No institutional home for open code in the NHS, and an active retreat from it

NHS England's open source policies lapsed when NHSX was merged away in 2021, and the policy pages were quietly deleted in December 2025. In May 2026 NHSE adopted a default-closed posture on its source code, citing AI-related security risks, and drew an open letter with 74 signatories asking it to keep code open. The electronic patient record rollout reached 95 per cent of trusts by March 2026 and locks in proprietary vendors with no open-code or open-API conditions. The Apperta Foundation, a clinician-led CIC that stewards OpenEyes, is small and industry-supported. OpenSAFELY and OpenPrescribing run on £17m of Wellcome funding over seven years, philanthropy substituting for a core NHS responsibility.

Health technology is where UK open source once led, and where lock-in costs most. OpenSAFELY ran national Covid research on open code. A closed-by-default NHS gives up scrutiny of its own systems and reuse across more than 200 trusts, and it hands negotiating power to the record-system vendors.

A reinstated NHS open source policy with a named accountable owner. Open-code and open-API conditions would go into record-system and framework procurements, and a modest stewardship fund would maintain clinically critical open software, contracted through bodies like Apperta or the Bennett Institute.

// Build together: Counterparty: NHS England/DHSC; pilot possible with one volunteer ICB or trust adopting open-code procurement conditions.

Record-system lock-in completes this year just as NHS England went default-closed and deleted its policy, so the window for keeping clinically critical code open is closing now.