Ninety-three per cent of NHS providers have an electronic patient record. Only thirty per cent have fully integrated bi-directional data flows, according to NHS England's Digital Maturity Assessment 2025. The AI ambition across the NHS is ahead of the data foundation by at least a decade. For Estates, Facilities and Integrated Care Boards, the answer is not another pilot. It is a defensible, auditable view of the asset record before AI is asked to run on top of it.
The ambition is not the problem
No NHS Trust is short of AI ambition. Diagnostics, rostering, bed flow, estates optimisation, net-zero reporting: every board paper has an AI line item. The Long Term Workforce Plan assumes productivity gains that only AI can plausibly deliver at scale. The direction of travel is set.
The NHS is not quiet on this. The 10 Year Health Plan, published July 2025, names five transformative technologies as strategic priorities: data, artificial intelligence, genomics, wearables and robotics. Data sits alongside AI, not underneath it. The Medium Term Planning Framework 2026/27 to 2028/29 mandates that every trust and every ICB onboard to the Federated Data Platform and use its core products for elective recovery, cancer, and urgent and emergency care. The national policy frame is already "analogue to digital" with data as a named pillar. The gap is between that frame and what actually sits under the estates record.
The problem is what AI runs on. NHS England's Digital Maturity Assessment 2025 covers 205 trusts and 42 Integrated Care Boards. Providers score strongest on digital leadership and infrastructure. They score weakest on empowering patients and transforming care delivery.
That gap is where AI will either fail quietly or fail expensively.
The estates record is the least-governed record in the trust
Every Trust Estates and Facilities director knows this, but few AI strategies factor it in. The estates record (medical equipment, plant, buildings, backlog maintenance, energy assets, PFI-encumbered assets) is typically held across three to five systems. Some are platform-based. Some are spreadsheets. Some are held by contractors. The result is an asset record that no single person can fully describe.
Ask a simple question: "How many ventilators do we run, where are they, when were they last serviced, and by whom?" The answer will vary by five to ten per cent depending on who you ask. That variance is the AI problem.
Models learn from data. If the data is ambiguous, the model will confidently produce ambiguous answers. In clinical settings, that is dangerous. In capital planning, it is expensive. In net-zero reporting, it is a regulatory risk.
Three areas where the data record decides the outcome
Medical equipment maintenance. Condition-based maintenance on an imaging estate that spans three decades of capital procurement will not work on a record that mixes manual service logs with vendor portals and PFI-owned data. The foundation is a single asset-level view, governed consistently, before any predictive model is deployed.
Backlog maintenance prioritisation. Every Trust carries a backlog that is larger than its capital envelope. The board question is not "what is on the list?". It is "which five hundred items should be funded this year to reduce clinical and operational risk most?". Answering that with AI requires a backlog dataset prioritised against consistent risk criteria. Most are not.
Energy and net-zero reporting. Greener NHS, Treasury reporting, and the Trust board all need the same number with a different cut. The asset register is the only source of truth that can serve all three. Where the asset register is incomplete, AI is not going to fill the gap. It will hide it.
DSIT has just changed the bar for the business case
In April 2026, DSIT and the Government Digital Service published the Digital and Data Benefits Framework. It sits alongside HM Treasury's Green Book as the standard methodology for quantifying the benefits of digital and data programmes in public sector business cases. The framework is structured in five sections: AI, service transformation, data, capability, and technology with cyber and interoperability.
NHS business cases over threshold go through Green Book. NHS AI business cases are now scored against the DSIT methodology. The data section is where most proposals have never been asked to articulate realised value, and the service transformation and interoperability sections are where the weakest proposals will lose marks twice. A Trust or ICB writing an AI business case today has a new bar to meet.
Why the previous wave of data investment did not solve this
Trusts have invested in data warehouses, business intelligence, and integration platforms for two decades. Those investments were designed to report on what happened. AI asks a different question. It asks what is going to happen, and what should we do about it. That requires the underlying record to be governed, not only reported on.
The governance gap is real. The IBM Security Cost of a Data Breach Report 2025 found that sixty-three per cent of breached organisations had no AI governance policy or were still developing one. Ninety-seven per cent of organisations involved in an AI-related breach reported no AI access controls. Shadow AI is adding an average of $670,000 to breach costs. Public healthcare is not insulated from any of that.
The Estates Director reads this as an asset-record problem. The CIO reads it as an integration problem. The Director of Finance reads it as a capital-prioritisation problem. The Caldicott Guardian reads it as a governance-of-evidence problem. Each is correct, and the same reconciled asset and data record answers all four.
The continuous layer: Data Governance as a Service
NHS data does not become defensible once and stay defensible. Platforms change. Contracts rotate. PFI schedules mature. Classification logic erodes. Clinical risk criteria evolve. CQC inspection and Internal Audit cycles are continuous, not one-off.
Data Governance as a Service (DGaaS) is Brainwave Asset Intelligence's cross-sector model for that continuous layer: practitioner-led governance that detects duplicates, degradation and supply-chain integration gaps in the asset and operational record between assurance cycles rather than at them. The full treatment, applied consistently across asset-intensive sectors, sits in the DGaaS anchor on this page.
Foundations before automation
AI ambition in the NHS is ahead of the data foundation. The DMA 2025 numbers confirm it; DSIT's Digital and Data Benefits Framework is about to enforce it on every business case. Closing the gap begins where it always begins in a regulated sector: at the asset record, with a governance discipline the Trust board, the Caldicott Guardian and the external auditor can all sign off.
Data readiness is the foundation. Foundations before automation.
Key takeaways
- AI ambition in the NHS is ahead of the data foundation. The DMA 2025 numbers confirm it.
- The estates record is the least-governed record in most Trusts, and it sits underneath the AI use cases boards actually want.
- DSIT's Digital and Data Benefits Framework is now the scoring methodology for NHS AI business cases through Green Book.
- Governance is not optional. Sixty-three per cent of breached organisations had no AI governance policy in place.
- The reconciled, governed asset and data record is the artefact that answers the Estates Director, the CIO, the Director of Finance and the Caldicott Guardian in the same review.
Sources: NHS England, Digital Maturity Assessment 2025. NHS England, 10 Year Health Plan for England, July 2025. NHS England, Medium Term Planning Framework 2026/27 to 2028/29. DSIT and Government Digital Service, Digital and Data Benefits Framework, April 2026. IBM Security, Cost of a Data Breach Report 2025. House of Commons Library briefings on the Long Term Workforce Plan and the 10 Year Health Plan. Verified 20 April 2026.