On 21 May 2026, London Mayor Sadiq Khan blocked what would have been Palantir’s biggest contract with UK police: a 50 million pound deal for AI-powered intelligence analysis across the Metropolitan Police.
Khan cited a “clear and serious breach” of procurement rules. The Mayor’s Office for Policing and Crime (MOPAC) has final sign-off on Met contracts over 500,000 pounds, and the Met had engaged with a single supplier after a trial run on a directly awarded contract with no open competition. Khan’s office also warned that the Met risked becoming locked into Palantir’s technology.
On the surface, this is a procurement story. Underneath, it is about something much bigger.
The Scale of Palantir in UK Government
An investigation by The Nerve identified at least 34 current and past UK state contracts with Palantir, totalling a minimum of 670 million pounds. As a minimum, the real figure may be higher.
The major ones include:
- NHS Federated Data Platform (FDP): 330 million pounds over seven years, awarded November 2023
- Ministry of Defence: 240.6 million pounds for data integration, analytics, and AI platforms, signed 30 December 2025 and running from April 2026 to March 2029
- Met Police (blocked): 50 million pounds for AI-powered criminal intelligence
That is over 620 million pounds across just three contracts with a single US-headquartered company. And integrated data platforms of this kind are, by design, deeply embedded in the systems around them, which is what makes them difficult to remove.
The NHS Break Clause
The NHS FDP contract has a break clause on 15 February 2027. In March 2026, Digital Health reported that the government was considering using it.
The British Medical Association’s annual representative meeting passed a motion in June 2025 calling Palantir an unacceptable choice of partner for the FDP, citing public trust, transparency and data governance. In February 2026, the BMA told doctors to limit their engagement with the platform. A separate briefing from the health charity Medact warned that the “highly interoperable nature” of Palantir’s software could enable “data-driven state abuses of power.”
NHS users have reported that the platform is “awful to use.” MPs, unions, and pressure groups have joined the pushback. Palantir’s UK boss has publicly urged ministers not to give in to the campaigners calling for the contract to be cut.
Where it stands at the start of October 2026: no decision on the break clause has been announced. In July 2026 the Commons Health and Social Care Committee told the government to start preparing a replacement so one could be in place by March 2027, and the Science, Innovation and Technology Committee has urged ministers not to extend the contract in 2027. Under the contract, Palantir’s exit plan was due by 30 September 2026. The break clause itself can be exercised on 15 February 2027, so the decision has to come before then.
The Sovereignty Question Nobody Is Asking Loudly Enough
Here is what sits beneath the procurement arguments and usability complaints.
Palantir is a US company. It is subject to the US CLOUD Act. Its software handles some of the most sensitive data the UK government holds: patient health records, criminal intelligence, military operations data.
Chi Onwurah, chair of the Commons Science, Innovation and Technology Committee, welcomed Khan’s intervention, saying authorities needed to guard against “vendor lock-in” and excessive reliance on overseas suppliers. The phrasing is diplomatic. The concern is jurisdictional.
When the Dutch government blocked Kyndryl from buying Solvinity, the host behind its DigiD national login, in May 2026, the minister cited the CLOUD Act explicitly. When France announced in January 2026 that civil servants would move off US videoconferencing platforms by 2027, the CLOUD Act was central to the debate that led there. The UK has not yet had that explicit conversation at the policy level, but individual decisions, Khan blocking the Met deal, the BMA pushing back on the FDP, keep bumping into the same underlying question.
Who controls the data? And who can compel access to it?
What This Means for IT Professionals
The UK government does not have an overarching digital sovereignty policy. A report by the Open Rights Group in April 2026 warned of a “crisis of digital dependency.” Green Party MP Sian Berry has tabled early day motions calling for a UK digital sovereignty strategy.
Whether that strategy materialises or not, the skills required are clear. Monitoring, intelligence dashboards, security baselines, log aggregation, data analysis. All of these can be built on open-source tools without jurisdictional complications.
You do not need Palantir to build a monitoring and alerting dashboard. You need Grafana, Prometheus, structured logging, and the security fundamentals to protect it. Replacing an integrated data platform is a much bigger job, which is exactly why lock-in matters.
Try It Yourself
The underlying capabilities that make platforms like Palantir valuable, data aggregation, visualisation, pattern detection, security monitoring, are all achievable with open-source tooling. The difference is who controls the infrastructure.
- Grafana and Prometheus for Homelab Monitoring shows you how to build the same kind of data visualisation and alerting infrastructure that underpins intelligence platforms, on hardware you control.
- SSH Server Hardening covers securing the access layer, because a monitoring platform is only as trustworthy as the infrastructure it runs on.
- Secure Linux Servers with Ansible automates the security baseline across your entire environment, the same principle as hardening production infrastructure at scale.
670 million pounds. One vendor. One jurisdiction. The question is not whether the UK will eventually address this. The question is whether IT professionals will be ready when it does.
Sources: Novara Media, Computing, The Nerve, Digital Health, The Register (July 2026), The Register (September 2026)
RTFM Apparel · printed in the UK
ReadTheManual is run, written and curated by Eric Lonsdale.
Eric has over 20 years of professional experience in IT infrastructure, cloud architecture, and cybersecurity, but started with PCs long before that.
He built his first machine from parts bought off tables at the local college campus, hoping they worked. He learned on BBC Micros and Atari units in the early 90s, and has built almost every PC he’s used between 1995 and now.
From helpdesk to infrastructure architect, Eric has worked across enterprise datacentres, Azure environments, and security operations. He’s managed teams, trained engineers, and spent two decades solving the problems this site teaches you to solve.
ReadTheManual exists because Eric believes the best way to learn IT is to build things, break things, and actually read the manual. Every guide on this site runs on infrastructure he owns and maintains.
Enjoyed this guide?
New articles on Linux, homelab, cloud, and automation every 2 days. No spam, unsubscribe anytime.
