Hale House member and founder of clinical innovation and safety consultancy Curistica, Dr Keith Grimes, shares headline findings from the largest review of NHS digital safety compliance to date.
In the first study to quantify both scale and compliance, an analysis of 14,747 NHS digital health technology deployments found that ~70% lacked documented clinical safety assurance, and that three in four patient-impacting tools did not demonstrate compliance with minimum legal or clinical safety requirements.
Published in The Journal of Medical Internet Research with co-authors Youssof Oskrochi, Elliott Roy-Highley, and Sam Shah, this interview with Keith provides insight into the research and lessons for the whole healthcare ecosystem, from innovator to provider.
What was studied, and how does it apply beyond the NHS?
The team examined how organisations evidence clinical safety for digital tools, including whether safety cases exist, whether Clinical Safety Officers (CSOs) are in place, and whether recognised standards are followed (such as DCB 0129 for manufacturers and DCB 0160 for deploying organisations, or analogous governance elsewhere). Even if a product is considered safe at development, local workflows, integrations and configuration can introduce new risks. This “last mile” must therefore be assessed in every setting where care is delivered, hospital or community, public or private.
The figures are concerning, but they do not imply that thousands of tools are actively harming patients. While findings show that assurance is patchy and difficult to evidence, and that awareness of the right standards remains varied, for the first time, we’re getting clarity – we now know where to focus efforts to improve confidence and safe adoption.
What are the biggest gaps and how do they translate outside of the NHS?
The most immediate gap lies in local assurance at the point of deployment. Workflow variation routinely creates new hazards, yet many organisations still lack the awareness, capacity, and number of trained and supported CSOs, or equivalent accountable clinicians in private settings, to manage those risks. Primary care and community services present an additional blind spot, as responsibility has increasingly shifted to practices, PCNs, and independent providers without matching funding or capability. A typical practice now operates 10–15 digital tools, yet most do not have a designated CSO. Transparency and cross-site learning are also limited because there is no shared repository of safety cases and few mechanisms to compare experience across organisations. Finally, enforcement and expectations remain unclear: no routine checker exists for digital safety compliance, and although the CQC assesses safe and effective care, expectations for digital safety evidence are still crystallising, a pattern that mirrors many private and international contexts.
Does safety governance slow innovation?
When done well, governance enables adoption rather than slowing it down. Clear safety cases allow clinicians and boards to approve technology sooner because risks have been modelled, mitigated, and monitored. Innovators or vendors also benefit because rapid feedback loops surface real-world issues earlier and help them deliver fixes faster.
What action should we be taking?
Providers in both public and private sectors should make digital safety a board-level commitment. They should maintain a live register of tools, require safety documentation from vendors, run local hazard assessments before go-live, and monitor performance in service. CSOs and other accountable clinicians should treat initial training as a starting point, seek mentorship and peer review, and convene multidisciplinary hazard workshops early in each deployment. Innovators and vendors should supply complete manufacturer safety packs (for example, DCB 0129 or the local equivalent), provide practical implementation guidance and configuration guardrails to speed site-level assurance, and establish two-way performance monitoring with customers.
The takeaway
These findings raise important questions about the risks to patients, the capacity of organisations to assess and mitigate those risks, and the implications of when, not if, harm occurs. Although the dataset is NHS-based, the lessons apply across public and private care and should serve to spur the health innovation community in London and worldwide to design, procure, and deploy digital tools that are safe by design, locally assured, and continuously monitored.
We should all be absolutely clear, this is not about slowing technology down; it is about proper resourcing, clarifying accountability, and sharing what works so AI can scale faster and safer with clinicians confident to adopt and patients protected by design, delivering the huge impact we all know is possible.
