Scotland’s Public-Sector AI Map Is Stored on Microsoft Cloud Outside Scotland

The Scottish Government has awarded a Finnish software company a £1 million contract to expand the country’s central AI-governance platform. Saidot says its service is hosted through Microsoft Azure in Ireland, its contract remains unpublished and the public register still contains only 34 records more than two years after officials said they already knew of more than 60 cases requiring inclusion.

Scotland’s official record of artificial-intelligence systems is not held on Scottish public infrastructure.

It operates from a commercial .com address and was developed by the Finnish company Saidot, which says its proprietary governance platform is hosted through Microsoft Azure in Ireland.

The public-facing Scottish AI Register currently displays 34 systems. It includes projects involving Social Security Scotland, the Scottish Children’s Reporter Administration, government communications, marine monitoring, environmental planning, pensions and the Emma Caldwell Inquiry. The website describes itself as the place where people can learn how AI is being used or developed across Scotland’s public sector. Its footer states: “Service developed by Saidot.”

Behind that public website sits something more extensive. Saidot says its wider commercial platform can record AI systems, models, agents, datasets, suppliers, owners, risks, controls and policies. The Scottish Government has said the register is also becoming a central location for monitoring data-science projects and providing public bodies with libraries of AI risks, policies and technical information. It is, in practical terms, an organised map of Scotland’s public-sector AI estate.

There is no published evidence that every benefit application, patient record or children’s case file processed by the systems listed on the register is copied into Saidot. The platform primarily holds governance information about those systems rather than becoming a central repository for their underlying operational records.

That does not make the information inconsequential. It identifies where AI is operating, which organisations and suppliers are responsible, what datasets and models are involved, which officials own the systems, what risks have been recorded and what controls have been adopted.

Scotland has placed that strategic record on software owned outside the country and cloud infrastructure controlled by Microsoft.

Scottish information held in Ireland

Saidot’s current data-processing agreement says its cloud services are hosted on Microsoft Azure and that daily automated backups are stored in Azure data centres in Ireland. It says all Saidot processing takes place in EU or European Economic Area data centres managed by Azure, while access to its services is logged through Azure Monitor.

Saidot acts as the data processor and its customer acts as controller. The standard agreement covers personal information belonging to authorised users, including government employees, consultants and contractors. Names, email addresses, telephone numbers, usernames, roles and authentication information can be processed, although customers are prohibited from entering special-category or sensitive personal information into the platform.

Microsoft is not the Scottish Government’s named contractor and there is no evidence that Microsoft owns Saidot. Its involvement is nevertheless structural. Saidot’s service is hosted on Azure, available through Microsoft’s commercial marketplace and integrated with Azure AI Foundry, Azure OpenAI, Azure Machine Learning and Microsoft identity and monitoring services. Saidot also supports Amazon Bedrock and external connections, so the product is not exclusively tied to Microsoft, but Azure supplies the cloud foundation used for its standard service.

The result is a two-layer private dependency. Scotland relies upon Saidot’s proprietary governance software, while Saidot relies upon Microsoft infrastructure to store and operate the service.

Why the two layers of dependency matter

Hosting the register in Ireland does not by itself make it unlawful or insecure. Public cloud services can provide resilience, security expertise and technical capacity that would be expensive for government to reproduce. The concern is that Scotland does not directly operate either the proprietary Saidot platform or the Microsoft infrastructure beneath it.

The arrangement creates a risk of vendor lock-in. Moving the register elsewhere could require Scotland to rebuild its data structures, identity systems, integrations and governance workflows. The signed contract and technical architecture have not been published, so the public cannot assess the cost or practical difficulty of replacing Saidot or Azure.

A major failure affecting Saidot or the Azure services on which it depends could temporarily make Scotland’s central register and governance platform unavailable. That would not necessarily stop the AI systems recorded within it. Public-sector AI could therefore continue operating while the central system intended to document its risks and controls was inaccessible. Saidot says its service uses encrypted backups and disaster-recovery measures, but the standards required under the Scottish contract remain unknown.

The dependence also crosses jurisdictions. Microsoft is an American company, while Saidot says the information is processed in Azure data centres in Ireland. US law can require American service providers to disclose information within their possession, custody or control regardless of where it is stored. That does not give US authorities direct access, and a legally valid demand would be required. It does mean that locating a server in Ireland does not place the information beyond every other legal jurisdiction.

Scotland’s direct contractual relationship is with Saidot, while Saidot depends upon Microsoft and other subprocessors. Saidot may remain contractually liable for supplier failures, but liability after an incident does not restore an unavailable service or provide Scotland with the technical ability to repair the underlying infrastructure. Without the signed contract, the public cannot determine what continuity, migration, encryption, audit or supplier-failure protections were obtained through the £1 million award.

A general consultation was not consent to this arrangement

The Scottish Government consulted on the broad direction of its AI strategy between February and May 2020. It received more than 80 responses covering issues including ethics, training, public dialogue and people-centred development. The consultation asked about Scotland’s overall vision and approach to AI. It did not ask whether Scotland’s central AI-governance records should be placed on a Finnish company’s proprietary platform, hosted through Microsoft Azure outside Scotland or operated from a commercial domain.

That consultation cannot reasonably be presented as public approval of the arrangement that followed.

Public bodies do not require individual consent for every lawful administrative processing activity. They can rely upon statutory functions and public-task grounds. The absence here is democratic rather than contractual: Scotland’s people were not offered a specific choice over who should own the technology, where the information should be hosted or whether national capacity should be developed instead.

The platform was adopted through policy and procurement decisions made inside government. Its use was then mandated across the public sector on a non-statutory basis from 1 April 2024.

A young Finnish company became the incumbent

Saidot was established in Finland in 2018. Founder Meeri Haataja brought substantial personal experience in AI policy and governance, including an affiliation with Harvard University’s Berkman Klein Center during 2019–20. That personal background was not the same as an established corporate record. Saidot’s first widely documented AI-register projects were launched for Helsinki and Amsterdam in September 2020, around a year before it entered Scotland’s CivTech process.

Scotland’s AI strategy had been published in March 2021 under Nicola Sturgeon’s government. The strategy committed Scotland to creating a register of trusted algorithms used in the public sector and to improving public-sector adoption through CivTech and innovative procurement.

Saidot entered the resulting CivTech process that year. Eleven tenders were received, including six from small or medium-sized businesses. Saidot won the contract, concluded in March 2022, with a published value of £199,551.67.

The ten unsuccessful bidders have not been named. The government has not published their countries of registration, experience, prices, technical proposals or scores. It is therefore impossible to establish whether Scottish companies competed, who the five non-SME bidders were, whether any competitor had a longer relevant track record or how Saidot’s corporate history was weighed during the evaluation.

There is no evidence that Nicola Sturgeon personally selected Saidot, instructed officials to award the contract or had direct discussions with Haataja. The policy was created under her administration; the supplier was selected through a civil-service procurement process whose detailed records remain hidden.

Material errors in the public award record

The official 2022 contract notice contains information that is demonstrably wrong.

It gives Saidot’s address as Tekniikantie 2 in Espoo and lists a Finnish +358 telephone number, but identifies the company’s country as the United States. It records Saidot as not being an SME and states that all 11 tenders came from countries outside the European Union.

Saidot was a Finnish start-up. Finland was an EU member state. The Scottish Government itself later described the company as a “Finnish start-up”.

The inaccurate information appears in the government’s published award record. The underlying application has not been released, so it has not been established whether the inaccurate classification originated in Saidot’s tender, was introduced by officials or resulted from an error when the notice was entered into the procurement system.

It would be premature to accuse Saidot of providing false information. It is established, however, that the Scottish Government’s official transparency record contains materially inaccurate information about the company that won.

The error also makes the published bidder geography unreliable. Scotland cannot use the notice to determine whether Finnish, Scottish, British, American or other European companies competed.

A procurement intended to create public confidence in AI began with a contract notice that misidentified the winning company’s country and size.

From experimental supplier to £1 million contract

Saidot did not simply build the first register and leave.

A Scottish Government freedom-of-information response published in 2024 said the company had “successfully retained” the work after designing the first iteration through CivTech. The government reported a total CivTech challenge cost of £236,989.17 and a further £97,320 paid by that point to manage, develop and maintain the register and its infrastructure.

By building the original platform, Saidot acquired knowledge of Scotland’s requirements, users, data structure and internal governance processes. That created an incumbent advantage for later work, even without any impropriety. Replacing a supplier becomes more difficult once its proprietary software has been embedded in government operations.

On 17 June 2026, under John Swinney’s current administration, the Scottish Government awarded Saidot a new contract worth £1 million excluding VAT. The contract covers the AI register and governance platform, hosting, maintenance, support, development, onboarding, training, public consultation and stakeholder engagement. Five tenders were received. Quality carried 80 per cent of the evaluation and price 20 per cent. Saidot was the only SME and the only EU bidder recorded in the notice.

Modern Scot could find no Scottish Government news release announcing the £1 million award. The decision became publicly visible through a statutory procurement notice rather than a ministerial announcement explaining the choice of supplier, hosting arrangements or long-term implications for Scottish technical capacity.

The new notice corrects the old classification and identifies Saidot as a Finnish SME. It does not identify the four unsuccessful bidders, publish the contract documents, disclose the duration or name the evaluation panel, approving officer or signatory.

There is no evidence that Swinney personally selected Saidot. The register began under Sturgeon and was expanded under Swinney. Political responsibility for continuing and enlarging the arrangement now rests with his government, but the public record does not identify who evaluated, approved or signed the award.

Saidot remains founder-led and received €1.5 million in external investment from Icelandic venture-capital firm Crowberry Capital and Finnish investment company Ventic in 2023, with a further €250,000 in programme funding from Business Finland. Exact shareholdings and voting rights have not been published.

Finnish business-information records show that Saidot had 12 employees and turnover of €338,000 in 2024, alongside an operating loss of €978,000. Those figures do not establish that the company is incapable of performing the work, but they show the scale of the new Scottish award in relation to the supplier’s latest publicly available accounts. The contract’s duration and annual payment profile remain unknown.

Sixty-plus systems were already known

The apparent gap in the register presents a separate transparency problem.

In June 2024, Scottish Government Data Standards Team Leader Shona Nicol told the Open Government Partnership Steering Group that officials were working to incorporate around 60 AI use cases already known to the team.

A formal Scottish Government progress report was more explicit:

“Work is now on-going to get the 60 plus use cases which we are already aware of, on to the register.”

The government was not waiting to discover 60 possible systems. Officials said they already knew about them.

As of 23 July 2026, more than two years later, the public register contains 34 entries. That is at least 26 fewer than the minimum number identified in 2024, and approximately 57 per cent of the stated total.

Some projects may have been cancelled, merged, reclassified or retained only within private governance records. The government has not published a reconciliation. It has not listed the missing cases, identified bodies that have failed to comply or explained how many systems are recorded internally but withheld from the public-facing register.

A May 2026 freedom-of-information response said Scottish Government bodies must record AI use that is not centrally delivered, including projects still under development. It also confirmed that no other central register exists.

That leaves Scotland dependent on a register that the public cannot verify is complete.

The Scottish capacity that was not retained

The original decision was made at a point when Scotland could still have chosen a different direction.

Government could have developed an internally owned platform, commissioned open-source software, created a consortium involving Scottish universities and technology companies, divided the work into smaller specialist contracts or required the successful supplier to transfer skills and technical capacity into Scotland.

It could have used the project to establish a permanent Scottish team capable of maintaining the register, auditing public-sector AI and controlling the infrastructure on which that work depends.

Scottish procurement rules would not have allowed officials simply to exclude Saidot because it was foreign. Contracts must be awarded fairly and without unlawful discrimination. The government did, however, have lawful ways to structure the work around public ownership, open standards, skills transfer, economic benefit and SME participation.