The Next
Evolution Review

A brain scan taken in a district general hospital joins a queue, and a radiologist works through the queue. The number of trained people, and how long each image takes, sets the pace for everything behind it.

In February 2026 researchers at the University of Michigan published a model, Prima, which interprets a brain MRI within seconds. It was trained on more than 200,000 past studies and tested on more than 30,000 over a year, with accuracy of up to 97.5% across more than fifty diagnoses.¹ It is not yet in routine clinical care.

Four approvals, each with a reason

Software that informs a diagnosis has to be certified as a medical device. That requirement exists because unregulated devices caused harm; the UK's review of medicines and device safety sets out how each layer of regulation followed a specific failure.²

It then has to be assessed for whether the evidence justifies the cost, because a health system with a fixed budget that buys things which do not work is taking money from things that do. It then needs a commissioning route: somebody has to decide that this is something the service buys, under which tariff, counted how. Finally an individual trust, with its own budget and its own list of pressures, has to decide that this is what the money goes on this year.

Each of the four is run by people acting reasonably. The likely result is that the capability reaches teaching hospitals first, where research budgets and academic partnerships can absorb the early cost, and reaches everywhere else over a period nobody has estimated in public.

Who waits

NHS England's own waiting-list breakdowns show that patients in the poorest communities are more likely than any other group to wait longer than 18 weeks for treatment.³ They are also the people least able to travel to a hospital that has a new capability, take time off for an appointment two counties away, or pay to go private while they wait.

A diagnosis that arrives late is often a different diagnosis. Described as a productivity tool, the software's slow rollout is a missed saving. Described as a change in who gets diagnosed in time, it decides which patients benefit first, and nobody records that decision.

How long

I have found no published figure for the average time between a diagnostic technology being validated at scale and being available across the service. The regulator can state its own timescales, and so can the evidence assessor and the commissioner. No single body is responsible for the total, which is probably why nobody has published one.

Simpler things meet the same problem. At a health innovation showcase, a medical student presented a single kit for a particular procedure. They had watched clinical teams finish that procedure and then account for every item used, and sometimes fail to. The kit released each stage only once the previous stage's components had been used, and finished as one sealed, disposable container. When I asked afterwards how deployment was going, the answer was that it was not: procurement raised one blocker, clinical teams another, and there was no single route into practice.

A record of the chain

One document per technology would be enough: the bodies that must agree, the question each is answering, the evidence each has asked for, and the date of each request, kept where a board would see it. It would put names and dates against a wait that currently belongs to nobody.

The mechanism sounds invented. Bacteria are mixed into the concrete in a dormant state, along with a nutrient. When a crack opens and water gets in, the bacteria wake, feed, and produce limestone that fills the crack from inside.

Full-scale outdoor testing began in 2011,¹ and Basilisk, the spin-out that grew from the Delft work, has taken self-healing products to market.² The engineering is understood, and the material still appears in few specifications.

No one says no

Construction procurement is decided on the price of building the thing. That is what the tender is scored on and what the person deciding is accountable for. Self-healing concrete costs more to lay. Over a long maintenance life it can cost less in total, because the repairs it avoids are expensive and disruptive. But the maintenance budget decades from now is not a line on today's tender, so a material that may be cheaper overall is scored as dearer, and it rarely wins.

Whole-life costing exists, and rarely wins

Government guidance already asks for this. The Construction Playbook tells public buyers to focus on whole-life value and to build should-cost models of whole-life costs.³ The pattern persists anyway.

Whole-life costing asks the person scoring a tender to estimate costs over a period longer than their tenure, the political cycle and the warranty. It needs assumptions about discount rates, usage, climate and maintenance, each arguable and each likely to be argued by a losing bidder. A scorer who relies on build price is easy to defend. One who relies on a forty-year projection is exposed.

In the public-sector bids I have written and responded to as a consultant, questions about whole-life cost beyond the contract term have been rare. The contract length sets the horizon: it is the only period a bidder can answer for, because what happens after may be delivered by someone else. The buyer seldom asks either, so neither side is accountable for the cost that arrives later.

Who pays

The maintenance cost does not vanish. It passes, in full, to whoever holds the asset in twenty, thirty and forty years, often a public body with a maintenance backlog it did not create. The person who takes the decision and the body that pays for it may never deal with each other.

The question for a procurement

A saving that arrives after the decision-maker has gone, falls to another organisation, or cannot be shown without a projection someone could attack never gets weighed at all. So ask of any procurement who must sign, what kinds of value the tender can record, and who in the process speaks for the maintenance budget in 2060.

Look at what a risk register contains: financial exposure, regulatory breach, operational failure, reputational damage, safety. Each entry has an owner, a score, a mitigation and a review date, and the discipline behind it is real. A well-kept register is one of the more useful tools in corporate governance.

Now look for the entry that records what it costs the organisation, or anyone else, if a decision is taken in March instead of January. The standard categories have no place for it.

I was once responsible for part of the reporting to a risk and audit committee. The same report came back each month with its dates moved further out, and nobody asked what the delay was costing the organisation or might cost later. I inherited some of the consequences: deferred decisions that had become problems of their own. The cost was the work stopped or postponed to deal with them, and nobody measured it.

The asymmetry

This follows from how accountability is built. A committee that approves something which then fails has made an identifiable decision with an identifiable outcome: a minute, a date, a set of names. The failure attaches. A committee that defers, asks for more evidence or refers the matter elsewhere has also decided, but it reads as diligence. If the deferral cost something, the cost is diffuse, arrives later and usually falls on someone outside the organisation.

So the two options are unequal, and nobody in the chain has to be timid or self-interested for the whole to run slow. Everyone can act in good faith and the outcome is still set by the shape of the accountability.

Every department did its job

There is a failure pattern in which every part of an organisation does its job correctly and the outcome is still wrong, because the gap that produced it was on nobody's map. Delay is the clearest example. The regulator answers a regulatory question in the time its process takes. The evidence body answers an evidence question, the commissioner a commissioning question, the trust a budget question. Every authority in a chain can account for its own timescale. None is asked for the sum.

Asking each body to go faster leaves the total unowned. Making the total somebody's responsibility is harder, because the aggregate crosses the boundary of every organisation involved, and there is no obvious candidate.

One sentence in the minute

The usual answer to a governance gap is a new governance artefact, which usually lengthens the chain. A narrower step would not: for any decision a board defers, record beside the deferral what exactly is being waited for, and what the delay costs and to whom.

Most of the time the cost will be small and the pause sensible, and writing that down takes a minute. The value is in the cases where the answer is uncomfortable, where writing it down turns a diffuse condition into a decision with an author.

Whether it would change outcomes is untested. The present arrangement, in which the risk of acting is quantified and the cost of waiting is not recorded at all, has rarely been examined as a choice. Would your board know what its last deferral cost, and who paid?

An adversary who copies encrypted traffic today cannot read it. The copy costs little to keep, and the bet is that one day the mathematics protecting it will give way. Then all of it can be read at once, including what was sensitive when it was sent and still is.

For a well-resourced actor this is cheap against the possible return, and the prudent assumption is that it is happening to anything worth collecting.

The replacement standards, cryptography designed to survive a quantum computer, were published by the US National Institute of Standards and Technology in August 2024.¹ In March 2025 the UK's National Cyber Security Centre set out milestones: by 2028, define goals and complete discovery and assessment; by 2031, carry out the highest-priority migrations; by 2035, complete migration.²

In the sectors I work with, much of the data being held matters for decades: health records, insurance policies, mortgages, criminal convictions. The conversations I have about protecting it tend to be about current encryption and current standards. I have rarely heard anyone ask how they are preparing for post-quantum encryption.

Why the decision waits

No regulator is withholding approval here and no commissioner is failing to find a route. The decision sits inside the organisation and can be taken by people already in the building.

It goes untaken because of how the harm is shaped. The cost of migration is large, immediate and lands in a named budget. The harm it prevents is uncertain in timing, falls in some later year, and will be felt by whoever holds the role then. A finance director weighing that against eleven other calls on the same money is reading the incentives in front of them accurately, and deferring is a reasonable response to them.

Discovery is the first milestone

The NCSC is explicit that migration starts with understanding your current estate: identifying key services and applications, and recording the data you hold, how long it needs to stay confidential, and its value to an adversary.² That work is comparatively cheap and useful for other purposes.

It also puts the exposure on record. Once the estate is understood, deferral becomes a documented acceptance of a specific risk. Some reluctance to start is about capacity. Some of it is that not knowing is more comfortable, and current governance rewards the comfort.

Where the human consequence sits

Much of what is worth storing for a decade is about people: medical records, legal matters, communications, financial histories, casework of every kind. A person whose records are collected today cannot know it and cannot withdraw them. They carry the risk, and nobody at the budget meeting where migration is deferred another year speaks for them.

When

Nobody can say when the mathematics gives way, and credible estimates vary widely. That uncertainty is often offered as a reason to wait. It is a better reason to start, because the collecting is happening now whatever the date turns out to be, and the NCSC's own timetable runs to 2035.

Consider Sam, who paid three bills late during a year of illness and spent several evenings searching about the condition. Sam's profile holds a record of lateness and a record of searching. It does not hold the illness, because the circumstance was never collected.

The profile was assembled by parties Sam never dealt with and is held for purposes Sam was not told about. Described that way it sounds like a scandal. Described the way the industry describes it, it sounds like an enrichment layer, which is one reason the debate has gone nowhere.

The deeper problem is a category error built into the design. A trace of behaviour records what someone did in a particular set of circumstances. A profile treats it as a description of what someone is, which does not follow.

Where it is used

These records travel. They feed credit decisions, employment screening, insurance pricing, tenancy referencing and a widening set of automated assessments in which the organisation has bought a score rather than looked at a person. The person assessed is not usually told which score was used, by whom, or on what basis, and the organisation using it often could not explain the basis either, because the score arrived as a product with a proprietary method.

Recruitment is where I see the risk most clearly. A gap in a career history, or several moves in a few years, is an accurate record, yet it is often read as a warning, and the candidate has to explain what was personal, or a redundancy. As AI tools take over more of the first sift of CVs, that reading risks being automated: a system that has learned what a conventional career looks like can treat a gap as an anomaly, with none of the context.

Chains around benefits, almost none around harms

In health, four bodies must agree before a person can have a scan that might help them. Here, nobody has to agree before a record is built about them. What stands between a person and a permanent, portable record of their worst year is a consent notice on a website they visited once.

Why correction struggles

UK law gives people a right to have inaccurate personal data rectified.¹ The regulator's own guidance explains why that right reaches less far than it sounds. A record of a mistake that has since been resolved is, in itself, accurate and should be kept, with the correction added; and a recorded opinion is hard to show to be inaccurate at all.¹ Most profile entries are accurate traces used to support an inference. You cannot correct an accurate fact that is being used to prop up a conclusion it does not support.

Where this leaves Sam

With a record Sam cannot see, held by parties Sam cannot name, used in decisions Sam is not told about, and correct in every particular. Each decision is defensible alone. The damage comes from the accumulation, which has no owner. What would Sam need to know, and from whom, to contest any of it?

A dropped kerb was cut for wheelchair users. It is used by anyone with a pushchair, a suitcase, a delivery trolley or a bad knee. The pattern is well enough known to have a name, the curb-cut effect, set out by Angela Glover Blackwell in 2017: changes made for one group that turn out to benefit many.¹

Subtitles are the clearest measured example in the UK. In 2013 Ofcom reported that around 7.6 million UK adults said they had used television subtitles, of whom about 1.4 million had a hearing impairment.² A service built for deaf and hard-of-hearing viewers was used, on those figures, mainly by people who were neither.

I worked on learning platforms for children where every part had to be usable by every child. One requirement was a choice of ways to log in, matched to different physical and cognitive abilities. Those options were built for children with particular needs. They also meant that no child had to remember a complex username and password.

Why it works this way

Designing for someone at the edge of what a system can accommodate forces you to drop assumptions that were never true for anyone: that the user has both hands free, full attention, good light and a quiet room. Most people are at that edge some of the time. The permanent condition of a small group is the temporary condition of a large one.

So a standard written for a minority often raises the floor for everyone rather than adding a feature for a few.

A chain that was overridden

Here a rule was imposed on organisations that would not have chosen it, over their objection, with a compliance date. That makes it the strongest evidence for a claim I am otherwise wary of: that the scoring is wrong as well as slow. Had the wider benefit been counted at the point of decision, the requirement would have looked like an improvement and would not have needed forcing.

It went uncounted for the same reason as the lifecycle saving on self-healing concrete. The benefit goes to people who are not the subject of the rule, in circumstances nobody anticipated, after the assessment was signed.

The limit

Not every imposed standard produces a wider benefit. Plenty are badly drafted, expensive, and deliver what they were narrowly written for and nothing more. The curb-cut effect is a repeated pattern with exceptions, and it would make a poor general case for regulation.

A narrower claim holds up. When a requirement forces the removal of an assumption about the user, rather than the addition of a feature for a group, the benefit tends to spread. That distinction is available whenever a standard is drafted, and it could be used to decide which standards are worth the cost.