Audit warns Cardiff health board digital plan could become unaffordable

Cardiff and Vale University Health Board risks falling short of its digital ambitions because ageing systems, gaps in staff skills and uncertain funding are holding back its plans, Audit Wales has found.

The public audit body said the health board has a clear ambition and strong board-level ownership, but its controls for digital, cyber and artificial intelligence risks are not yet effective. The health board remains at level one on the HIMSS electronic medical record scale and level two for infrastructure maturity, which Audit Wales said indicates very low digital maturity and continued reliance on paper-based processes and fragmented systems.

The funding gap

The main five-year Digital Foundations Programme has no confirmed funding. Current estimates say the Welsh Government would be asked for £25 million of capital funding plus about £9 million for capital depreciation charges. The health board would fund about £26.67 million of associated revenue costs over five years.

The programme forecasts £23.8 million of benefits, including £8.01 million expected to release cash and £15.76 million in non-cash benefits. Audit Wales warned that later phases could become unaffordable if those benefits are not delivered, especially where savings depend on workforce reductions.

Cyber and AI controls remain incomplete

An internal audit in August 2025 gave limited assurance on parts of cyber security, while the health board was rated not achieved against the Cyber Resilience Unit's assessment framework. Audit Wales also found that the board had not approved an AI strategy and that AI risks were not explicitly recorded on corporate or digital risk registers.

Four incidents had been reported to the Cyber Resilience Unit since March 2025. Staff cyber training reached 72 per cent in August 2025, leaving almost three in ten staff without completed training at that point.

Only 323 staff completed the skills assessment

The health board employs about 17,000 people, but only 323 had completed the Health Education and Improvement Wales digital capability self-assessment by November 2025. Audit Wales said that response was too small to provide a useful picture of workforce readiness.

There has been progress in individual services. Electronic prescribing and medicines administration is live in 70 per cent of hospital wards, and work is under way on a shared care record with Cardiff Council and the Vale of Glamorgan Council. Audit Wales nevertheless made eight recommendations covering affordability, board knowledge, cyber assurance, AI controls, staff skills, contingency planning, user involvement and benefits reporting.

What happens next

The health board plans to update its digital strategy and expects the Digital Foundations Programme to start this year. Its contingency options include delaying phases, reducing the programme's scope and identifying further benefits, but Audit Wales said delays could extend dependence on legacy systems and increase operational and cyber risk.