Audit Wales flags gaps in NHS digital delivery
Audit Wales warns that NHS digital ambitions in Wales lack clear delivery plans, risking service quality, cyber security and AI governance.
Audit Wales has warned that the delivery of digital transformation across Wales’ NHS is falling short of the ambitions set by health bodies, jeopardising service quality and value for money.
Auditor General Catherine Mealing‑Jones briefed Senedd members on Monday 28 September, outlining the findings of a review into how the twelve health organisations in Wales are deploying digital technology.
The audit examined each body’s digital strategy, leadership structures, workforce capability, investment planning and the management of risks linked to digital infrastructure, cyber resilience and the growing use of artificial intelligence.
While the review found that most organisations have articulated clear digital ambitions, it also highlighted a gap between vision and execution.
Audit manager Darren Griffiths told the Public Accounts Committee that “most have not yet translated them into costed delivery plans with clear actions, responsibilities and success measures”.
He added that many boards have not formally assessed their digital maturity, meaning “some bodies do not fully understand their starting point or the scale of change required”.
“Without clear delivery plans and robust benefit management arrangements, a digital ambition may not deliver better services or value for money,” Griffiths warned.
Plaid Cymru MS Carrie Harper pressed the auditors on where responsibility and accountability lie for the shortfall in delivery.
Representing the constituencies of Flint and Wrexham, the MS asked whether the fault rested with individual health boards, Digital Health and Care Wales (DHCW) or the Welsh Government.
Audit lead Nathan Couch responded that “at the local level, health boards are responsible for the digital programmes and things that they implement locally”.
He continued that “at a national level, it’s the Welsh Government and DHCW who are responsible for the rollout and delivery of national digital programmes, in conjunction with the health boards as well”.
Couch said the reports revealed “a lack of clarity around the roles and responsibilities of each party in doing that”.
Cyber security was flagged as a “major risk”, with the potential to disrupt services, expose patient information and affect care delivery.
Griffiths noted that boards discuss cyber risks regularly and that some have completed self‑assessments against national cyber security standards.
However, he cautioned that “progress in addressing identified gaps has been slow, keeping risks high”.
The audit also identified artificial intelligence as a source of “significant opportunities”, with bodies exploring how AI could support daily work, improve services and make better use of resources.
Yet, Griffiths warned that “boards are still developing approaches to ensure AI is used safely, ethically, and consistently”, adding that failure to get this right could “struggle to balance the benefits of AI, with risks to patient safety, data protection and public trust”.
Audit Wales concluded that without robust delivery plans, clearer accountability and accelerated action on cyber and AI governance, the promised digital benefits may remain out of reach for patients across Wales.