Lord Sarfraz

In 2025, DSIT suspended reporting under the previous Legacy IT Assessment Framework due to the burden it placed upon departments. Consequently, a comprehensive account of which systems have been remediated or decommissioned is currently unavailable. However, DSIT have been working with departments to explore innovative and scalable solutions to tackle legacy systems across the public sector, including piloting AI Code Assistants within departments to accelerate legacy remediation activities. The current evidence shows that these pilots are extremely successful and given this DSIT is now considering how this could be expanded

Individual departments are accountable for addressing their legacy technology, supported by £20 billion in funding allocated to digital priorities across government, including the remediation of legacy IT systems. Through the Digital Business Review Process DSIT will track the progress being made and offer support where appropriate.

The Government Cyber Action Plan does not set specific targets for the remediation of legacy systems. This will be a continually evolving picture as DSIT improves the observability of the legacy estate across the public sector. These targets will be set in the Legacy IT Action Plan that will be published later this year.

The Government Cyber Action Plan set out public milestones to hold Government to account for delivering improvements in cyber security and digital resilience.

The first tranche of milestones published under the Government Cyber Action Plan are due for completion by April 2027. Work is ongoing towards these milestones with some notable achievements including: the establishment of the Government Cyber Unit within DSIT; the establishment of central services and support functions; the launch of the Government Cyber Profession in February 2026, and the publication of the Government Cyber Incident Response Plan.

The noted investment is subject to standard business case approval procedures. DSIT will continue to report bi-annually on progress against NAO recommendations (from its 2025 report on Government Cyber Resilience) to enable parliamentary scrutiny of government spending.

The Government recognises the transformative economic potential of generative AI in the UK. While London and the South-East currently generate around 86% of UK AI Revenue, other regions, such as Manchester, Cambridge, and Edinburgh, are emerging as key innovation hubs. This includes £750 million of investment recently announced for the building of a new AI supercomputer, hosted at the University of Edinburgh.

Additionally, as HMG’s AIRR+ compute network can be accessed remotely, researchers across the country are now able to make use of the UK’s world-class sovereign compute, in order to train new cutting-edge AI models.

The North and South-West have the highest levels of business AI adoption outside of the greater South-East, suggesting industry in UK is harnessing the benefits of AI technology into their business practices.

Cable landing stations are a critical part of the UK’s digital infrastructure, and the Government takes their security seriously. The Department for Science, Innovation and Technology (DSIT) works closely with the National Protective Security Authority (NPSA) and the National Cyber Security Centre (NCSC) to identify and assess physical and cyber security risks to telecoms infrastructure, including cable landing stations. These assessments inform DSIT and wider Government policy, legislation and engagement with the sector.

The Government is carefully considering issues relating to copyright and AI, such as copyright protection for AI-generated works of art.

The Government has launched a consultation on a package of measures to address copyright and AI issues. This will include seeking views on protection for the outputs of generative AI.