NHS digital safety gaps leave 70% of 14,848 technologies without documented assurance

The BMJ Innovations analysis examined freedom of information responses from NHS trusts and integrated care boards collected February to March 2025. Researchers identified four interlocking drivers of noncompliance: limited understanding of standards, weak governance, ineffective assurance processes, and CSO roles treated as ancillary duties. Average capacity stood at one full-time Clinical Safety Officer per organization, though free-text comments indicated these figures overstated dedicated time. Senior leaders often absorbed the function, reducing both availability and expertise development.

Contextual pressures amplify the risk. The NHS 10-Year Plan emphasizes digital shift amid existing workforce shortages and post-pandemic backlogs. Similar governance shortfalls contributed to earlier UK digital rollout delays and to safety incidents documented in the 2022 NHS England review of electronic prescribing systems. Equity concerns arise because under-resourced ICBs reported 0.4 full-time equivalent CSO capacity versus 1.3 in trusts, potentially widening variation in digital safety oversight.

Financial accountability remains unclear. No central register tracks compliance costs or incident rates tied to unassured technologies. Statutory exemptions claimed by 37 organizations on cost and data-access grounds further signal immature oversight rather than deliberate withholding.

Next steps require NHS England to publish annual compliance audits tied to funding release and to mandate dedicated CSO posts with protected time. Without enforcement mechanisms, the digital transformation may scale existing vulnerabilities rather than resolve them.