Hywel Dda agrees AI risk and staff skills changes after digital audit

Hywel Dda University Health Board has agreed to review its artificial intelligence risks and prepare a dedicated digital workforce plan by 31 December 2026, following an Audit Wales review. The audit praises the board’s digital leadership and investment, while warning that limited funding could put its plans at risk. It also identifies uneven staff confidence with technology and gaps in how the organisation oversees AI. There is an important distinction in the dates: Audit Wales’s publication page is dated 29 September, but the report itself is dated March 2026. Its findings describe the position examined then, rather than a fresh inspection of services this week.

What the audit found

Of approximately 13,000 staff, 209 had completed a national digital skills self-assessment tool. That is a measure of participation in the assessment, not a finding that the remaining staff lack digital skills. Separately, 499 staff attended digital inclusion sessions during 2024/25. Auditors found that the board had a clear strategy, effective oversight and a good approach to tracking the benefits of digital projects. Its plans include helping patients manage their care and making shared records easier for staff to access. The report records about £68 million in digital revenue spending and £13 million in capital investment across 2021/22 to 2024/25. Those are separate spending categories over four financial years, not a new funding announcement.

The board’s response and deadlines

The published management response accepts all five recommendations. It sets 30 September 2026 for clearer committee reporting and stronger reporting on national digital partnerships. The AI risk review and workforce plan are due by 31 December, with a process to track the effects of engagement across projects due by 31 March 2027. The board says the AI work will follow its approved framework, covering clinical safety, information governance, ethics and monitoring. These are planned actions and deadlines; the response does not establish that they have been completed. The audit also reports well-developed cyber risk management and no cyber incidents reportable under the Network and Information Systems Regulations in the 12 months to March 2026. That does not mean there were no IT problems. The next question is whether the agreed actions are delivered and improve how staff and patients use digital services.