Digital Audit: Next plc

Audit Phase: Digital (Digital / Technology Forensics) Subject Entity: Next plc (LSE: NXT) Jurisdiction of Incorporation: England & Wales (Companies House No. 00230233)¹ Registered Office: Desford Road, Enderby, Leicester LE19 4AT, United Kingdom Audit Date: June 2026 Evidence Base: Published corporate disclosures, vendor press releases and case studies, trade and technology press, biometric-policy reporting, and civil-society sources. All factual claims are drawn from publicly available sources cited in the End Notes.

Scope and directionality note: Digital assesses the digital/technology nexus to Israel. The serious case is the provision of surveillance, digital, data, or cyber technology to the Israeli state, military, or security services. The reverse direction - Next procuring technology from Israeli-origin vendors - is a customer relationship and is recorded explicitly as such, weighted far lower than provision. No transitive guilt is imputed: a vendor’s founders, other clients, or a parent group’s separate activities are not attributed to Next. US-entity relationships (e.g. Microsoft, Amazon Web Services, Oracle, Zendesk) and EU-entity relationships (e.g. Infobip) are not Israeli-origin and are recorded for completeness only.

Enterprise Technology Stack & Vendor Relationships

Technology Orientation and the Total Platform (Direction: Next as provider to retail brands)

Next operates a largely proprietary technology function and has commercialised it through Total Platform, a white-label retail-infrastructure product providing e-commerce, warehousing, distribution, customer service, and in many cases the digital storefront to third-party brands.²³ Disclosed Total Platform clients include Reiss, Gap (UK & Ireland), Victoria’s Secret (UK), Childsplay Clothing, Laura Ashley, and Joules.²³⁴ Total Platform is explicitly marketed to retail brand partners, not to government, security, or military clients.²³

Named Enterprise Vendors (Direction: Next as customer; all US/EU-origin)

Public vendor disclosures and case studies identify the following enterprise relationships, none Israeli-origin:

Zendesk (US, San Francisco) - Next migrated from a homegrown CRM to the Zendesk Enterprise Suite in 2022 for global customer service (agent workspace, help centre, email, chat, social, and Zendesk AI), handling roughly 653,000 tickets monthly.⁵
Infobip (Croatia, Vodnjan) - In June 2025 Next partnered with Infobip for fraud detection (Infobip Signals, an AI/ML solution blocking artificially inflated messaging traffic - Next reported blocking ~175,000 artificial messages per month) and Rich Communication Services (RCS) for Business.⁶⁷⁸ Infobip is a Croatian company; this is a customer relationship with an EU-origin vendor.⁸
Oracle (US) - Third-party software-intelligence profiles record Oracle PeopleSoft ERP, Oracle Cloud HCM, Oracle Cloud ERP, and Oracle Recruiting Cloud in Next’s stack.⁹

Third-party technographic profiles also attribute use of Microsoft Azure, Amazon AWS, Tableau, Dynatrace, New Relic, and VMware to Next; these are aggregated scraper data of varying reliability and all reference US-origin products.¹⁰

Israeli-Origin Technology / Cybersecurity Vendors

No public evidence was identified from primary sources, vendor case studies, or Next’s own disclosures confirming a licensing, subscription, or integration relationship between Next and any Israeli-origin technology or cybersecurity vendor - including Check Point, Wiz, CyberArk, SentinelOne, NICE, Verint, or Claroty. Searches of the named vendors’ customer/case-study pages surfaced no Next reference.¹¹¹² An aggregator-style narrative asserting Next is “systemically dependent” on a “Unit 8200 stack” (Check Point/Wiz/SentinelOne/CyberArk) that it “forces” upon Total Platform clients appears only in AI-generated/low-reliability aggregator content and is not corroborated by any primary source, vendor disclosure, or reputable trade-press report; it is recorded here as unverified and not as a finding. No public evidence identified.

Procurement Transparency Constraints

Next is a private-sector company not subject to UK public-procurement disclosure obligations and publishes no named technology vendor register in its annual reports, ESG disclosures, or corporate-responsibility pages.¹³ Vendor relationships below the level of named, publicly announced partnerships - including the full security/IT stack embedded in Total Platform’s back-end - are undisclosed. This is the principal evidence gap in this domain.

Surveillance, Biometrics & Retail Technology

Facial Recognition - UK Domestic Policing (Project Pegasus)

Next is named among approximately ten major UK retailers funding Project Pegasus, a UK Home Office / police retail-crime initiative reported in September 2023 under which retailers share CCTV imagery with police, who run it against a national police database using facial-recognition software to identify shoplifters.¹⁴¹⁵¹⁶ Reporting names Next alongside John Lewis, Co-op, Tesco, Sainsbury’s, Waitrose, and others; the retailer-funded element was reported at around £600,000 (with later reporting citing higher aggregate pledges across participating retailers).¹⁴¹⁵¹⁶

Project Pegasus is a UK domestic law-enforcement programme with no Israel nexus. The matching is performed by police against a national database; primary reporting identifies no Israeli-origin facial-recognition vendor in the scheme, and no provision of any technology, data, or service to Israel arises from Next’s participation.¹⁴¹⁵¹⁶ No public evidence was identified that Next itself operates live facial recognition on customers in its own stores; contemporaneous UK live-FR retail deployments reported by trade and rights-group press named other retailers (e.g. Sainsbury’s, Spar, Sports Direct via Facewatch), not Next.¹⁷¹⁸

Israeli-Origin Surveillance / Biometric Vendors

No public evidence was identified that Next has deployed facial-recognition, biometric, gait-analysis, or in-store behavioural-analytics technology of Israeli origin (e.g. Oosto/AnyVision, BriefCam, Trigo, Trax). No public source links any such vendor to Next. No public evidence identified.

CCTV Infrastructure & Store-Level Analytics

Next operates an extensive CCTV network across its UK retail estate, referenced contextually in sector retail-crime reporting, but no public disclosure identifies the hardware vendor or video-analytics layer underpinning that estate.¹⁴ Third-party loss-prevention or CCTV-analytics sub-contractors are not publicly named, and it cannot be confirmed or excluded from public evidence whether any deploys Israeli-origin technology. No public evidence identified linking any to Next.

No public evidence was identified of Next using Israeli-origin predictive-analytics, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data Centre Operations in Israel

No public evidence was identified that Next operates, leases, or co-locates data-centre infrastructure within Israel. Next’s disclosed and reported infrastructure footprint is UK-based, with third-party profiles attributing hyperscaler use (Microsoft Azure, AWS, Oracle Cloud) to US-origin providers.⁹¹⁰

Project Nimbus & Israeli State Cloud Infrastructure

Not applicable. Project Nimbus is the Israeli-government cloud contract awarded to Google Cloud and Amazon Web Services; Next is neither a participant nor a sub-provider.¹⁹ No public evidence was identified of Next involvement in any Israeli state-backed digital-infrastructure programme. Whether any Next production workload incidentally resides on AWS or GCP infrastructure that elsewhere serves Nimbus cannot be determined from public evidence and, in any case, would not constitute provision of technology by Next to the Israeli state.¹⁹

Data-Sovereignty or Resilience Services to Israeli State Institutions

No public evidence identified. Next does not operate as a technology or cloud-service provider to any state body, Israeli or otherwise; Total Platform is marketed to retail brand partners.²³

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No public evidence was identified of any contract, partnership, memorandum of understanding, or service agreement between Next and the Israeli Ministry of Defence, the Israel Defense Forces (IDF), Shin Bet, Mossad, Unit 8200, or any other Israeli state security or intelligence body. Next is a fashion, homeware, and third-party-brand retailer and does not publicly operate in the defence-technology or security-services sector.¹¹³

Provision of Technology / Data to the Israeli State or Military

No public evidence was identified of Next providing surveillance technology, data, software, cloud capacity, or digital services to the Israeli state, military, or security services. This is the directionally serious Digital case, and no qualifying evidence of it was found. No public evidence identified.

Dual-Use Technology Provision

No public evidence was identified of Next’s commercial technology - its e-commerce platform, logistics systems, or Total Platform infrastructure - being reported or confirmed as deployed for military, intelligence, or law-enforcement surveillance applications in Israel or the Occupied Palestinian Territories.

Offensive Cyber Capability

No public evidence identified. Next does not develop, license, or sell offensive cyber capability, signals-intelligence products, or weapons technology. No UK export-control licence (OGEL/SIEL) relating to Next technology exports to Israel was identified.

AI, Algorithmic & Autonomous Systems

Disclosed AI/ML Activity

Next’s publicly disclosed AI/ML activity is directed at its own retail operations and Total Platform partners - e-commerce personalisation and recommendation, demand forecasting and stock optimisation, supply-chain modelling, and (via vendors) AI-assisted customer service (Zendesk AI) and messaging fraud detection (Infobip Signals).⁵⁶⁹ No disclosed AI/ML product is offered to state, security, or military clients.

AI/ML Provision to Israeli State Bodies

No public evidence identified. No public evidence was identified of Next providing AI capability, model access, training data, computer-vision systems, or inference services to any Israeli state, military, or security body.

Training Data & Model Development Involving Israeli Population Data

No public evidence was identified that Next’s AI/ML models are trained on, or have been given access to, civilian population data, intercepted communications, facial-recognition datasets, or surveillance-derived data originating from Israel or the occupied territories.

Autonomous Systems & Lethality

Not applicable. Next’s disclosed autonomous-systems activity is limited to warehouse robotics and logistics automation for retail fulfilment.² No lethal autonomous systems, drone technology, or weapons-guidance AI is consistent with Next’s disclosed business activities. No public evidence identified.

Internal Algorithmic Deployment - Israeli-Origin AI Tooling

Next’s documented AI tooling runs through US-origin (Zendesk AI, Oracle/Microsoft) and EU-origin (Infobip Signals) vendors.⁵⁶⁹ No public evidence was identified of any Israeli-origin AI vendor embedded in Next’s stack; the undisclosed full vendor list means secondary embedding within managed services cannot be positively excluded, but no such instance was identified.

Technology Ecosystem & R&D Footprint

Israeli R&D Facilities

No public evidence was identified that Next operates any R&D facility, engineering office, innovation lab, or accelerator programme within Israel. Next’s technology and engineering functions are based at its Leicester head office and distributed UK locations.¹³

Acquisitions & Investments in Israeli Technology Companies

No public evidence was identified of Next acquiring, or taking a corporate-venture stake in, any Israeli technology company. Next’s documented acquisitions in the period centre on UK fashion/retail brands (e.g. equity stakes in Reiss and FatFace, and the Joules acquisition via joint venture in 2022).⁴²⁰ None involves Israeli-domiciled technology assets. No public evidence identified of an Israeli-registered Next subsidiary or holding structure.

Patents & IP Co-Development with Israeli Institutions

No public evidence was identified of patent portfolios, licensing, or co-development arrangements between Next and Israeli-domiciled entities or research institutions (Technion, Hebrew University, Weizmann Institute), or of participation in the Israel Innovation Authority, BIRD Foundation, or a UK–Israel Tech Hub programme.

Supplier Code of Conduct - Technology Supply-Chain Provisions

Next’s responsible-sourcing, modern-slavery, and supplier-conduct frameworks address ethical obligations for its product supply chain but do not, in public versions reviewed, contain provisions governing the national origin or geopolitical exposure of technology vendors, software suppliers, or digital-infrastructure providers.¹³²¹ No technology-supply-chain due-diligence framework specific to vendor geopolitical exposure is publicly documented by Next.

Civil Society Scrutiny & Regulatory History

NGO & Academic Scrutiny - Technology Supply Chain

No public evidence was identified of an NGO investigation, academic study, or UN report addressing Next’s technology relationships with the Israeli state, Israeli defence entities, or Israeli-origin vendors. Civil-society attention on Next in relation to Israel has historically centred on the Wolfson family’s ownership and documented philanthropic support for Israeli institutions, not on technology procurement.²²²³

BDS Campaigns

Next appears on BDS-aligned boycott listings.²²²³ The publicly documented grounds relate to the Wolfson family’s ownership and philanthropic connections, not to Israeli-origin technology procurement, software licensing, or digital-infrastructure provision. No public evidence was identified of a BDS or NGO campaign specifically targeting Next’s technology relationships.

ICO & Data-Protection History

Next Retail Ltd holds a standard data-protection registration consistent with a major UK retailer.²⁴ No public evidence was identified of an ICO enforcement notice, monetary penalty, or undertaking against Next relating to surveillance technology, biometric processing, or cross-border data transfer to Israeli-jurisdiction entities. No public evidence was identified of a major customer-data breach attributed to Next during the review period.

Export Controls & Sanctions Authorities

No public evidence was identified of any action by UK export-control authorities, HMRC, the Office of Financial Sanctions Implementation (OFSI), or any equivalent body relating to Next technology sales, services, or data transfers to Israeli state entities. No public evidence identified.