AI (artificial intelligence) is being presented as the technology that will transform the NHS – reducing administrative burden, improving diagnosis, and enabling population-level care. But the central issue is not what AI can do; it is who will control the data that AI learns from – and therefore who ultimately controls the knowledge generated by NHS care.
The NHS holds one of the most valuable longitudinal health datasets in the world. Analysis by the Boston Consulting Group on behalf of NHSX suggested that more effective use of NHS data could generate up to £10bn annually in economic value through improved care and life sciences innovation.
AI offers a route to unlocking that value – but it also creates a risk that the infrastructure used to process and analyse NHS data gradually shifts control of that value outside the NHS.
Historically, the NHS has had a clear model of data stewardship: clinical data is generated through interactions between patients and clinicians and held within a publicly governed system, even when software infrastructure is provided by commercial suppliers.
AI fundamentally changes this relationship. AI systems do not simply store information – they structure it, interpret it, and generate new datasets from it. Federated data platforms can integrate datasets across organisations and make them operational for planning and decision-making, creating not just data but operational insight.
In AI, value sits across three layers: compute, code, and data. Health systems do not need to own every server or write every algorithm, but if we lose control of the data layer, we lose control of the insights generated from our own clinical activity.
If the platforms that structure and operationalise NHS data are controlled externally, the NHS could gradually move from being the owner of one of the world’s most valuable health datasets to being a data provider to platforms it does not control, generating the data while the strategic value sits elsewhere.
This is why the debate around the NHS FDP (Federated Data Platform) matters so much. The FDP could be enormously beneficial to improve service planning, reduce waiting lists, and support population health management. But it is not just an IT system – it is the operational intelligence layer of the NHS, and whoever controls the platform that integrates and operationalises NHS data holds significant influence over how services are planned and delivered.
This is not an argument against partnership with private companies, but it is an argument for choosing who we partner with carefully. Several European countries are investing in sovereign health data infrastructure and cloud capability specifically to avoid long-term dependency on foreign-owned platforms.
This dependency rarely occurs suddenly; it develops gradually through long contracts, integration into workflows, rising switching costs, and loss of internal capability, until the balance of power shifts from the organisation generating the data to the organisation controlling the platform.
Healthcare data resilience should be considered critical national infrastructure, under UK jurisdiction. Companies are subject to the legal frameworks of the countries in which they are based, irrespective of the location of the servers that store the data. For example, under the US CLOUD Act, US-based companies can be required to provide data to US authorities even if that data is stored in the UK or Europe.
In a world of increasing geopolitical tension, dependence on infrastructure governed by another country’s legal jurisdiction introduces strategic risk. In extreme scenarios, access to critical cloud or platform infrastructure could theoretically be restricted or withdrawn under legal or political pressure, disrupting national digital infrastructure.
This is not just about who builds the platform, but who ultimately controls what it learns.
AI will also create entirely new datasets from routine clinical care. If AI systems capture and structure clinical conversations, integrate system-wide datasets, and generate operational intelligence from NHS activity, the NHS is on the verge of creating one of the most powerful health data assets in the world.
The question is whether that asset remains under NHS stewardship, or whether the NHS becomes a data provider to platforms it does not control.
Where data is aggregated, anonymised, and used in ways that do not compromise the privacy and safety of individuals, the use of large, structured datasets should be encouraged. Platforms such as OpenSAFELY demonstrated the enormous value of large-scale health data during the COVID-19 pandemic.
Expanding structured clinical data could transform disease surveillance, pharmacovigilance, drug safety monitoring, and population risk prediction. However, if these capabilities are developed and controlled through platforms or companies outside the UK, the economic and strategic value of these aggregated datasets could accrue elsewhere. This would potentially export the estimated £10bn annual value of NHS data rather than retaining it within the UK health system and economy.
To combat this, we need a clear strategy on data sovereignty. Data generated through NHS care – including data derived and structured by AI – must remain under NHS stewardship. Platforms should be built on open, interoperable standards that allow portability and prevent lock-in, and the UK should invest in domestic analytical capability and governance so that it can shape and control its own health data ecosystem.
AI could be one of the most important developments in modern healthcare. But if the NHS loses control of the data layer while adopting AI, it risks losing control of the knowledge generated by its own patients and clinicians.
Loss of data sovereignty would affect economics, innovation, clinical decision-making, national resilience, and public trust. Data sovereignty is not a technical detail of digital transformation – it is the strategic issue that will determine who controls the future of the NHS.
The NHS was built as a publicly owned healthcare system. It should not become a publicly funded data generator for privately controlled intelligence platforms.
Professor David Strain is chair of the BMA board of science