Lock-in pattern catalogue
The suppliers, products and customers discussed in the survey are in the landscape database, with known spend and sources. The graph shows how they connect.
The same lock-in mechanisms recur across sectors. Naming them helps a buyer recognise them in their own contracts, and tells anyone designing an alternative which mechanisms it has to avoid.
1. Data-format lock-in
The data shape is proprietary, partially documented, or only fully extractable through the vendor’s own export tools. Migration requires reconstructing the meaning of the exported data.
Examples: GP clinical-system data export (EMIS, TPP); council revenues-and-benefits historic-arrears data; school MIS attendance and assessment formats; legacy-mainframe COBOL/IDMS extracts in HMRC and DWP.
How an open alternative addresses it: Open data standards. Where a national or international standard exists (FHIR for health, planning.data.gov.uk schemas for planning, GBFS for transport), an open product that follows it is portable as a result.
2. Accreditation and certification barriers
Entering the market requires passing a regulatory bar that is expensive in time and money. The bar is often legitimate (clinical safety, security accreditation), but it entrenches incumbents who have already paid the cost.
Examples: NHS clinical-safety standards (DCB0129 / DCB0160); Digital Technology Assessment Criteria (DTAC); GP IT Futures framework; Cyber Essentials Plus; ISO 27001; security clearance for defence, justice, and policing systems.
How an open alternative addresses it: Plan for certification from the start of the build. Sustained funding to absorb the certification cost across multiple sector engagements. Component-level certification where end-to-end product certification is impractical.
3. Integration monopolies
One vendor controls the integration points to a system used by many organisations. Replacing the vendor means rebuilding integrations to a system you do not control.
Examples: NHS Spine and e-Referral certified-integrations; the Idox planning portal’s relationship with the Idox back-office product; council-tax billing integration to council financial ledgers; rail retail clearing through LENNON; Cubic ticketing as the integration point for TfL transactional services.
How an open alternative addresses it: Open integration libraries that any product (proprietary or open) can use. The CIC’s plausible role here is integration components (a clean open EPS library, an open council-tax-billing connector, an open Spine-integration crate).
4. Asymmetric switching costs
Migrating to a new vendor involves significant cost (data migration, re-training, dual-running, integration rebuild) which the buyer bears. Buyers often stay with the incumbent because moving is expensive, even when another product would suit them better.
Examples: Council ERP migrations (typically £15–40m per council). NHS acute EPR replacements (multi-year, multi-tens-of-millions per trust). School MIS migrations across MAT estates. The historical cost of replacing CHIEF with the Customs Declaration Service in HMRC.
How an open alternative addresses it: Tools that reduce migration cost: data-portability extractors, dual-running adapters, parallel-validation tooling. These tools can be worth more to a buyer than an alternative product.
5. Acquisition-driven concentration
Competitors merge, or a private-equity buyer acquires several suppliers in a sector, and the market becomes a duopoly or monopoly. Competitive pressure on price and quality falls.
Examples: EMIS acquired by Optum/UnitedHealth (2023). Cerner acquired by Oracle (2022). Multiple council-software vendors acquired by Civica (Blackstone), the Access Group (Hg), and System C (CVC). Body-worn video consolidation around Axon.
How an open alternative addresses it: Public-sector buyers cannot prevent acquisitions, but they can make their data and integrations portable so that an acquisition does not leave them unable to move. An open replacement also means that a second option exists if the market consolidates.
6. Skills and training lock-in
Staff become deeply trained in one product. Replacing it requires retraining, which is rarely costed in full. Job adverts ask for experience of the dominant product.
Examples: The clinical-systems analyst market is split between EMIS and TPP organisations; transferring skills between them is harder than for a generic developer. Council planning officers’ familiarity with Idox Uniform creates organisational reluctance to switch. Police RMS expertise transfers between products in the same limited way. The skills of social-care administrators trained in Liquidlogic do not transfer directly to Mosaic.
How an open alternative addresses it: Open products and open methods produce transferable skills. The benefit builds up over a career, so it rarely appears in a single procurement business case.
7. Statutory-return lock-in
Statutory or regulator-required reports are built around the dominant vendors’ data structures. Migration involves rebuilding return generation, and a mistake can lead to regulatory action.
Examples: CIPFA returns from council finance systems; SSDA903 and SALT from social-care systems; HESA returns from HE student systems; Tenant Satisfaction Measures from housing systems; clinical statistical submissions across NHS.
How an open alternative addresses it: Statutory returns are usually well-documented. An open product that produces them correctly from the start raises no particular difficulty. The main risk is operational: running parallel returns to validate before going live.
8. Hyperscaler dependency
The product can be replaced, but the infrastructure it runs on often cannot. Replacing the SaaS vendor leaves the hosting provider unchanged, so CLOUD Act exposure remains and data residency is still unclear.
Examples: AWS hosts a large share of UK public-sector SaaS, including NHS national infrastructure components, GDS shared platforms, and council SaaS. Azure hosts a large share of Microsoft 365-adjacent council and NHS estate. Many open-source self-hosted alternatives still run on AWS or Azure by default.
How an open alternative addresses it: Architectures that can be self-hosted on commodity infrastructure, UK or European hosting, and procurement terms that preserve the right to migrate. The CIC arranges hosting for what it builds: some systems run on the CIC’s own infrastructure, others with a hosting partner or on the client’s own servers, and the client owns the software and can move it to another host. The architecture page in this planning area gives the detail.
9. Programme-management lock-in
A specific lock-in pattern for the largest programmes: dependence on a small number of major systems integrators (Capgemini, Atos, IBM, Accenture, Capita) for delivery. The vendor of the product may be replaceable, but the SI relationship spans products and persists across procurement cycles.
Examples: Long-running SI relationships in HMRC, DWP legacy, defence, MoJ, large NHS programmes.
How an open alternative addresses it: Internal capability-building. The Universal Credit reset is the best-known UK example. The CIC’s model rests partly on the view that small, experienced teams can deliver some of the work that has gone to large SI programmes, several of which have delivered poorly.