International comparisons

The suppliers, products and customers discussed in the survey are in the landscape database, with known spend and sources. The graph shows how they connect.

Several countries have made progress on digital sovereignty and shared public-sector platforms. Their experience of what worked, what did not, and what transfers informs the CIC’s thinking.

Estonia: X-Road and e-Estonia

Estonia’s X-Road is the most frequently cited example of national digital infrastructure. It is a federated data-exchange layer that lets public-sector and private-sector systems exchange data with verifiable identity, audit, and citizen-controlled access, without a single central database. Built originally in the early 2000s, it is now used by a very large proportion of Estonian public services and is open-source.

What worked. Long-term political consensus, good engineering, citizen-trust mechanisms built in from the start (every data access is logged and visible to the citizen), and a small population that allowed a coherent national rollout.

What did not. X-Road’s adoption outside Estonia has been patchy. Larger, more federated countries (the UK among them) have found the governance model harder to translate. The 2007 cyber-attacks exposed risks that took years to address.

What transfers. The federated-exchange architecture is sound and increasingly adopted in components elsewhere. The governance lessons (long-term funding, citizen-trust mechanisms, and openness) are directly applicable to UK ambitions on identity, FDP-style data infrastructure, and shared platforms.

France: DINUM, SILL, and the public software catalogue

France’s Direction interministérielle du numérique (DINUM, formerly DINSIC) maintains the Socle Interministériel de Logiciels Libres (SILL), an officially-recommended catalogue of free and open-source software for use in the French public sector. France has made open-source preference a stated procurement principle through the Loi pour une République numérique (2016) and successive policy. France has also produced significant open public-software components: Beta.gouv.fr (a startup-style incubator inside government, comparable to GDS), Démarches Simplifiées (forms and citizen-service infrastructure, similar to GOV.UK Forms), and Tchap (a Matrix-based secure messenger for government use).

What worked. Sustained political backing across multiple administrations. Beta.gouv.fr-style small-team delivery has produced a substantial number of services at modest cost. Tchap shows that open messaging at national-government scale is operationally feasible.

What did not. Adoption of SILL has been uneven across ministries. Open-source preference is stated policy but is not always followed in practice.

What transfers. The CIC works at a smaller scale, but the Beta.gouv.fr model is the closest international comparator to its delivery model: small experienced teams, short delivery cycles, a public-benefit mission and open source by default.

Germany: Sovereign Tech Fund and ZenDiS

Germany’s Sovereign Tech Fund (later Sovereign Tech Agency) funds maintenance of critical open-source software dependencies that public-sector and private-sector systems rely on but that no single party pays for. The Zentrum für Digitale Souveränität (ZenDiS) is a federally-owned company developing openDesk, an open-source productivity suite intended as an alternative to Microsoft 365 for public-sector use.

What worked. Identifying the dependency problem in policy and funding it. The Sovereign Tech Fund has extended the maintenance funding for several critical open-source projects (curl, OpenSSL, sequoia-pgp, others) that the public sector depends on globally. openDesk is now in pilot and rollout in several Länder and federal authorities.

What did not. Adoption of openDesk is slow where organisations already use Microsoft 365. Political support varies between federal and state levels.

What transfers. The Sovereign Tech Fund model could be applied directly in the UK, and the CIC could argue for it. ZenDiS shows that an open productivity suite can be built at national scale, which is relevant to the CIC’s long-term thinking on Microsoft dependency.

Denmark: digital identity and shared services

Denmark has built one of the most consolidated digital-identity systems in Europe (NemID, succeeded by MitID), used universally across public services, banking, and large parts of the private sector. Beneath that, Denmark has invested in shared public-sector services (Digital Post for citizen-facing communication, Borger.dk as the single citizen portal, the public CPR registry).

What worked. A mandate combined with investment: citizens must use MitID, so the government has had to make it work, and this has consolidated identity across services.

What did not. NemID had reliability problems at peak load; political controversy over CPR-data uses persists.

What transfers. GOV.UK One Login is broadly following the MitID approach, with less of a mandate. Denmark’s Digital Post and Borger.dk are useful comparators for consolidated citizen-facing platforms.

European Union: OSPO and EU public-software policy

The European Commission has its own Open Source Programme Office (EU OSPO) and has published increasingly clear guidance on open-source preference for public-sector procurement. The EU Cyber Resilience Act and other regulatory instruments have raised the priority of open-source maintenance. Several member states maintain their own OSPOs (France, Germany, Belgium, Sweden) under the umbrella of EU coordination.

What transfers. The OSPO model is increasingly used as the institutional means of sustaining public open source. The UK has no comparable function with a comparable budget, and the CIC could argue for one.

United States: 18F, USDS, and state-level efforts

The US 18F service (similar to GDS but smaller) and the United States Digital Service have delivered public-sector services using small teams. State-level open efforts are sporadic but include some good examples (the State of California’s ODP work, several New York City open-data initiatives).

What did not transfer well. US federalism and procurement law create a very different operating environment from the UK. Many of the 18F/USDS lessons are about working within that environment specifically.

What this means for the CIC

The successful examples share long-term political backing, well-engineered reference implementations, limited scope, and governance that continues through changes of leadership. UK work with these features (parts of GDS’s output) has been successful. Most of the SI-led legacy estate lacks them and has had poorer results.