Stage 3 summary. Strategy, trust and sector

Strategy frames are instruments, not identities. A frame that maps competitive position answers a different question from one that maps capability gaps or customer jobs, and the failure mode is reaching for whichever frame you know rather than the one that fits. The now, next and later structure works because it separates commitments from intentions: now is funded and staffed, next has a stated dependency that must clear first, and later is a direction that has not yet earned a date.

Honest dependencies are what make a roadmap survive. Most roadmap failures are sequencing failures rather than estimation failures, where two items were drawn in parallel that could not run in parallel, or a foundational item was pushed right because it had no visible customer. The business case is where this gets tested, because a finance director asks who is accountable for the benefit and when it lands in a budget line. Benefits that nobody owns in a budget are not benefits.

Change does not end at go-live. The Government Digital Service story is instructive because it was not a single delivery: GOV.UK launched in October 2012 in place of Directgov and Business Link, and the durable output was a standard and a way of working, in the Service Standard and the Technology Code of Practice, that outlasted any individual service.

The project-to-product shift is a funding change disguised as a delivery change. Projects fund a scope for a period and disband the team, so knowledge leaves and what was built becomes somebody else's maintenance problem. Product funding sustains a team against an outcome and re-decides the level each planning cycle. The consequence lands on finance and governance rather than engineering, which is why the shift stalls when only engineering is asked to change.

Team Topologies gives four team types and three interaction modes. Stream-aligned teams follow a flow of work from a segment of the business domain and do most of the delivery. Enabling teams help them over obstacles and detect missing capability. Complicated-subsystem teams exist where deep specialist expertise is genuinely required. Platform teams provide an internal product that accelerates the stream-aligned teams. The modes are collaboration for a bounded period of discovery, x-as-a-service where one team consumes what another provides, and facilitation where one team mentors another. Applied to a real organisation chart, the model usually reveals permanent collaboration where an x-as-a-service relationship should have formed.

Platform engineering follows from that. An internal platform is a product with users who can decline to use it, which is the distinction between a platform and a portal: a portal is a place to find things, while a platform provides paved paths that are genuinely faster than the alternative. That quality is where AI value comes from, because the returns follow the surrounding system rather than the tools. Skills frameworks such as SFIA name the capabilities an operating model needs rather than leaving them implied in job titles.

The Data (Use and Access) Act 2025 reshaped the UK landscape without replacing the UK GDPR, so the discipline is still to choose a lawful basis before designing anything, and to choose it for the specific processing rather than for the organisation. The Act adds recognised legitimate interests as a further basis alongside the six in the UK GDPR, and its scope is the point: it applies to a defined list of purposes, and where it applies the balancing test is not required, while everything outside that list still runs on ordinary legitimate interests with the balancing test intact. Treating it as a general shortcut is the error the ICO guidance is written to prevent.

Sharing structures answer a different question, which is who holds the data and who decides. A data trust puts an independent trustee between the holders and the users, bound to a stated purpose. A data cooperative gives the people the data is about collective control over its use. Federated analysis moves the computation to the data, which is often the only workable answer when the barrier is legal rather than technical. Each needs a data-sharing agreement naming controllers, purposes, retention and the exit.

Two parallel tracks are making sharing an obligation rather than an option. In the UK, smart data schemes under the 2025 Act let government require regulated holders to release customer and business data to authorised third parties, sector by sector. In the European Union, the Data Act has applied since 12 September 2025, giving users access to the data their connected products generate. On enforcement, attribution matters: UK data protection penalties come from the ICO while headline European fines are issued by named national supervisory authorities, and citing the wrong one discredits an otherwise sound argument.

The regimes are separate and their triggers differ. The Cyber Security and Resilience Bill, introduced to Parliament on 12 November 2025, reforms the UK Network and Information Systems Regulations 2018 to cover essential and digital services more widely. It is a reform of the UK regime, not an implementation of the European Union's NIS2, so its notification clocks and penalty levels have to be read from the Bill and its published factsheets rather than assumed from the European text.

The NCSC Cyber Assessment Framework is the assessment instrument sitting under the UK regime, currently at version 4.0, organised around managing security risk, protecting against cyber attack, detecting cyber security events and minimising the impact of incidents, with basic and enhanced profiles that set the target according to the threat an organisation faces. Used properly it produces an evidenced position and a gap list rather than a score to report upwards.

Three further regimes complete the picture. The European Union's Digital Operational Resilience Act governs operational resilience for financial entities and their critical technology providers, and shares nothing but an acronym with the DevOps research programme from Stage 2. The Online Safety Act 2023 places duties on user-to-user and search services, enforced by Ofcom and brought into force in phases. Accessibility binds public sector sites and apps to WCAG 2.2 level AA under the 2018 regulations. Digital identity is the trust infrastructure underneath: the UK digital verification services trust framework sets the rules a provider is certified against, so a relying party can accept a verified attribute without running its own checks.

Ecosystem roles are worth naming before economics are argued: the orchestrator that sets the rules, the complementors that build on them, the customers whose participation makes the network worth joining, and the enablers who supply the underlying capability. Value accrues to whoever controls the point of interaction, which is why the interesting question about a partnership is who owns the customer relationship and the data it generates rather than what it costs.

Lock-in has three components that need pricing separately. Data lock-in is whether your data leaves in a form another system can read. Operational lock-in is whether your processes have been shaped around one supplier's model. Contractual lock-in is what the agreement says about notice, egress charges and transition assistance. An exit written at signature costs a negotiation; one written after the relationship breaks down costs a programme.

Regulation has moved in the buyer's favour and should be used. The Digital Markets Act, Regulation (EU) 2022/1925, imposes obligations on designated gatekeepers in core platform services, and the Data Act sets the framework for switching between providers of data-processing services. Build, buy and partner decisions then turn on which capability is genuinely differentiating, and sovereignty questions about where data rests and which jurisdiction can reach it belong in the same decision rather than in a later compliance review.

Benefits realisation tracks a claimed benefit past the point where the programme closes. That requires a baseline measured before the change, a named owner in a budget line, a date, and a review that happens after the delivery team has moved on. Most claimed value evaporates not because the change failed but because nobody was accountable for collecting it once attention moved elsewhere.

Technical debt becomes useful when it is quantified, and Fowler's framing separates deliberate debt taken for a reason from the accidental kind. The quantities that matter are the interest payments: additional effort per change, incident rate attributable to the component, and the number of people who can safely work on it, which is often the sharpest legacy risk of all. The strangler approach, routing slices of traffic to a new implementation while the old one keeps running, is the migration pattern that lets you stop halfway, and governing a migration means deciding in advance what would make you stop.

Cost and carbon belong in the same measurement conversation as delivery, because cloud spend and energy consumption are both consequences of architecture decisions that stay invisible until someone reports them per service. Failure statistics need the discipline from Foundations: when a claim about transformation failure rates appears, say what that study counted as a transformation, what it counted as failure, and over what period, because the honest version is almost always narrower and more useful than the headline.

The GB governance stack has clear layers. Government sets direction through the Energy Digitalisation Framework. Ofgem sets licence expectations through Data Best Practice guidance and Digitalisation Strategy and Action Plan guidance. Licensed network companies and the system operator publish their own plans against that guidance, with NESO's Sector Digitalisation Plan and its Digitalisation Strategy and Action Plan showing what the output looks like. Knowing which layer a requirement comes from stops a licence obligation being argued as if it were a preference.

Data Best Practice puts the burden of proof on withholding. A dataset is presumed open, and any restriction has to be justified against a stated harm such as personal data, security or genuine commercial sensitivity, applied to the narrowest part of the dataset that carries the harm rather than to the whole file. Assessing an action plan against the guidance means checking that the presumption was applied, that the catalogue is discoverable, and that the commitments carry dates. The Data Sharing Infrastructure is the sector-level answer to discovery and exchange between parties who do not share systems, delivered incrementally rather than as a single switch-on.

Market-wide half-hourly settlement makes all of this concrete. It moves electricity settlement onto actual half-hourly consumption data, and its milestone ladder runs from central systems readiness through long migration windows for different meter types to full migration and then the switch to the new settlement timetable, at which point the settlement runs compress. Ofgem's final impact assessment estimated net consumer benefits of between 1.5 billion and 4.5 billion pounds by 2045. Digital twins and flexibility markets sit on the same data foundation, which is why sequencing matters: settlement-quality data first, then the applications that assume it.