The Missing Clutch

On 7 April 2026, two things happened simultaneously on the Isle of Man.

The Tynwald chamber voted to pass the Foundations (Amendment) Bill 2025 -- the legislative backbone of the Island's Data Asset Foundation initiative, a genuinely world-first attempt to treat data as a registerable, governable capital asset with legal standing equivalent to land or securities.

On the same day, Digital Isle of Man announced the sixteen finalists of the 2026 Innovation Challenge, a cohort of global health-tech vendors selected to work directly inside the Island's health and social care ecosystem over a ten-week contextualisation period, with a Finale Day scheduled for 25 June at the Comis Hotel.

Two announcements. Same day. Zero acknowledgement that one creates a problem for the other.

On 6 May 2026, Digital Isle of Man Board Chair Phil Adcock published a piece on the agency's website titled "The Engine and the Handbrake." The central argument -- that AI capability is racing ahead while organisational readiness lags behind -- is coherent and well-evidenced. The BCG data cited is real. The Federal Reserve figures are accurate. The framing is compelling.

But the metaphor has a mechanical problem Digital Isle of Man hasn't addressed publicly: you can have a powerful engine and a well-designed handbrake, but if the clutch isn't fitted, the car isn't going anywhere. And right now, the clutch is missing.

The Foundations (Amendment) Bill 2025 passed Tynwald on 7 April. It has not yet received Royal Assent from the Lieutenant Governor. It has not been promulgated. Until both conditions are met, it remains a Bill -- not an Act. It has no legal force.

Beyond Royal Assent, the secondary legislation that will define how Data Asset Foundations actually operate in practice -- the rules of engagement for registration, governance standards, rights expression, and the Data Asset Register itself -- has not yet been drafted. The public consultation on the DAR closed on 7 May 2026. The framework is not expected to be fully operational until late 2026 at the earliest.

This is not a criticism of the legislative process. Careful lawmaking takes time, and the DAF initiative is ambitious enough to warrant it. But it does mean that on the day Digital Isle of Man announced sixteen health-tech vendors would begin working inside Manx health infrastructure, the governance framework designed to protect that data had no legal existence.

Foundations (Amendment) Bill 2025 passes Tynwald. Same day: sixteen Innovation Challenge finalists announced. Ten-week contextualisation begins immediately. Vendors start working inside Manx health infrastructure under existing contract arrangements -- the same contract-led governance model that, as we will see, Digital Isle of Man's own analysis identifies as no longer sufficient.

Digital Isle of Man publishes a response to the UK Biobank breach, in which half a million British citizens' medical records appeared for sale on a Chinese consumer marketplace. The piece is well-argued. The asset-level governance analysis is sound. The headline makes the case explicit.

Agreed. It is. But the DAF doesn't exist yet. And the Innovation Challenge vendors are already in the building.

DAR public consultation closes. Bill still awaiting Royal Assent. Secondary legislation unwritten. Framework operational late 2026 at earliest. Finale Day -- when vendors will have completed their ten weeks inside Manx health infrastructure -- is 25 June 2026. Three months before the framework governing that data is expected to exist.

An AI research assistant was tasked with conducting an open-source intelligence sweep of the sixteen Innovation Challenge finalists: DNS lookups, WHOIS records, SSL certificate transparency logs, published sub-processor lists, privacy policies, data processing agreements, and Companies House filings. Using AI tools to investigate the data governance posture of AI-enabled health-tech vendors seemed, under the circumstances, appropriate.

The findings are not surprising. They are simply documented.

Of the sixteen finalists, not one operates on sovereign, bare-metal, or EEA-sovereign cloud infrastructure. Every entity in the cohort -- including DotPerformance Limited, the sole Manx-registered finalist -- routes data through infrastructure owned by Amazon, Microsoft, or Google. All three are US-incorporated entities subject to the CLOUD Act and FISA 702, meaning US law enforcement and intelligence agencies can compel access to data held on their infrastructure regardless of where the physical servers are located.

Concentric Health explicitly hosts on Google Cloud Platform, confirmed by G-Cloud 13/14 framework disclosures. Optimise BP's clinician-facing subdomain resolves through a full Azure CNAME chain to Microsoft's Amsterdam infrastructure -- independently verified by DNS trace on 6 May 2026. Strolll, the AR therapeutics provider, is an AWS Partner Network member. Spryt is a Google Growth Academy graduate with deep GCP and Firebase integration. Mediktor, the Barcelona-based AI triage provider and the most sovereign entity in the cohort by legal jurisdiction, uses AWS and Azure for global scalability. Even DotPerformance, Douglas-based and Manx-registered, uses AWS as its managed hosting sub-processor -- confirmed by its own Data Processing Agreement.

This is not a failing unique to this cohort. It reflects the current state of health-tech infrastructure globally. But it does mean that Manx patient data -- hypertension records, dementia care interactions, triage decisions, wastewater surveillance data, home care monitoring -- will be processed on infrastructure reachable by US warrant, under a governance framework that has no legal existence yet, during a ten-week programme that concludes three months before the framework is expected to become operational.

Digital Isle of Man's board meeting minutes are public documents, published under the Open Government Licence.

The minutes of the 6 November 2025 board meeting include the following action log item: "Microsoft Azure access: Andrew Honour will circulate an update by email." Status: Closed.

The same item appears in the 4 December 2025 minutes: "Microsoft Azure access -- an update from Andrew Honour by email." Status: Actioned.

The nature of the Azure access question is not specified in the public minutes. But it is worth noting that Digital Isle of Man's own board was tracking an unresolved Microsoft Azure matter across two consecutive meetings while simultaneously advancing a programme that would onboard vendors -- several of them Azure-dependent -- into Manx health infrastructure.

This is not an argument against the Data Asset Foundation initiative. The governance architecture is the right response to a real problem. Asset-level governance, machine-readable rights, tamper-evident provenance records -- these are serious ideas from people who have done serious work.

This is not an argument against the Innovation Challenge. Health-tech innovation matters, and the Island's scale genuinely does make it a useful testbed for ideas that could scale elsewhere.

And this is not an argument that the sixteen finalists have done anything wrong. They are operating on the infrastructure that exists, under the contracts they have signed, within a programme that selected them. The gap is not theirs to fill.

The framework that Digital Isle of Man says will solve the Biobank problem is not yet law. The vendors working inside Manx health infrastructure right now are operating under the contract-led governance model the Biobank piece correctly identifies as no longer sufficient.

The engine is powerful. The handbrake is well-designed. The clutch -- the legal mechanism that would actually connect the governance framework to the data moving through these systems -- hasn't been fitted yet.

That line, with one small edit, is Phil Adcock's.

It seems worth returning it to him.