GRC

PAC chair warns of ‘worrying lack of urgency’ on Whitehall legacy IT

The Public Accounts Committee chair says Whitehall is too slow to fix legacy IT that creates cyber risk, while it chases AI without the skills to match.

Stylised server racks with the headline Whitehall too slow on legacy IT risk

The chair of the Commons Public Accounts Committee has accused government of moving too slowly on ageing IT that leaves departments open to cyber attack, even as it races to adopt AI. The warning comes in his second annual report, and it offers a governance lesson that applies well beyond Whitehall.

What happened

On 14 October 2026 Sir Geoffrey Clifton-Brown, the Conservative MP who leads the Commons Public Accounts Committee (PAC), published his second annual report as its chair. Published as HC 629, it was ordered to be printed on 10 September.

The report is built around five themes. The first, getting ready for a more volatile future, puts cyber security alongside defence and health. In that section the chair writes that government is showing a “worrying lack of urgency” about its long-running legacy IT problem. He says these ageing systems carry significant cyber risk and stop departments benefiting from newer technology.

The report’s main worry is that government is adopting AI faster than it is building the skills to handle it. Clifton-Brown compares AI’s arrival in government to a tsunami and says he doubts Whitehall is prepared for the scale of the change. Ministers have announced reforms, he notes, but have not shown how they will close the digital skills gap, or when.

The detail

The cyber security section is short, but its argument is clear. Paragraph 7 says hostile states and criminal groups keep finding new and more advanced ways to attack government systems as AI and digital technology develop.

The workforce figures explain why the PAC is sceptical. Only around 6% of the civil service sits in digital and data jobs, and senior posts are hardest to fill. Government wants that share to reach 10%. The report says that will need sustained recruitment, training and retention of specialists. The chair also warns that frequent machinery of government changes, most recently setting up the new Department for Business, Innovation, Science and Trade (BIST), could slow things down further.

Legacy technology comes up again in the report’s section on fraud. The committee estimates that fraud and error cost the taxpayer between £55 billion and £81 billion a year. It names legacy IT, weak digital capability and leadership, and the difficulty of sharing data between public bodies as obstacles to reducing those losses. The Department for Work and Pensions alone estimated £9.9 billion of benefit overpayments through fraud and error in 2025–26.

Critical infrastructure gets its own chapter. The report contrasts two modernisation programmes. National Savings & Investments’ Business Transformation Programme was estimated in December 2024 to cost £3 billion, £1.3 billion more than in 2020, and has been rated red since 2022–23. The Bank of England, by contrast, delivered its Real-Time Gross Settlement renewal for £431 million in April 2025. On water, the chair notes that cyber attacks on water infrastructure appear in the 2026 National Risk Register and says government must take the issue seriously.

Key figures from the Public Accounts Committee chair's 2026 annual report on digital skills, fraud and IT programmes

Why it matters for UK organisations

A committee report on Whitehall does not create legal duties for private companies. It still matters to them. Government departments are some of the biggest buyers of IT and managed services in the country, and they hold large amounts of citizen data that suppliers often handle on their behalf. If central government struggles to retire unsupported systems, the risk spreads to every integrator, outsourcer and SaaS provider connected to those systems.

The report also echoes a theme the Home Secretary raised in Parliament on 12 October: the Cyber Security and Resilience Bill is meant to strengthen the defences of essential services. As that bill makes its way through Parliament, legacy estates will be hard to defend to regulators. An organisation cannot credibly say it manages supply chain risk if its own core platforms are past end of support.

The skills point applies everywhere too. Many mid-sized UK firms face the same shortage of senior specialists, which puts more weight on governance: deciding what matters, funding it and seeing it through.

Expert view

In my experience, legacy IT is rarely a technology problem. It is an ownership problem. When we test large estates, the most serious findings are almost always on systems that nobody wants to fund, nobody fully understands and nobody has authority to switch off. They often sit on flat networks with over-privileged service accounts, because changing anything feels too risky. Attackers know this, and they go after the quiet corners first.

What I find striking is the PAC’s framing. It does not treat legacy IT as a niche technical debt line. It ties it to cyber risk, fraud losses and the ability to use AI safely, which is exactly how boards should see it. Bringing AI tooling into an environment you cannot inventory or patch does not modernise anything. It adds another layer of complexity on top of foundations you already know are weak.

The contrast between NS&I and the Bank of England’s RTGS programme is a useful governance case study. The lessons the committee draws, about leadership, clarity of goals, flexibility and starting modernisation in good time, are not security controls, but all of them decide whether security controls ever get funded and delivered. It is worth remembering this is a value for money document, not a threat assessment: its cyber passages are brief, and its value lies in the accountability signal.

What to do now

  1. Build an honest legacy register. List every system that is end of life, unsupported or impossible to patch, with a named business owner, the data it holds and what it connects to. Cyber Essentials already requires unsupported software to be removed or isolated, so treat any exceptions as formal, time-limited risk acceptances signed off at board level.
  2. Isolate what you cannot retire. Put legacy platforms in their own network segments, allow only the traffic they actually need, and keep them away from direct internet exposure. This lines up with the Cyber Essentials firewall and secure configuration controls.
  3. Tighten access around old systems. Remove standing administrative rights, rotate shared and service account credentials, and require multi-factor authentication on the jump hosts and portals that front legacy kit.
  4. Govern AI adoption against your foundations. Before connecting AI tools to internal data, confirm you can inventory, patch and log the systems involved. If you cannot, fix that first.
  5. Fund modernisation as risk reduction. Show the board how retiring legacy IT cuts cyber, fraud and operational risk, and track delivery with clear milestones rather than open-ended programmes.
  6. Check your suppliers. Ask key providers how they handle unsupported technology in services they run for you.

Bottom line

Parliament’s spending watchdog has told government plainly that ageing IT is a cyber security risk it is not addressing fast enough, and that chasing AI without the skills or foundations to support it compounds the problem. For any UK organisation, the message is to retire or ring-fence legacy systems, own the risk at board level, and sort out the basics before adding new technology on top.

Sources

Related Posts