UK AI Adoption Hits 30%: Why Most Businesses Are Stuck at the Starting Line
AI is everywhere in the headlines, from HSBC’s reported plans to reshape its UK wealth business around it to a new wave of AI-discovered cyber threats. Yet the latest official figures on AI adoption show most UK businesses are still not using it, and many that are have barely scratched the surface. Here is what the data really says and how to turn AI into measurable results. What the latest data shows The Office for National Statistics‘ latest Business Insights and Conditions Survey, published on 8 October 2026, found that 30% of UK businesses were using at least one AI technology in September 2026. That level of AI adoption is up from 9% when the question was first asked in September 2023, but broadly flat since June. Size makes a big difference to AI adoption. Among businesses with 10 or more employees, adoption reached 38%. Around half of the largest firms now use AI, compared with just 29% of businesses with fewer than 10 staff. By sector, AI adoption is highest in the information and communication industry, where around 60% of businesses use AI. What businesses are using is telling. Among firms with 10 or more employees, the most common tools were text generation using large language models, at 21%, and visual content creation, at 19%. In other words, much of today’s adoption is still about chat assistants and content tools rather than AI built into core operations. Why do AI adoption surveys give different numbers? If you have seen higher figures elsewhere, you are not imagining it. The British Chambers of Commerce, working with Atos, reported in March 2026 that 54% of the SMEs it surveyed were actively adopting AI, up from 35% a year earlier. The difference comes down to who is asked and how the question is framed. The ONS survey is a large, weighted sample of UK businesses asked about specific AI technologies, while other surveys often capture firms that are exploring or experimenting. Both point the same way: AI adoption is rising fast, but unevenly. The real problem: AI adoption without integration The bigger gap is not whether businesses use AI but how deeply. The Department for Science, Innovation and Technology’s UK Business Data Survey found that only 21% of AI-using businesses said their AI tools were integrated into existing platforms such as Microsoft 365, CRM or finance systems, rising to 57% among large businesses. Governance is thin too: only 17% of AI-using businesses had any AI policy, and just 5% had a formal written one. Security is lagging as well. The government’s Cyber Security Breaches Survey 2025/2026 found that only 24% of businesses using AI had any cyber security practices in place to manage the associated risks. Is AI taking jobs? For most UK businesses, not yet. The ONS found that just 6% of AI-using firms with 10 or more employees reported a lower headcount as a result, and fewer than 1% reported an increase. The BCC found that 95% of SMEs using AI had seen no impact on workforce size over the past year. But the work itself is changing. Administrative and clerical roles were the most affected, cited by 38% of AI-using firms, up nine percentage points since December 2025. Creative and design roles came next at 24%. And at the large-company end, change can be sharp. The Financial Times reported this month that HSBC plans to cut around half of the management and specialist roles in its UK wealth business, and up to around 70% of its financial advisers, as it puts AI at the centre of how it serves clients. HSBC has said it is evolving to offer more digitally enabled products and journeys, and reports its third-quarter results on 27 October. 6 ways to move beyond the pilot 1. Start with a business problem, not a tool Pick two or three processes where time, cost or errors genuinely hurt, such as invoice handling, customer queries or reporting. Define what success looks like in numbers before you choose any technology. 2. Get your data ready AI is only as good as the information it can reach. Clean up and connect the data behind your chosen processes, and make sure access is controlled so the right people and systems see the right information. 3. Build AI into the systems people already use The biggest returns come when AI works inside your existing workflows, in your email, CRM, finance or service desk tools, rather than in a separate window someone has to remember to open. 4. Write an AI policy, then keep it short With only 17% of AI-using businesses having any policy, a clear one-page guide on approved tools, what data can be shared and who is accountable will already put you ahead of most of the market. 5. Secure it from day one Assess the cyber risks of any AI tool before you deploy it, not afterwards. Control access, log usage and make sure sensitive data is not leaving your organisation through unapproved services. 6. Invest in people as well as platforms The roles most affected by AI are changing, not simply disappearing. Train teams to use AI well, redesign roles around the new workflows and bring staff into the process early. AI adoption sticks when the people doing the work trust the tools. The bottom line Three in ten UK businesses have started on AI adoption, but far fewer have made it part of how they actually work. The gap between experimenting and transforming is where the real value sits. Firms that close it, with clear goals, connected data, sensible governance, and well-supported teams, will set the pace for everyone else. Ready to move your AI from experiment to results? Cloud Technology Hub helps UK and international organisations identify high-value AI use cases, prepare their data and integrate AI securely into the systems their teams already use. Speak to our team at info@technohub.cloud. TALK Leave a comment and Read More Here
Microsoft Walks Away From Britain’s Largest AI Data Centre: What the Grid Crunch Means for Your AI and Cloud Plans
The UK wants to be an AI superpower, but last week it was reminded that AI runs on electricity. Microsoft has pulled out of Nscale’s planned flagship AI data centre in Essex after it emerged the site would not get the grid power it needs for years. Here is what happened, why it matters, and what UK businesses should do about it. What happened Microsoft has ended its agreement to take computing capacity at Nscale’s planned AI data centre in Loughton, Essex, which was set to be the largest in the UK. Reuters reported the termination on 18 October 2026. According to reporting by the Guardian and others, the local network operator, UK Power Networks, indicated that adequate grid power would not reach the site until the early to mid-2030s, long after its planned opening in early 2027. Nscale announced the project in 2025 as a 50MW campus, expandable to 90MW, with 23,040 Nvidia GB300 chips earmarked for Microsoft’s Azure cloud. It was part of Microsoft’s £22 billion UK investment and was hailed at the time as a boost to Britain’s AI ambitions. Both companies have stressed that the wider relationship is intact. Microsoft described the project as a relatively small piece of its portfolio and said it remained on track to meet its UK commitments. Nscale said it remained committed to the site and the UK, and is exploring alternative power sources. The real story: why the UK cannot power every AI data centre Loughton is not a one-off AI data centre problem. It is the most visible example of a problem the energy regulator has been warning about for more than a year. In July 2026, Ofgem reported that contracted demand connection offers had jumped from 41GW to 125GW between November 2024 and June 2025, driven largely by data centre projects. Around 73GW of data centre demand was referenced in its consultation on reform. Much of that queue is speculative. Projects can secure a place in line at very little cost, which blocks capacity for schemes that are actually ready to build. Ofgem has proposed a Data Centre Commitment Fee and new progress milestones that developers would have to meet to keep their place. Its consultation closed in September and a decision is awaited. The government is also trying to steer AI data centre capacity towards designated AI Growth Zones, with plans to reserve and reallocate grid capacity for strategically important projects and a Connections Accelerator Service to help developers. The Loughton decision shows how much is riding on those reforms working, and working quickly. Why this matters to businesses that will never build an AI data centre It is tempting to see this as a story for energy companies and hyperscalers. It is not. Every UK organisation planning to use AI, or simply to keep growing its cloud footprint, depends on the same infrastructure. 5 practical steps for your AI and cloud strategy 1. Right-size your AI ambitions Not every task needs the largest model or the most powerful chips. Smaller, efficient models can handle many business tasks such as summarising, classifying and drafting at a fraction of the compute cost. Match the tool to the job. 2. Decide where your data must live Be clear about which data genuinely has to stay in the UK and which can be processed elsewhere. That decision shapes which cloud regions and AI services you can use, and how much flexibility you keep if UK capacity is tight. 3. Keep a hybrid option open For predictable or sensitive workloads, on-premise or private infrastructure can offer cost certainty and control, while the public cloud handles peaks and experimentation. A hybrid design also gives you somewhere to run critical services if a single cloud region fails. 4. Ask your providers about capacity, not just features When you sign or renew cloud and AI contracts, ask which AI data centre or region behind your service physically sits in, what happens if demand outstrips supply, and what service levels apply. Contracted capacity is not the same as capacity that is powered up and running. 5. Measure the energy and cost of your workloads Track how much compute your AI and cloud services consume, and what they cost. Efficiency is no longer only a sustainability goal. In a power-constrained market, it is a competitive advantage. The bottom line The UK’s AI ambitions now depend as much on cables, substations and connection queues as on chips and talent. Businesses cannot fix the grid, but they can plan around it. The organisations that design efficient, flexible and resilient AI and cloud strategies today will be best placed to grow, whatever happens to the next headline AI data centre. Build an AI and cloud strategy that does not depend on one headline project Cloud Technology Hub designs hybrid and multi-cloud infrastructure across Azure, AWS and on-premise environments, with on-premise options through our partner HPE. Email info@technohub.cloud to talk through a strategy that fits your workloads, budget and data residency needs. Speak to our team at info@technohub.cloud. TALK Leave a comment and Read More Here
Cyber Security and Resilience Bill: What UK Businesses and IT Providers Must Do Before It Becomes Law
The Cyber Security and Resilience Bill, the UK’s biggest overhaul of cyber security law in almost a decade, reaches the House of Lords report stage today, 26 October 2026. For the first time, managed IT providers and data centres will be regulated, incidents will need to be reported within 24 hours, and fines could reach 4% of global turnover. Here is what the Bill does and how to prepare. Where the Bill stands today The Cyber Security and Resilience (Network and Information Systems) Bill was introduced to Parliament on 12 November 2025. It completed its Commons stages in June 2026 after being carried over into the new parliamentary session, and was examined in Grand Committee in the House of Lords in September. Report stage, the first point at which the whole House of Lords can vote on amendments, is scheduled for today, 26 October 2026. After report stage, the Cyber Security and Resilience Bill still needs a Lords third reading and agreement between both Houses before Royal Assent. Royal Assent is widely expected around the end of 2026, although some trackers suggest it could slip into 2027. Many of the detailed obligations will then be switched on through secondary legislation. That gives businesses a short but valuable window to prepare. Why the government is acting now The Cyber Security and Resilience Bill updates the Network and Information Systems Regulations 2018, which were written for a very different threat landscape. The government’s own Cyber Security Breaches Survey 2025/2026, published in April, found that 43% of UK businesses, an estimated 612,000 organisations, identified a cyber breach or attack in the previous 12 months. The figure rises to 65% of medium-sized businesses and 69% of large ones. The cost of getting it wrong has also become impossible to ignore. The attack on Jaguar Land Rover that began in August 2025 was estimated by the Cyber Monitoring Centre to have cost the UK economy around £1.9 billion, making it the most expensive cyber incident in British history. This month, TFG London, owner of Hobbs, Whistles and Phase Eight, disclosed its own cyber incident. What the Cyber Security and Resilience Bill changes IT providers come into scope The Bill creates a new category of regulated business, the relevant managed service provider. Medium and large firms that manage IT, networks or security on behalf of other organisations will need to put appropriate and proportionate security measures in place, register with the regulator and report significant incidents. Micro and small providers, with fewer than 50 staff and turnover of up to €10 million, are excluded from the definition. Data centres become essential services Data centres above set thresholds, a rated IT load of 1MW for standalone facilities and 10MW for enterprise data centres, will be treated as essential services and subject to the full set of NIS obligations. Critical suppliers can be designated Regulators will be able to designate suppliers whose disruption could cause serious harm to essential services, bringing key parts of the supply chain under the rules even where they are not operators themselves. Faster, two-stage incident reporting In-scope organisations will need to send an initial notification of a significant incident within 24 hours, followed by a full report within 72 hours. Data centres and managed service providers will also need to notify customers who are likely to be adversely affected. Tougher penalties The standard maximum penalty is the greater of £10 million or 2% of worldwide turnover. For the most serious failures, including security breaches and failures to report incidents, it rises to the greater of £17 million or 4% of worldwide turnover. Daily penalties for continuing non-compliance are also proposed. New powers over risky suppliers Government amendments tabled during the Lords stages would give ministers a new power to direct essential and digital service providers to stop buying from, restrict or remove technology supplied by vendors judged to pose a national security risk. Does it affect you if you are not in scope? Almost certainly. Even if your business is too small or in the wrong sector to be regulated directly by the Cyber Security and Resilience Bill, your customers, IT provider or data centre may be. Regulated organisations will push security and reporting requirements down through their contracts, and suppliers that cannot show good practice risk losing work. For many UK SMEs, the Bill will arrive first as a new set of questions in a tender or contract renewal. 6 steps to prepare for the Cyber Security and Resilience Bill The bottom line The Cyber Security and Resilience Bill turns cyber security from good practice into a legal duty for a much wider group of UK businesses. The organisations that use the next few months to get their visibility, reporting and supply chain in order will find compliance straightforward. Those that wait for Royal Assent will be playing catch-up under a far tougher regime. Find out where you stand before the rules arrive Cloud Technology Hub helps UK organisations assess their readiness for the Cyber Security and Resilience Bill, from supplier mapping and centralised logging to incident response planning, backed by our technology partners Sophos and JumpCloud. Speak to our team at info@technohub.cloud. TALK Leave a comment and Read More Here
The 8-Hour Google Cloud Outage in London: 5 Hard Lessons on Cloud Concentration Risk for UK Businesses
Google Cloud Outage: On Tuesday 20 October, a power failure at a single Google Cloud facility in London froze Revolut cards at supermarket tills and disrupted banking, parcel delivery, property search and even court hearings across the UK. MPs now want answers. Here is what happened in the Google Cloud outage and what every UK organisation running on the cloud should learn from it. What happened The Google Cloud outage began just after 07:00 BST on 20 October 2026, when a power event hit europe-west2-b, one of three availability zones in Google Cloud’s London region. Google said the disruption occurred at a third-party facility serving the region. Its incident record ran for seven hours and 52 minutes before the incident was closed at around 15:00 BST. The knock-on effects of the Google Cloud outage were wide-ranging. Revolut reported disruption to card payments, ATM withdrawals and transfers, while Lloyds and HSBC customers reported problems with online services. Royal Mail, DPD, Rightmove, Screwfix and NHS England were also affected, as was the video platform used for remote court hearings in England and Wales. Revolut said its customers’ money and data remained safe throughout. For much of the morning, Google’s only suggested workaround was for affected customers to move their workloads to another available location, if feasible. For businesses that had never planned for that, it was not a realistic option at 08:00 on a Tuesday. Why regulators are paying close attention to the Google Cloud outage Timing made the Google Cloud outage a political story as well as a technical one. On 10 July 2026, HM Treasury designated the UK or EMEA arms of Google Cloud, Amazon Web Services, Microsoft and Oracle as Critical Third Parties to the financial sector. Joint oversight by the Bank of England, the PRA and the FCA began on 13 July. Under the regime, designated providers must report serious outages to the FCA and the Bank of England. Within hours of the Google Cloud outage, Treasury Committee chair Meg Hillier MP wrote to the Governor of the Bank of England and the Chief Executive of the FCA, asking how they would respond, how large the disruption was and what financial harm had been caused. The European Banking Authority also contacted Google to assess the impact on EU financial firms. The European Banking Authority made a point that applies to every regulated business in the UK too: designating a provider as critical does not transfer responsibility for managing incidents away from the firms that use it. Oversight of the hyperscalers is growing, but accountability for your customers stays with you. 5 lessons from the Google Cloud outage for UK businesses 1. An availability zone is not a backup plan Cloud regions are split into zones so that a failure in one building does not take down the rest. In practice, many applications depend on regional services, shared networking or a single zone without anyone realising. When europe-west2-b lost power, errors spread across the wider London region. If your critical services cannot fail over to a different region, you are more exposed than your architecture diagram suggests. 2. Concentration risk is shared, even when your suppliers are different Revolut, Lloyds and HSBC are separate businesses with separate technology teams, yet their customers felt the same failure on the same morning. The same is true further down the supply chain. Your payment provider, your courier, your CRM and your bank may all rely on the same handful of data centres. Map those dependencies, not just your own. 3. Know your impact tolerances, and test them UK financial firms are already required to set impact tolerances for their important business services, meaning the maximum disruption they can withstand before customers suffer intolerable harm. Every business can borrow that discipline. Decide how long each critical service can be down, then test whether your current setup can actually meet that limit during a regional cloud failure. 4. Do not rely on your provider’s status page During major incidents, status dashboards often lag behind what customers are actually experiencing. Independent monitoring, centralised logging and alerting across every environment you run tell you what is really happening, so you can switch to a fallback, warn customers and make decisions in minutes rather than hours. 5. Rehearse failover before you need it A failover plan that has never been tested is a hope, not a plan. Run regular exercises that simulate the loss of a zone or a whole region, measure how long recovery takes, and fix what breaks. For some services, a multi-cloud or hybrid design that keeps a critical path running on a second provider or on-premise infrastructure will be worth the extra cost. What happens next after the Google Cloud outage Regulators and MPs are still gathering information, and Google’s full incident report is awaited. Whatever the outcome of the inquiries into the Google Cloud outage, the direction is clear. UK regulators are building the tools to supervise the largest cloud providers directly, and businesses that depend on them will be expected to show they have planned for failure. The organisations that recover fastest next time will be the ones that treat resilience as a design choice today. How would your business cope if your cloud region went dark? Cloud Technology Hub designs and runs resilient infrastructure across Azure, AWS and on-premise environments, with centralised logging and monitoring that does not depend on any single provider. Email info@technohub.cloud to book a cloud resilience review. Speak to our team at info@technohub.cloud. TALK Leave a comment and Read More Here
PHP2Shell: 7 Steps Every UK Business Must Take After the Worst PHP Flaw in Years
Two critical flaws in PHP, the language behind most of the web, forced governments and companies to pull websites offline last week. The NCSC’s advice is blunt: patch immediately, or take the system offline until you can. Here is what happened, who is exposed, and exactly what to do next. What happened On 20 October 2026, details of two critical vulnerabilities in PHP leaked online ahead of their planned disclosure. The PHP project released emergency fixes the following day, 21 October, and by then organisations across Europe, the US and the UK were already taking websites offline as a precaution. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are known collectively as PHP2Shell. Both carry a CVSS v4.0 score of 9.2 out of 10, and both can allow an attacker to run code on a web server without logging in. In plain terms, a single crafted web request could hand someone control of the server behind your website. The scale of the reaction to PHP2Shell was unusual. Downing Street warned that some government services might be temporarily unavailable, while confirming that no large public-facing critical services had been affected. Edinburgh council and the BBC were among the UK bodies that took pages offline. Cloudflare’s chief executive, Matthew Prince, said the company had seen millions of attempts to exploit the flaws. BY THE NUMBERS Why this one is different Two things set PHP2Shell apart from the usual monthly patch cycle. First, the reach. PHP runs on roughly seven in ten websites, according to Kaspersky, and the PHP developers have said that every installation serving web requests is potentially affected, whether it runs on PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. That includes WordPress sites, customer portals, intranets and line-of-business applications that most boards would not think of as “PHP” at all. Second, the way the flaws were found. Researchers at Calif and Wiz used frontier AI models to uncover bugs that had sat undetected in PHP for more than a decade. Wiz described the findings as among the most severe ever discovered in PHP. The lesson for every business is that AI is now shortening the gap between a hidden weakness and a working exploit, and attackers have access to the same tools. PHP2Shell exploitation is already under way. Security firm watchTowr reported attacks in the wild on the day the patches shipped, and Amazon Threat Intelligence identified an exploitation attempt dating back to 17 October, four days before public disclosure. If your servers were exposed during that window, patching alone is not enough. You also need to check whether anyone got in. 7 steps to protect your business from PHP2Shell 1. Find every system that runs PHP Start with a complete inventory, because PHP2Shell reaches far beyond your public website. Your website is the obvious one, but also check intranets, booking and payment pages, HR and ticketing tools, marketing microsites and any third-party software with a PHP dependency. The Dutch NCSC has published an inventory of software products with PHP dependencies on GitHub, which is a useful starting checklist. 2. Patch to a fixed version immediately The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP core developer Gina Peter Banyard has warned that no workaround fully blocks these attacks, and that applying the official patches is the only permanent fix. If you run PHP in containers, rebuild your images so they pull the new base image rather than a cached one. 3. If you are on PHP 8.1 or older, treat it as an emergency PHP 8.1 and earlier versions no longer receive updates from the PHP project, so there is no official fix for them. Your options are an extended-support or Linux distribution backport, an emergency configuration mitigation while you upgrade, or taking the system offline. Running unsupported PHP was already a risk. After PHP2Shell, it is an open door. 4. Get written confirmation from your host or IT provider If your website sits on shared hosting or is managed by an agency or managed service provider, do not assume it has been patched. Ask for written confirmation of the PHP version now running on every server that hosts your services, and the date the update was applied. 5. Look for signs of compromise since 17 October Review web server and application logs for unusual requests, including any with “php2shell” in the user-agent string, which watchTowr saw in early attack attempts. Check for new administrator accounts, unexpected files in web directories and unfamiliar outbound connections from your servers. If anything looks wrong, isolate the system and bring in incident response support. The NCSC maintains a list of assured cyber incident response providers. 6. Use a web application firewall as a stopgap, not a fix Cloudflare and other providers deployed firewall rules to block known exploitation patterns before the patches were released. These buy time, but attackers adapt quickly. A firewall rule should sit alongside patching, never replace it. 7. Prepare for more of this The NCSC has urged organisations to prepare for a “vulnerability patch wave” as AI-assisted research uncovers older flaws faster. That means knowing what software you run, having an agreed process to patch critical issues within hours rather than weeks, and testing that your backups and recovery plans actually work. What the NCSC is telling UK organisations about PHP2Shell The UK’s National Cyber Security Centre has encouraged organisations to take immediate action and to follow vendor guidance. Where immediate remediation is not feasible, its advice is to consider taking the affected system offline until it can be fully mitigated. That is unusually direct language, and boards should treat it as such. The bigger picture PHP2Shell arrived in the same week that a power failure at a Google Cloud facility in London disrupted UK banking apps, while UK retailers were still recovering from cyber attacks. Taken together, these events show how much of the UK economy rests on shared software and shared infrastructure that most businesses never see. Resilience now depends less
