This first bulletin looks at three patterns that continue to appear across critical systems: complexity, concentration, and the challenge of governing change over time.
Each bulletin contributes to an open archive of observations, studies, and recurring patterns across critical systems.
Critical Dependencies studies patterns rather than incidents. Individual events come and go, often dominating attention for a brief period before receding from view. The structures that produced them tend to remain.
Our interest is in what persists: the slow accumulation of complexity, the gradual concentration of capability, the quiet lag between systems and the institutions that govern them. These patterns are visible only when observed across systems and across time.
This first bulletin introduces three patterns that continue to appear across critical systems and the questions they raise. It is not an argument for any particular policy.
Complexity accumulates in critical systems gradually and almost without notice. Each individual addition — a new interface, a new dependency, an additional layer of automation — is justifiable on its own terms. The cumulative effect is rarely examined.
Over time, the working understanding of a system becomes distributed across many people, vendors, and documents. No single participant can hold the whole picture. Operating procedures grow longer; exceptions outnumber the rules they qualify; institutional memory thins as personnel change.
The governance structures intended to oversee such systems frequently lack the resources, access, or technical fluency to follow them at this depth. Complexity does not merely make systems harder to operate; it makes them harder to govern. We explore this further in the foundational study on Operational Complexity.
Concentration is most often discussed as an economic phenomenon — a question of market share or competitive structure. Treated structurally, it is something more basic: a property of the system itself, describing how thoroughly critical functions have settled into a small number of operators, components, or jurisdictions.
Concentration does not require deliberate consolidation. It can arise from standardisation, from regulatory cost, from the gradual disappearance of alternatives that were once routinely available. Choices that seem flexible in the short term can become difficult to reverse as alternatives disappear and common approaches become established.
Once concentrated, a system carries risk that is correlated rather than distributed, and offers fewer points of leverage to those responsible for its oversight. The foundational study on Dependency Concentration examines how this shape emerges and why it tends to persist.
Institutions, procedures, and oversight mechanisms tend to evolve more slowly than the systems they are meant to govern. This is not a failing of any particular institution; it is a structural feature of how rules, mandates, and expertise are formed.
A regulator's understanding of a system is necessarily based on the system as it was when the framework was written. As architectures, dependencies, and operating practices shift underneath, the framework continues to apply, but the object it describes is no longer quite the same.
Governance lag is rarely visible in ordinary operation. It becomes visible during disruption, when the questions that need to be asked turn out not to fit the categories the framework was built around. The foundational study on Governance Lag develops this pattern in greater detail.
The three patterns above converge with unusual clarity in contemporary digital infrastructure. Cloud computing, identity systems, content delivery networks, and the dependencies that connect them form a substrate on which a growing share of other critical systems now rests.
Operational complexity in this layer is considerable and accelerating. Concentration is structural: a small number of providers underpin a large share of the services that institutions, governments, and other critical systems depend upon. Governance frameworks designed for earlier generations of communications and computing infrastructure do not always map cleanly onto what has replaced them.
The focus here is on how these dependencies are structured and governed, rather than on the actions of individual organisations.
Future bulletins will continue to build on these themes as the archive develops. The aim is not to explain every event, but to better understand the structures and patterns that shape them over time.