Cyber Security Centre on resilience beyond baseline requirements, information sharing with government, and participation in exercises on prioritising essential services.

In return, a new Ministerial Control Centre chaired by the Minister for AI will consider support for qualifying projects. The Covenant says the government will use powers in the Planning and Infrastructure Act to reserve and reallocate grid connections for strategically important projects, work with the system operator NESO and network companies to find capacity before 2030, facilitate transfers of pre-2030 connection contracts, and, for “exceptionally strategic” projects only, permit temporary on-site generation until a grid connection is available. The government also says it will publish a draft Data Centre National Policy Statement for consultation and continue the five AI Growth Zones in England, Scotland and Wales.

Two caveats matter. First, the government has not yet defined “strategic data centre”; it says further detail will come “in due course.” Second, priority access to the grid does not create grid capacity. Whether enough power and connection capacity exists to support 6 GW by 2030 is precisely the kind of question officials are reported to be still working through.

The money behind the sovereignty language

The Budget package, set out in the Treasury’s announcement “Chancellor unveils Britain’s ambitious plan for AI”, put figures on the security side of the framework:

• £165 million for a National AI Biosecurity Initiative, including £100 million for an AI Biosecurity Lab, supported by up to £200 million in AI model credits from OpenAI and Anthropic.
• An additional £120 million for the AI Security Institute’s testing and research.
• £60 million for a National Cyber Shield that uses agentic AI for cyber defence, including a £25 million challenge fund.
• £70 million for a National Exposure and Real-Time Vulnerability Centre to find weaknesses across critical infrastructure.
• An additional £60 million for the Sovereign AI Fund and £60 million for Sovereign AI’s R&D procurement scheme, plus £18 million for an Advanced Chip Design Academy.

Note the detail about model credits. Britain’s flagship sovereign biosecurity lab will run partly on compute from two American AI companies. That is not a contradiction so much as a description of what sovereignty means in practice: a mix of domestic capability and trusted access to foreign technology, with the government deciding which is which.

Sovereignty is a data question first

The clearest definition of the term comes from the Council for Science and Technology, the government’s senior independent science advisory body. In a letter to Narayan published on October 19, it defines AI sovereignty as “having sufficient agency across the AI value chain to deliver the UK’s chosen outcomes, capture economic and public value for the UK, and maintain resilience under duress.” It warns that without action the UK risks becoming “a high-value AI customer, rather than a country able to shape the technology.” It recommends that government identify important UK datasets and test access arrangements in at least two high-value areas, naming health and creative data as examples.

That recommendation is where privacy law enters. Health data is special category data under UK GDPR. Creative data sits on top of the copyright dispute Nandy reportedly raised. Any program that opens national datasets to AI development will need a lawful basis, transparency to the people the data is about, and data protection impact assessments before access is granted, not after. The Data (Use and Access) Act 2025 changed parts of that framework, including research provisions and automated decision-making rules; our guide to the UK Data (Use and Access) Act 2025 covers what moved.

Sovereignty also intersects with international transfers. A UK-hosted data centre does not mean UK-only processing if support staff, model providers or sub-processors sit abroad. UK transfer rules apply to the data flow, not the postcode of the server. The ICO’s recent guidance changes, which we covered in how the ICO reframed international data transfers, are a useful check on whether “sovereign” hosting actually changes your transfer analysis.

Britain is not alone. Canada has taken a stake in Cohere, which we examined in Canada’s sovereign AI bet and data control, and the US has warned Europe that its sovereignty push could provoke a trade clash, as we reported in U.S. warns Europe its AI sovereignty push could trigger a tech trade clash. The UK is trying to stay close to American AI firms while building enough of its own capacity to say no when it needs to.

Six questions to ask of any “sovereign” AI service

Expect vendors to market UK hosting and sovereign capability heavily as these policies take shape. Procurement, privacy and security teams can test those claims with a short set of questions.

1. Where is personal data processed, not just stored? Ask for the locations of inference, logging, backups, support access and model fine-tuning. A UK data centre with a support team in another country still involves a transfer.
2. Who controls the model? Is it a UK-developed model, an open-weight model run locally, or an API call to a foreign provider? Each has different contractual, security and transfer implications.
3. Is customer data used for training? Get a contractual answer and an opt-out mechanism, and record it in your record of processing activities.
4. What happens under duress? The Council for Science and Technology defines sovereignty partly as resilience under pressure. Ask what continuity the service has if a foreign supplier withdraws, is sanctioned or changes terms.
5. What security assurance exists? The Covenant expects strategic sites to work with the NCSC beyond baseline requirements. For ordinary suppliers, ask for recognised certifications, penetration test summaries and incident notification commitments.
6. Can you meet individuals’ rights through it? Access, correction, deletion and objection requests must still be honoured when data sits inside an AI system. Confirm the vendor can locate and act on records about a specific person.

A “sovereign” label on a sales deck answers none of these by itself.

What compliance teams can do now

The framework does not change legal obligations today, but it does indicate what UK regulators and public buyers will care about. Sensible steps include:

• Inventory the AI tools in use, including those embedded in existing software, and record what personal data each one touches. Our overview of AI governance tools explains why this list is usually longer than leaders expect.
• Run DPIAs for AI uses involving special category data, children’s data or significant automated decisions.
• Update vendor questionnaires with the six questions above and keep the answers on file.
• If you sell to the UK public sector, expect procurement teams to ask about UK hosting, security cooperation and supply chain resilience, and prepare documented answers.
• Watch for the full seven principles, the definition of strategic data centres, and the draft Data Centre National Policy Statement consultation.

Captain Compliance supports the privacy side of this work with data mapping and records of processing, privacy and third-party assessments, privacy notices that can be kept current as processing changes, and data subject request workflows. Those tools help document where personal data goes and respond to individuals. They do not certify a vendor as sovereign, and no software can guarantee compliance on its own.

There is also a public-administration angle. AI is already changing how citizens interact with the state, as we discussed in how AI could overwhelm the British state. A government pushing faster public-sector adoption will face the same governance questions as any private organisation, under more scrutiny.

Frequently asked questions

Who is the UK Prime Minister, and when did the framework get agreed?

Andy Burnham has been Prime Minister since 20 July 2026, according to the government’s official ministers page. The Financial Times reported the agreement of the seven-principle framework on 2 November 2026.

Has the government published the seven principles?

Not in full as of 3 November 2026. Only a few principles have been reported, covering the interests of the British people, control and sovereignty, and infrastructure that serves a national purpose and local communities.

Do AI developers now have to meet environmental conditions?

Not as a general rule. The environmental and community tests are in the Data Centre Covenant, which applies to data centres. All data centres are encouraged to meet them, and projects designated as strategic must meet them to receive government help with grid connections and planning.

Does the framework change UK GDPR?

No. It is a policy framework. UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025 continue to set the legal rules for personal data used in AI systems.

Does hosting data in a UK data centre remove the need for transfer safeguards?

Not necessarily. If personal data is accessed from or sent to another country, for example by a support team, a model provider or a sub-processor, UK transfer rules can still apply. Check the full data flow, not just the hosting location.

What is a “strategic data centre”?

The government has not yet published the definition. The Covenant says further details on the definition and additional criteria will follow.

The capacity question nobody has answered

Every principle in the framework depends on something physical: power, land, water, chips and the people to run them. The Covenant can move a project up the grid queue, but it cannot make the queue shorter, and the government’s own estimate of 6 GW by 2030 is a target, not a forecast. Meanwhile the data that would make sovereign AI valuable, from NHS records to creative archives, belongs to people and rights holders who have not been asked. Britain has decided what it wants AI to be. The harder test, for ministers and for every company that wants to build here, is whether it can be built fast enough without spending the public trust the framework says it is trying to protect.