Why This Matters for Boundary Governance
Regulatory changes rarely arrive in isolation. New standards create new obligations. New obligations create new boundary risks. Organisations that govern proactively — rather than reacting to each new requirement — build resilience that compounds across regulatory cycles.
Regulatory Timeline
In Effect Now
DCB 0129 / DCB 0160
Clinical risk management standards for health IT systems. Mandatory for NHS-deployed systems. Increasingly referenced by private healthcare regulators.
UK GDPR & Data Protection Act 2018
Data protection framework governing clinical data sharing, consent, and cross-boundary data flows.
Health and Care Act 2022
Established Integrated Care Systems (ICSs). Created new governance obligations for cross-organisational collaboration.
CQC Single Assessment Framework
New inspection methodology emphasising outcomes, safety culture, and governance maturity across providers.
Medical Devices Regulations 2002 (UK MDR)
UK regulatory framework for medical devices post-Brexit, including software as a medical device (SaMD).
2025–2026
NHS England Provider Selection Regime
New procurement framework affecting how services are commissioned across boundaries.
Federated Data Platform (FDP) Rollout
National data infrastructure creating new governance requirements for data access and use across organisations.
NICE Evidence Standards Framework Updates
Evolving requirements for digital health evidence, affecting approval pathways for clinical software.
NHS App as Digital Front Door Expansion
Patient-facing digital services creating new consent and identity governance requirements.
2027–2028
EU AI Act (UK Implications)
While UK is not directly bound, cross-border providers and international insurers will face AI governance requirements that affect UK operations.
Anticipated UK SaMD Regulatory Reform
Expected updates to how software as a medical device is classified and governed, potentially aligning with international frameworks.
ICS Maturity Expectations
Increasing expectations for ICSs to demonstrate governance maturity across provider networks, not just within individual organisations.
What This Means for Your Organisation
Each regulatory change creates specific governance obligations. For organisations operating across boundaries, the challenge compounds: you must meet requirements within your organisation AND at every boundary crossing. Governance infrastructure that addresses the LSPPT disciplines — Legal, Safety, People, Process, Technology — provides a stable foundation regardless of which specific regulations change.
Organisations with governance infrastructure adapt to regulatory change. Organisations without it react to each new requirement as a standalone project.
Prepare Your Organisation
Governance vs Compliance
Why meeting requirements at audit is not the same as being governed
LSPPT Framework
The five disciplines that make regulatory compliance sustainable
Boundary Risk Assessment
Score your current governance across all five disciplines
Scaling from Pilot
How scale surfaces regulatory requirements that pilots deferred
Last updated: February 2026
Prepare for What's Coming
We help organisations build governance infrastructure that adapts to regulatory change rather than reacting to it.
Book a discovery call Check Your Score