Six things a modern government has to get right

Recommendations for digital government are usually principles. Be user-centred. Break down silos. Fund outcomes, not projects. They are hard to disagree with and impossible to fail, which is why they survive from one strategy to the next without anything changing underneath them.

The six below are different in one respect. Each comes from a specific published finding, and each can be checked next year against a document that already exists.

1. Fund the remediation, not only the replacement

Departments were running at least 228 legacy IT systems as at March 2024. Sixty-three of them were red-rated. For 120 of the 228, or 53%, no fully funded remediation plan existed at all. The auditors also recorded a government estimate that nearly half of £4.7 billion of IT expenditure in 2019 went on keeping legacy running.

A replacement programme with a five-year horizon leaves those systems in service for five years. The budget line that pays for isolation, monitoring and patching in the meantime is the one that decides how bad the intervening period is, and it is routinely the line cut when a department manages an in-year pressure. That is exactly what happened: from January 2023 onwards, several departments narrowed the scope of their cyber improvement work to pay for something else.

The recommendation, stated as a rule rather than an aspiration, is that no modernisation business case should be approved without a separately identified, ring-fenced sum for keeping the outgoing system safe for its full remaining life. That sum is knowable. It is currently absorbed into an operating budget where it competes with everything else and loses.

2. Staff the buying side in proportion to what is being bought

Around 6,000 people work in the Government Commercial Function. Fifteen have the nineteen biggest technology suppliers as their whole job, plus four colleagues in the Government Digital Service. Publishing that ratio on 6 June 2025, the Public Accounts Committee called it simply not tenable. The spend it covers is put at £14 billion or more each year.

The new Digital Commercial Centre of Excellence is to have 24 experts. That is a better number than fifteen and it is not a different order of magnitude. Any recommendation about smarter buying that does not address headcount on the buying side is a recommendation about attitude.

There is a second-order effect that gets missed. Thin coverage does not distribute evenly across the supplier base. It concentrates on whichever relationship is currently on fire, which means the contracts that are running acceptably receive no attention until the renewal, at which point nobody in the room has been following them. Suppliers know this and price accordingly, and it is entirely rational of them to do so.

3. Know what you spend before negotiating on the strength of it

That £14 billion is not a government figure. It is an outside estimate that government has not been able to sharpen, and departments do not tell the centre what they intend to buy next. The Cabinet Office conceded in evidence that this gap produces procurement inefficiencies which cost real money.

The admission is worse than it sounds. In cloud pricing, the buyer who can promise volume gets the discount, and DSIT said as much when it told the committee that the ability to commit spend is where its leverage comes from. A department that cannot forecast cannot promise, so it buys at something close to published rates while spending at a scale where nobody else does. A data platform introduced in March 2025 gives departments somewhere to submit spending and pipeline figures. Having a form is not the same as having an answer.

The fix here is unglamorous and entirely within government’s control: publish a rolling three-year forecast of digital demand by category. Suppliers would read it, which is the point. So would the Treasury.

4. Put the digital leader where the decisions are taken

The State of digital government review counted four central departments whose executive committee includes a digital leader. Four. In the NHS, over 80% of trusts have a named chief digital information officer, and roughly half of those officers sit on the trust board.

There is a commitment attached, and it is dated. The blueprint for modern digital government of 21 January 2025 requires all public sector organisations, councils as well as departments, to have a digital leader on their executive committee and a digital non-executive director on their board by 2026 at the latest, and to publish that information. A commitment with a year on it can be marked, which makes it rarer than it should be. The year is 2026, and it is more than half gone.

There is a reason this is not merely symbolic. Legacy accumulates through decisions taken where technology is not represented: a policy change with a three-month deadline, a merger of two arm’s length bodies, a decision to keep an unsupported system running for one more year. None of those decisions look technical when they are made.

5. Count services, not websites

Nearly half of central government services have no digital pathway at all, and the NHS figure is close behind at 45%. Around 45,000 letters reach DVLA daily. Defra maintains more than 500 services built on paper forms. Very few services anywhere avoid manual processing altogether.

Twenty-five years of digital government has produced excellent front doors on top of processes that still require a person to key something in from paper. That is not a failure of design; the front doors are genuinely good. It is a failure of scope, and it recurs because a website can be delivered inside one financial year and a process change cannot.

The measure that would settle it is not satisfaction with a service’s website. It is the proportion of completed transactions that touch no manual step, published per service. Government holds the data to publish it.

6. Write the law for the analysis you intend to do

Taking evidence from the Public Sector Fraud Authority, the Public Accounts Committee reported on 27 March 2026 that the Local Audit and Accountability Act 2014 does not allow for profiling of individuals’ behaviours. The practical effect, in the committee’s words, is that data collected under the Act can be used to look for or prevent fraud, but not for ongoing live investigations, and cannot be used to flag someone who has previously committed fraud to inform future counter-fraud work. The same report gives the reason the National Fraud Initiative, which local authorities must use, has never been mandatory for central government: the original legislation was targeted at local government and has not since been amended.

Neither is an oversight by anybody currently in post. Both are the residue of statutes drafted when the analysis now contemplated was not possible. The lesson generalises: a data or AI ambition announced without a legislative programme behind it is an ambition that will meet a 2014 Act in about eighteen months and stop.

What links the six

None of these is a technology decision. They are decisions about budget lines, headcount, seniority, measurement and statute, and every one of them is taken by people who would not describe themselves as working in digital.

That is the uncomfortable conclusion available from the audit record, and it has an implication for anyone selling into this market or working inside it. The constraint on British digital government is not that the technology function is insufficiently ambitious. On the evidence it is more ambitious than the machinery around it can currently absorb.

Further analysis of that machinery sits in public sector technology, and the buying half of the argument is worked through in what the Procurement Act changed for suppliers.