Every ministry wants the same thing right now: faster digital services, tighter security, and systems that don’t fall over under budget cuts. Easier said than done. Sovereignty rules keep narrowing which AI tools agencies can even touch, and the staff who understand the old mainframes are retiring faster than anyone can replace them. So who’s actually building the replacement infrastructure? Not always who you’d guess. Here are eight firms doing real public-sector work, plus what’s worth checking before signing anything.
Why Government IT Looks Different Now
Ten-year mainframe contracts, glacial rollouts, nobody in a hurry. That was the old model. It’s breaking down fast. Agencies today are pulled in a few directions at once:
- Modernizing legacy systems while they’re still live and processing payments
- Defending against cyber threats that are political as much as criminal
- Building 24/7 citizen services (tax filing, permits, benefits) that actually work on a phone
- Navigating sovereignty and data-residency rules that rule out most generic cloud AI
- Losing experienced staff to retirement faster than replacements can be trained
Sound familiar? It’s the same squeeze private companies feel, just with more auditors in the room and zero tolerance for downtime. A private company’s app crashing is annoying. A tax portal crashing during filing season makes the evening news.
Companies Worth Knowing
Skip the usual mega-consultancy names for a second. These are mid-sized firms with actual government contracts on the books, named agencies, and delivery histories you can check.
DXC Technology
Scale is the story here — 280-plus government customers across 25 countries, plus a GSA Multiple Award Schedule contract letting US federal agencies buy straight off the catalog. DXC recently built a GenAI platform with the European Space Agency and supplies justice-system software courts use to modernize case management. Whitelane Research named it Top Public Sector Performer in Europe.
You can learn more about the service at the link: https://dxc.com/industries/public-sector
Sopra Steria
Not flashy. Not trying to be. Sopra Steria runs identity systems, defense platforms, and welfare administration software for French and UK ministries, and it built pieces of the French biometric passport infrastructure. It also supports NHS digital services across Britain. The pitch here isn’t branding — it’s depth in security-cleared, regulated delivery, the unglamorous work most vendors avoid.
Indra Sistemas
Ask anyone in Spanish defense circles and they’ll know Indra. Air traffic control, radar systems, NATO command infrastructure — that’s the base. But the public-sector arm also runs election technology and tax platforms across Latin America and Europe, including voting infrastructure for Spanish regional elections. Civilian and defense work under one roof is rare. Indra pulls it off.
Netcompany
Denmark’s Netcompany built the country’s digital tax and business-registration platforms almost from the ground up, then took the playbook to the UK, Netherlands, and Norway. Fewer subcontracting layers, tighter timelines — that’s the whole model. Copenhagen’s citizen portal, borger.dk, runs partly on its infrastructure, and the firm is now chasing UK Home Office contracts too.
Tietoevry
Born from a merger of Finnish Tieto and Swedish EVRY, this Nordic operator handles healthcare records, welfare payments, and municipal service platforms across Scandinavia and the Baltics. It supports Norway’s national patient record system. Finnish municipalities lean on it for digital-service rollouts. Nordic open-data standards and cross-border interoperability aren’t easy to fake — Tietoevry lives in that world daily.
Comarch
Started in telecom billing. Ended up running chunks of Poland’s e-health system and traffic-management software for several Central European cities, plus public-administration platforms most people outside Poland have never heard of. Comarch’s story is a decent reminder: regional players who know the local rulebook cold can out-compete bigger names with better logos and worse local knowledge on the ground.
Reply
Reply doesn’t operate as one big blob — it’s a federation of specialized units, which lets it move fast on niche projects. Cybersecurity operations centers, cloud migration, AI pilots for Italian ministries, handled by small teams that own the problem end to end. It’s worked with Italy’s public administration digitization agency on citizen-identity and open-data initiatives. Agencies often deal directly with whoever’s building their system.
Bechtle
Germany runs on Länder-level bureaucracy, and Bechtle knows how to navigate it. Device procurement, network overhauls, full systems integration for federal and state agencies — Bechtle does the unglamorous middle ground between reselling and building. German public schools rely on it for digital-workplace rollouts. Framework contracts with several state ministries give it a price and reach that smaller integrators just can’t match.
What This Means for Buyers
Brand recognition isn’t the metric that matters here. Before any RFP goes out, check a few things:
- Do the delivery staff actually hold security clearances, not just the sales team?
- Are there references inside your specific government tier — federal experience doesn’t guarantee municipal fit
- What are the real data-residency and sovereignty guarantees, especially for AI tools?
- What’s the exit clause? Legacy lock-in is the oldest horror story in public IT.
No single company on this list wins every category. Some lean defense-adjacent, some build citizen apps, some handle back-office modernization nobody sees. Fit depends on the mission, the budget, and how much political risk an agency can stomach.
FAQ
Is DXC the biggest government IT contractor here?
By client count, yes. Biggest doesn’t automatically mean best fit for every agency, though.
Do any of these firms work outside Europe?
Most do DXC, Indra, and Sopra Steria all run active contracts in the US, Latin America, and Asia-Pacific.
Why leave out the usual big-four consultancies?
They’re covered everywhere already. Mid-sized specialists tend to bring sharper, more regionally grounded expertise.
How should agencies check AI sovereignty claims?
Ask for infrastructure diagrams, data-residency contracts, and independent audits — not just a slide deck.
