Lack of compliance with safety standards means the NHS digital transformation agenda risks “unprecedented” patient harm, according to a new warning from researchers.
The government’s 10-year health plan for England risks “propagating patient harm at an unprecedented scale” because of poor compliance with digital safety standards, according to research published this week.
“Before the UK government pursues its ambitious digital future for the NHS, a new digital safety architecture must be established”
Study authors
Shifting the NHS from analogue to digital is a core feature of the government’s 10 Year Health Plan for England, which was published in July 2025.
But the authors of research published on Tuesday in the journal BMJ Innovations have concluded that the NHS lacks the safety architecture needed to support this digital transformation.
The authors, from University College London, have warned that the digital ambitions of the plan risk placing an “unsustainable burden” on failing safety systems in the NHS.
Under the Health and Social Care Act 2012, NHS organisations currently have a statutory duty to manage clinical risks posed by digital health technologies.
They are required to obtain records from the manufacturer of any health IT system showing that it meets risk management standards.
And they are also required to empower clinical staff, who have been trained to manage digital risk, to act as clinical safety officers (CSO).
These CSOs are meant to ensure that digital health technologies used within the organisation meet clinical safety standards.
The UCL researchers used Freedom of Information (FoI) requests to gather data from NHS organisations in England to see how fully they were meeting these two statutory digital clinical safety requirements.
Of the 239 NHS organisations contacted for information, 163 subsequently provided data on CSO appointments.
On average, each NHS organisation employed 1.1 full time equivalent CSO, although this figure was much lower in integrated care boards (ICBs).
ICBs had an average of 0.4 full time equivalent CSO per organisation, while it was higher in NHS trusts where the average was 1.3.
The researchers found that the CSO function was treated across NHS organisations not as a dedicated professional post, but as an ancillary responsibility absorbed into existing roles.
In some cases, organisations had no information on the amount of time that was spent ensuring that digital clinical safety standards were met within the organisation.
The researchers also found a lack of consensus on what constituted digital health technology with 22 trusts reporting fewer than 10 digital health technologies while five reported over 500 and one more than 1,100.
Some trusts only applied the safety standards to electronic patient records, not applying the standards to other technologies used in clinical decision making, referral management and operational support.
The researchers also found that NHS organisations were not keeping centralised digital safety records, making it very difficult to retrieve even basic safety information about the digital technologies in use.
In addition, procurement processes did not comply with the safety standards, with many manufacturers failing to provide the required records and organisations failing to request them at the point of purchase.
The researchers warned that these findings had immediate implications for the government’s 10-year health plan for England.
They said that the plan to rapidly adopt frontier technologies including artificial intelligence, genomics and robotics would require a highly skilled CSO workforce with dedicated time to undertake risk assessments.
However, most NHS organisations currently lacked the CSO workforce needed to safely assess their current digital portfolio, they said.
The researchers concluded: “NHS organisations in England are systematically failing to comply with legislated digital safety standards…
“Before the UK government pursues its ambitious digital future for the NHS, a new digital safety architecture must be established.”
They said that, to ensure equal prioritisation of both innovation and patient safety, a combination of centralised assessment and local risk management should be adopted.
They also recommended the development of a professionalised CSO workforce, empowered regulatory enforcement, and integration of digital safety into national quality frameworks.
“Without these changes, the digital transformation envisaged in the 10 Year Health Plan risks propagating patient harm at unprecedented scale and speed,” the researchers said.
