Welcome to the Public Accounts Committee on Thursday 30 January 2025. We today extend a very warm welcome. I think we have a delegation of about 25 parliamentarians from across the Commonwealth attending committee hearings today. They have been attending a workshop on AI organised by the Commonwealth Parliamentary Association, so you are probably all much more expert on this than we are, but we will see. Anyway, you are all very welcome. The Prime Minister said recently that “Artificial intelligence will drive incredible change in our country. From teachers personalising lessons, to supporting small businesses with their record-keeping, to speeding up planning applications, it has the potential to transform the lives of working people. But the AI industry needs a Government that is on their side, one that will not sit back and let opportunities slip through its fingers. And in a world of fierce competition, we cannot stand by. We must move fast and take action to win the global race”. To help us in this quest, today we will look at cross-Government work between the Cabinet Office and DSIT—that is the Department for Science, Innovation and Technology; I do not like acronyms but I will use it from now on—which began in 2023 to develop a strategy for AI adoption in the public sector, with the NAO reporting on March 2024 that 70% of Government bodies surveyed are piloting or planning to use AI. We will be examining how effectively the Government have set themselves up to maximise the opportunities and mitigate the risks of AI in providing public services and how effectively they can roll out an overarching AI policy across Departments. We will be questioning officials on how they plan to overcome the barriers to AI adoption in the public sector, including issues with legacy IT structure, data access and quality and AI guidance standards and assurance, key to which are the Government’s own procurement frameworks. To help us in that quest, we are very pleased to welcome today, from the Department for Science, Innovation and Technology, the Permanent Secretary, Sarah Munby. Sarah has been Permanent Secretary of DSIT since it was set up in February 2023, so she has been there at the beginning of all this. We also have, to my right, David Knott, chief technology officer for the UK Government, Central Digital and Data Office. David joined CDDO as the chief of technology for the UK Government in 2023. We are especially pleased to welcome back to our committee Cat Little CBE, the Permanent Secretary for the Cabinet Office. Cat was appointed as Permanent Secretary at the Cabinet Office in 2023, prior to which she was the second permanent secretary at HM Treasury. All of you are very welcome and we have a very experienced set of witnesses to help us in our quest today. Let us move quickly on to questions. I will start the proceedings, if I may, and ask both Sarah and Cat to answer this, because it is a machinery of Government change. The Central Digital and Data Office, an incubator for AI, was moved from the Cabinet Office to DSIT to support plans for AI adoption in the public sector. If both of you could explain how we are all going to benefit from this change and how it came about, it would be really helpful. Shall we start with you, Cat, because you moved the lot over and then they went to Sarah? They moved from you to Sarah’s Department.

It is worth saying a bit about how it came about and the process, and then we will talk about outcomes and what we are trying to achieve. Both Sarah and I first understood, as part of our access talks with, at that point, the Opposition, that there was likely to be some sort of machinery of Government change in this space. Ahead of the new Labour Government coming into power, we knew that that was something they were interested in. That meant we had a bit of time to understand, prepare and think about what that could involve. From 1 September, all of the oversight, ministerially and at official level, moved across to DSIT, from the Cabinet Office, for CDDO, which is our Central Digital and Data Office, the Government Digital Service, which we will call GDS from now on if that is okay, and i.AI, which is the incubator for AI. That involves a significant number of our staff, and we started with that oversight and a very clear, transparent move. On the process, we are about to transition the accounting officer responsibilities and the supplementary estimates, so you will see that transition through the financial records. On 1 April budgets will move, and then on 1 June the line management and our people will transfer. That is the relatively straightforward bit of the transition. The really difficult bit is how we manage the underlying technical infrastructure. It is a bit like taking a Government start-up and moving it into a much bigger set of architectural technological issues that we have to grapple with. David is obviously our expert in that. In terms of vision, which Sarah should add to, it is important that quite a lot of what we are trying to do here is to resolve some of the challenges that were highlighted in the NAO Report, so, in particular, the observations about complexity and lack of accountability. This is partly about making sure there is a single place for the whole of Government and the economy to grasp the opportunities of technology and AI. It is bringing together in one place policy, delivery and engagement with all of our major stakeholders throughout the whole of the technological centre. What we hope to achieve through the outcomes is exactly as you set out the Prime Minister’s vision for grasping opportunity, putting in place the right guardrails for some of the challenges and risks that we have and making sure that policy and delivery are in lockstep. We are working very closely together in partnership. The final thing I will say is that we have a dedicated MoG team established. We have gone back to the 2010 NAO report on lessons learnt from machinery of Government changes. We have embedded that in everything that we are doing. We also have a joint ministerial team overseeing the MoG in the new digital IMG, which is chaired by the Chancellor of the Duchy of Lancaster and supported by the Chief Secretary to the Treasury and, of course, the Secretary of State for DSIT.

That was a really helpful opening introduction. It has all come to your Department, DSIT, Sarah. Would you like to now set out what your Department’s vision is, using all these various different bodies that you are now in charge of? What is your vision for how this should be taken forward?

I might just add a few small points to what Cat said about the machinery of Government change before talking more broadly about vision. The first thing to note is that the change of Department is one aspect of this, but there is actually a lot of change happening within the units that have transferred. We will come to delivery and output in a second, but from an organisational perspective we have now, as it were, dissolved the various component pieces that made this up that were not under common leadership in the Cabinet Office, except at the Permanent Secretary, absolute top-of-the-shop level. What were the Government Digital Service, which was essentially the delivery organisation driving gov.uk and other cross-Government platforms, CDDO, which was the central strategy, co-ordination and owner of the profession function, and i.AI, which was the incubator for AI-based change are now part of one organisation inside DSIT. We have named that the Government Digital Service. That now encompasses all of these pieces. We are in the process of recruiting a second Permanent Secretary-level Government chief digital officer to lead that entire organisation as a single piece. There is lots to discuss in the NAO Report, but that point about confusion and lack of accountability has been pretty comprehensively addressed by that set of changes. The second thing, though, that is interesting about it, as Cat has said, is what new opportunities this change opens up. We used to face, as the report says, quite a lot of challenges in where the line is between driving change in the public sector and driving change across the economy and wider society. It is things such as how you think about what private sector organisations need to do on fairness and transparency and what Government need to do on fairness and transparency. These are very obviously linked. If you look at the AI Opportunities Action Plan that we just published, it talks about the work to digitise the public sector and the work to support private industry in digitising the whole of the economy being mutually reinforcing. We knew that there would be good examples of the sorts of work we could do more effectively together but, as ever, as you get to know each other better, both parts of the new DSIT are finding more and more ways in which the work has joined up. We have actually moved some pieces of what was the pre-machinery of Government change DSIT into the new GDS part of the organisation to make that work even more effectively. The question is “We have this new machinery. What are we going to do with it?” We started with two things. The first is a pretty comprehensive and, I hope, robust assessment of the starting point. That is the report into the state of digital Government. That is that one if you are following along. That has had a huge amount of input from right across the public sector, beyond central Government as well. Spoiler alert: it is not a good assessment. It says that we have very serious challenges and an enormous amount of work to do to close the gap between reality and ambition. We can talk more about any aspect of that. We have then put out the blueprint, which is to describe what we need to do about that. There is quite a lot of detail in there talking about join-up, making AI a much bigger focus of our digital strategy, having more central infrastructure, working on leadership and talent, changing the way we fund and procure and looking at a much more transparent and accountable way of operating for organisations across Whitehall and, ultimately, the broader public sector. This hearing is, ultimately, beginning from the point of AI in the public sector. I am sure we will dig more into this, but it is worth saying that, if you ask what the strategy for AI in the public sector is, the first important component of the answer is that all of the things to drive digital and data across the public sector are an essential enabler of what we need to do on AI. You cannot look at an AI strategy in isolation from this broader picture, which is why it is picked out as one of the key six things that we are focused on. If we do not get talent and procurement right and do not fund projects in the right way, it does not matter how much you do on making some AI. You will not see systemic change.

We all focus a lot on Government Departments. How are you going to roll out that strategy in other organisations for which you are responsible, such as NDPBs, ALBs and so on? How will you roll that out? I suspect that there are some out there that are way behind the curve at the moment.

That is right. If I may, there are also some that are ahead of the curve and doing rather better. It is an extremely mixed picture, but we have some fantastic digital and technical capability. Organisations connected with my Department that would definitely want to be mentioned would be places such as the Met Office and Ordnance Survey, which are doing some really interesting work in this space. We should not paint everything with the same brush. To answer your question, the scale of the challenge is such that we are not going to be able to do everything everywhere all at once. There is a lot to be done even within central Government. It is also really important that we remember that not all of the activity is going to take place at the centre. The primary delivery of digital and AI change is going to take place within Departments and organisations. The NHS, for example, has a long way to go, but nevertheless a relatively mature programme across all of these topics that is up and running. Nobody is suggesting that we are going to start trying to unpick those things. I would highlight local government as an area where we are particularly keen to move early. That is because there is a huge amount of potential there to improve citizens’ lives through better digital services and an enormous amount of enthusiasm from the sector for support and help in bringing together services and products that many local authorities can make use of. We need to do more work to really bring that to life and to say, “What does that mean in practice?” Which of the programmes that David and I are looking after at the moment are the ones that will add the most value? If I was going to pick one piece of the puzzle outside central Government where we are keen to go after early impact, it would be there, obviously in complete partnership with local government itself. There is a really good response from the LGA to both the blueprint and the diagnosis that gives us some really good direction about where to take that work. It is going to be staged. It is going to take some time. There is a lot of work to get our own house in order in central Government, and we should be very honest about that.

Indeed, and a variable quality of delivery of services too.

How will moving the Central Digital and Data Office and the incubator for AI from the Cabinet Office to DSIT support your plans for AI adoption in the public sector?

It probably goes back to what I said about the interaction between the work that we do on AI in the private sector and the work that we do on AI in the public sector. To unpack that a little bit, if we think about some of the major issues in AI deployment, which I am sure we will go into the detail of, I mentioned fairness and transparency being one. There is also guidance: how do you do this in the way that is right for citizens and compatible with regulation and the law? There is a lot to go after there. Private and public organisations face a lot of the same challenges in dealing with those problems. The same kind of information is helpful. This is an area where, across the economy, a very large proportion of organisations are grappling with similar challenges. We want to make sure that the Government are setting a standard that supports the private sector. It does not always mean making that standard compulsory. In some cases you might want to extend the standards. On cybersecurity for AI, for example, we are taking some of the work done inside Government and starting to bring that into the form of a voluntary commitment for industry, but that will take time. There is join-up there. The second area is that there is a very direct linkage between these two things. We are trying to build a really successful AI economy in the UK, including where we want to be—not just model builders at one end of the funnel, but everything that takes that into implementation. We are an enormous customer. If we are not getting our buying and use of AI companies right, that is directly holding back the UK’s ability to grow a thriving UK AI economy. It is those sorts of interfaces. That is the benefit of what we get. Like any organisational change, you also lose something. That is why Cat and I are working so closely together to make sure that the work that we do is really knitted into the overall vision for, for example, civil service reform, civil service skills and service transformation and public service transformation more broadly. Wherever you sit, you always need to look in more than one direction. Right now, given the pace of change on AI and the scarcity of expertise on AI, a centralised one throat to choke has real benefit.

You are talking about being the gold standard.

Yes.

Rather than bronze.

To be very clear, I do not think that we are the gold standard. We have a lot of evidence for that. When you come to something like how you use AI in a way that is truly cyber secure, or what it means to be completely compliant with data regulations in the UK, the Government need to be gold standard on those points. That is the only way that we will help the whole economy reach gold standard on those points. I do not think that it is an unreasonable ambition, although we have work to do to get there.

How has the governance of the programme for AI adoption into the public sector changed following the move?

Cat has already mentioned the IMG, the inter-ministerial group. That is the primary thing to have in mind. That is, in and of itself, quite an important change, because that is about having multiple members of the Cabinet really focused on the change agenda for Government on digital services. Certainly our teams would really have noticed, from this machinery of Government change, on the one hand a change in their leadership and structures, but also a very significant step up in ministerial engagement on the digital transformation of government, including government use of AI. That is enormously to the benefit of the work. It is channelled through the IMG so that we make sure we are really connected with Treasury, because these issues around how you fund are really critical. We have to have lots of discussions about how much this will both cost and save, importantly, the public purse, and to join up with the missions and the public service reform agenda that Cat’s Department leads on.

To build on what Sarah said, a lot of what we are talking about here is prioritisation, so being very clear about where we are using AI and the whole suite of technology. It is not just about AI. It is about how we bring all of our change and transformation tools together to deliver better service outcomes for the public, deliver the greatest level of productivity and efficiency gain and maximise taxpayer resources when it comes to the public sector. What that group is doing is, in a different way to what we have done before, saying, “Let us prioritise and set the strategy so that the sum of the parts delivers the greatest bang for the buck”. We have had a period where we have done some of that top-down strategy, but there has been a lot of bottom-up organic growth. We are trying to create the conditions for success, create the strategy and the direction and make sure that we also have the bottom-up passion, tools and skills to do this. That is the difference. It is much more strategic, joined up and prioritised.

That is music to our ears. Given the adoption strategy is intended to cover the whole of the public sector—we have talked a bit about central Government—how are you ensuring your governance arrangements include oversight of AI beyond central Government, so into the public sector, local government and things like that?

We have sort of covered that. I do not want to repeat anything we have already said, but do either of you have anything to add to that? Otherwise we will move on, if we may.

We know enough.

Can I clarify some of the things you have said there, Ms Munby? There is a difference between policy and procurement. I absolutely agree with you that policy needs to be centralised, because we need to have one set of policies and so on, and the framework for procurement. When it comes to the actual procurement itself, I want to put the opposite point of view that has been put to us by one of the witnesses, Boardwave. It says that 85% of the venture funding still flows to US firms and the investment gap between UK scale-ups and their overseas counterparts, particularly in the US, means that foreign investors, often from Silicon Valley, dominate larger funding rounds. It then makes the point about smaller companies getting a fair crack at the whip in Government procurement. They say, “Analysis by Tussell revealed that between July 2017 and June 2018, only 397 scale-up companies secured 1,415 public sector contracts”. Without going too much into those figures, it is basically saying that the whole thing is moving so quickly and the big companies have such a stranglehold over the whole thing, so how are we going to encourage particularly British innovation in this field?

This is probably one that Cat and I will both want to come in on. In case my remarks gave the impression that we thought we should be centralising all AI procurement, that is absolutely not the case. We need to have some standards, processes and guidance to, frankly, help people with what is a very challenging procurement journey at the moment, given the pace of change. There is that, plus there will be some things where it makes sense to procure once. This is only indirectly an AI example, but David and I talk a lot about what it is we might want to do about cloud procurement across Government. That is not to say that the default option by any means should be centralised procurement for everything, only where that is really going to add value. I will let Cat talk about the broader point about how procurement drives growth.

This is a really important point and I broadly agree with the sentiment of the witness’s comments. This is an ongoing challenge and has been for some time. We have set up a very small digital commercial centre of expertise. My commercial teams in the Cabinet Office have dedicated digital commercial folk embedded within Departments, and especially those Departments that have very high technological procurement requirements, such as MoD and some of the big digi tech reliant Departments, such as DWP and HMRC. I will give a few bits of information about how we are taking this forward. It is worth reminding ourselves that the CCS frameworks the Crown Commercial Service oversees are set up and designed to try to encourage greater participation from SMEs. If you look at G-Cloud, in 2023-24, 42% of all G-Cloud contracts and spend went to SMEs. We have actively changed the way in which that framework operates. It is about a third of our digital outcomes framework that is currently going to SMEs, and that trend is increasing and growing. We have to learn from why that trend is working and make sure we replicate and scale it. The other thing I would say is that we have to look at the top end and at SMEs and partnerships. We recently launched the memorandum of understanding with Microsoft. That is about scaling discounted benefits and taking advantage of Government’s scale of buying power. We are one of the largest customers of Microsoft globally. We want to pass that benefit to the whole of the public sector. We now have discounted products for every part of the public sector to take advantage of. That is quite groundbreaking. We need to replicate that over and over and make sure that we are focusing on that, where we have got British technology and start-ups in this country that we know we can support.

That is fantastic, but who disseminates that information to all the various parts of Government, particularly, as Ms Gilmour has alluded to, other bits, such as the NDPBs, the ALBs and so on? How do they know that you are doing all that? Does that come from Cabinet Office or does it come from Sarah Munby’s Department?

Quite a lot of it happens in partnership, but the main flow is through our commercial function, because they are the buyers and purchasers who are embedded within Departments, so quite a lot of that will come through the Cabinet Office senior leadership in commercial. We also have our strategic supplier programme, which you are probably aware of from previous inquiries, Sir Geoffrey, where we take the biggest 39 strategic suppliers. Quite a lot of our tech suppliers are in that group. We also have our SME forums, which we are doing much more in partnership with DSIT, because they need to see the common voice from Government and to make sure that policy and what we are doing commercially is aligned.

I think that we are back quite soon talking about exactly this topic, digital procurement across Government, and there is definitely work to do. One thing that you will see in the blueprint, which Cat was just alluding to, is establishing something that looks much more like a joint function, not to do all of these things, because ultimately we need to flow that through the correct structure, but to make sure that the right level of digital expertise and commercial expertise are being plugged together. To bring that to life, some of what really great buying looks like on some of these areas is not, “Okay, you can do a deal and then on you go”. If you want to understand this properly, you should ask David. If you are buying cloud really effectively, there is an ongoing optimisation process, so that you are calling off in the right way small amounts and managing scale. You need real technical expertise to make that work over time. There is still more to do to make that partnership work really effectively, so that we can match the skills of the best in buying digital.

Thank you for that answer. We will be coming to you, David, in a little while on cloud, clean data and all these technical subjects.

I am just going to touch briefly on AI adoption and transparency, if I may. I have been looking at the algorithmic transparency register, and this is meant to record different records from across Government where AI decisioning is being used. You acknowledge that there are hundreds of AI contracts across Government, but there are only 33 records on there. That is not transparent enough, is it, about how AI is being used to inform decision-making across Government?

This is one for me. The ATRS is one of our standards. You are absolutely right. We need to get more out. They are coming. I think that we have another 20 or so coming over February and lots more to follow this year. It is absolutely our view that they should all be out and published. It takes a bit of time to get them up and running. It has not been mandatory for that long, but that is absolutely the target. You will have seen, if you have been following this journey for a while, that there has been a significant acceleration in pace recently. We expect that to continue over the coming year.

You will acknowledge that, at the moment at least, the Government have not been transparent enough about AI records on the algorithmic reporting?

As a matter of fact, it is true that there are 33 records out and there need to be more. We are on that.

Can I turn to an issue around benefit applications and claimant letters? There is a significant degree of health information and very sensitive personal information in relation to those. Are AI decisioning tools having access to that data?

For the precise answer to that question, the right person to ask would be the DWP Permanent Secretary. I do not think that I can answer for every use of AI right across Government in detail. It is important to say that up front. There has been quite a lot of coverage. I think that you are probably talking about the white mail functionality within DWP. We want to see that come on to the ATRS. I know that that is absolutely where DWP is as well. It is important that functions such as that are made transparent. Of course, all of these functions right across Government are being conducted in compliance with our very important data protection obligations, particularly around personal data.

On white mail, you would agree that there has not been enough transparency.

It is coming on to the ATRS.

On my question there, there has not been enough transparency to date.

It currently is not on the ATRS and it is coming on.

So yes. Could I turn to a bit of a false start, as was acknowledged, I think, by the director of the Incubator for Artificial Intelligence, around some of the DWP trials? It looked as though there were some quite promising things in there, but some of the programmes were scrapped. I appreciate that you may not be able to report fully on some DWP aspects. One of the programmes—I think it was called a‑cubed—talked about how it helps steer staff and job seekers into work. It sounds like a great innovation, but it was scrapped. Could you talk about the false start there? Is it the case that sometimes we might see glossy demos but actually scaling them into wider applications becomes too difficult?

That is absolutely, of course, true. Back to the AI Opportunities Action Plan, that has a catchy framing of how to think about AI adoption, which is scan, pilot, scale. By the way, on the scaling challenge, I do not know whether any of you follow Davos coverage, but the, “We have loads of pilots. How do we scale to create value?” was the core discussion at Davos as well. It is not a public sector challenge specifically. You are absolutely right. You want to run pilots, work out what works and then scale them. It is really important that we do not have a mentality that shutting down a pilot that is not delivering value is the wrong thing to do. If all of our pilots were scaled, they were not pilots. Pilots are meant to have gates. The point of test and learn is to actually learn. I do not know the exact details of that case, but I would not say that, if you have multiple pilots running in a Department and several of them are shut down, that is a bad thing. Given that we have to prioritise, we want to work out where the most valuable use cases are and where we have a solution that has user traction, is really working and is able to deliver. Frankly, if I could do something across Government, speaking personally, I would like the move to be potentially to have fewer things done at more scale. That is exactly the same transition that is happening in every large company across the world at the moment. They are moving away from just pilot, pilot, pilot and into a big, scaled solution. That is exactly the transition that the public sector needs to make.

What was perplexing about the a-cubed pilot that was scrapped is that it was actually celebrated in the DWP annual report. It said that it had successfully tested multiple generative AI proofs of concept. Do you feel that sometimes there can be too much early hype and not enough realism? Do you feel that there is enough realism and pragmatism about that culture that some of the early pilots might not work and a few will actually go on to scale?

That is a good question. Probably almost everybody—possibly not quite across the globe, but certainly across large parts of the global economy—is currently going through exactly that question in their minds: “Where is the hype? Where is the value? How do we manage it?” It is not surprising that we have that challenge too. Lessons are learned. We have teams that have been at this for a while. We occasionally get into AI‑ing to AI versus AI-ing to solve user need. There is no particular special merit in AI-ing the public sector. That is not the goal. The goal is productivity, better user experience and better experience for staff. It is certainly true that we, along with everybody else, occasionally fall into the trap of AI-ing something to AI it.

I will just ask my last few questions. There is a real risk that there is quite a lot of divergence across Government on AI adoption and certainly the resource allocation that comes with it. It is really a question of what mechanisms you are putting in place to ensure that consistent implementation and avoid significant amounts of divergence in the adoption of AI across Departments.

There are quite a few bits to this. One is that, as we previously discussed, there will be some things that we want to implement on a—I do not want to say a cross-Government scale, because what does Government mean? It depends what it is. To give you an example, we announced just recently a package of tools for civil servants to help them in their work. This is what has been nicknamed “Humphrey”. That is something where I would expect we will drive adoption for all of the relevant customer groups right across the civil service, rather than doing it individually in Departments, although implementation will look slightly different according to people’s underlying systems. Most of the work needs to be departmental-led, because it needs to be addressing the needs as discussed. I do not think that we have to have a completely symmetrical and consistent approach. There are going to be Departments who should and can be moving faster because of the nature of what they do. We need consistency on leadership and sponsorship, governance and effectiveness. We are working to make sure that Departments have an AI leader, an AI governance set-up and the right level of AI training. Those sorts of issues need to be consistent and some products need to be consistent. Some of the technical architecture needs to be at least built in a way that it can interact. We talk a lot about making sure that, for example, all of the data is increasingly built to have APIs available to make it easier for things to connect. I do not think that our goal is to move as one on all of this.

Finally, do you worry that some Departments are coming from such a low base on digital adoption that it is going to hamper AI adoption? The example that this Committee has heard is around the use of faxes in the NHS. My better half is booking her maternity appointments. They are still using paper wheels to book appointments in the NHS. Thinking about, for example, NHS England in particular, there is some good innovation around adoption of AI in clinical settings, such as radiology and scans and so on. Do you have confidence in some Departments’ ability to start from that low base and reach those levels of efficiencies that we should obtain on the operational side?

That is the right question, because the work that we have just done on where we stand, collectively as a Government, on digital and data more broadly says that we have problems. You cannot just layer the AI on without doing some of the reform to legacy systems, for example the clean-up of data. All of that underlying work has to happen. Do I have confidence? It is going to be a hard road with a lot of work to do. We are very clear that this is not an AI strategy. It is a digital data and AI strategy, building right through the stack so that you can put those AI tools on top. There will be the odd case where AI lets you take a jump forward. I do not think that that is always the case but, for example, one thing that could be holding you back is how you are ultimately delivering a complex set of data to an end user. For example, gov.uk has become now 700,000 pages. We are putting a chat interface on that to help people navigate it. The AI is helping you solve a problem that would otherwise be very difficult to address, but, in the main, we have to get the data and digital foundations right.

Lastly, do you think that my constituents can be confident that the NHS can adopt AI when still using fax machines?

That is probably a question best asked to the NHS. We certainly think that, like most of the other parts of Government, there is a long way to go.

I am going to bring Sarah Hall in in a minute, but I am going to come to you, David Knott, first. I want to touch on one of the questions that Luke Charters raised there. It is very important to maintain public confidence that AI is going to work for them. Equally, if they feel that the ethics of AI are wrong, it could very quickly develop into something that the public are worried about. We have had evidence from Dr Ali Hessami. He says, “Ethics is a key facet of social impact and comprises a number of principal considerations, namely: algorithmic bias; transparency and explainability; accountability; privacy; responsible governance; fairness and redress; safety, security and dependability”. How are Government going to tackle those issues so that the citizen is going to maintain a confidence in AI?

This question is probably at the heart of AI adoption right now. It is how we adopt this relatively new technology in a safe and responsible fashion. It is also one of those areas that illustrates what Sarah was talking about earlier on about the synergy between having the digital part of Government and the policy part of Government in the same Department now. I have technical teams working on technical standards and guidelines to implement this in practice. They are working very closely with the teams working on AI policy and AI regulation to make sure that we can be both the experts and exemplars in this. Fairly shortly after the current wave of the AI revolution, after ChatGPT was released in 2022, we in the Central Digital and Data Office, as it was then, recognised the need to give people really clear guidance. That was not to solve all these problems for them or tell them what ethical use meant in their context, because there is obviously a very wide range of contexts, but to help them to lay out all the considerations they should take into account; that is about how to think about how to use AI responsibly, as well as relevant law and regulation that they should take into account when they are deploying it. That came together into a product we published last year called the Generative AI framework for HM Government. We published it at about this time last year and it has been very widely used. We have seen it being used outside Government in the private sector as well. We think that it is probably the most comprehensive set of guidance for technologists and other adopters across Government. We deliberately positioned that as guidance rather than policy. One thing in the foreword is that it probably uses some words that are unusual in Government guidance. It says that it is both incomplete and dynamic. The reason it uses those words is recognising that, as we have seen with recent events this week, this is a very fast-moving field. We have tried to give people practical guidance that is grounded in reality that they can apply in their particular context, and then to update that on a regular basis as the field changes. As your witnesses probably shared, there are a lot of unsolved problems in the field at the moment. We are encouraging people to do is to be aware and think this through, and to learn from them as well.

David has talked about, as it were, the carrot of helping people. We have also strengthened, if I may, the stick. We have done a lot of work on what the spend controls process looks like and that now involves a much more explicit set of triaging for use of AI, but specifically high-risk use of AI, so where there is AI that is getting into any kind of decision‑making territory for example. That is actually significantly strengthening our assurance and controls in that area, so that, as new spend is signed off, you are embedding external challenge to Departments’ proposals. It is really important that we support and guide, but we also need some of that backstop governance, given the importance of these issues.

I will start and then I might go to David, particularly on the point about how experience is shared across Government, because that is something that is a big part of what he does. In terms of learning from other digital and data transformations, the team that is now leading this work is—of course, people move—broadly speaking, the team that has also been doing the oversight, spend controls, working with Departments and support on all of the data and digital transformation that has come before this. We are not starting new with a load of people and saying, “Hey, make AI for Government”. This is all built off that learning. That is a very organic process. All the learnings about skills being really vital always come out absolutely front and centre when you start looking at this. We are making sure that we have proper leadership and accountability. Lots of the things embedded in here are exactly trying to learn from what has not worked in the past. In terms of sharing expertise across Government and learnings, David, do you want to comment?

There are three mechanisms we are using. One is that—I referenced the guidance we published—part of the role of my team and the new GDS team is to get examples of good practice from across Government, shine a spotlight on them, publish them, either as formal guidance or as case studies, and communicate that. The second is convening communities. We run multiple communities of, typically, technologists across Government. To give an example of two of those, we formed a community of AI practitioners about a year ago. That has about 1,000 members from across Government and the public sector. We are deliberately very inclusive in that. Pretty much anybody who is working in any publicly funded organisation who wants to participate in that can. A lot of our job there is just to give them a place to come together and connect with each other. The third way, which is really important, is that one of our principles in GDS is to build in the open. If I take a practical example of that, one of our signature AI use cases is putting a chatbot in front of some of those 700,000 gov.uk pages to help people to navigate them. We want to do that really responsibly, so make sure we were not giving hallucinated or inaccurate feedback to citizens. The team that built that went through about a year-long journey at a time when, in the field, the state of the art in testing and delivering accurate responses probably changed about four times. They really strongly documented and published their user research and their research about trust and confidence in that and made that publicly available. That makes it available not just to other teams in the public sector trying to implement that, but to anybody. We get feedback that private sector adopters as well really value that.

My view would be that it varies by Department. One thing we have referenced here in this State of digital government review shows that there are many challenges and they are not evenly distributed. We conducted a series of workshops last year with Departments to understand the challenges and obstacles that they are experiencing. The ones that came up most often were exactly the ones you have called out. One of the big four was skills. We are attempting to recruit more heavily and to offer training to people, but skills still remain a challenge. The second one was data. The data they need to use to train models are often locked inside legacy systems and we have had uneven progress in remediating those legacy systems. The third is the maturity of the market. A lot of these solutions depend on buying solutions from the market. As was referenced earlier, part of the reason we are trying to find the right balance between guiding procurement centrally without stifling the ability to buy locally from SMEs is that lots of people want help to understand how they should think about the security of the companies they are buying from and their stability. We are seeing lots of volatility in the market. The fourth one was change management. People are realising now that, as these tools start to show up in people’s daily work, it may be a significant shift to their working patterns. For example, I think that we will be in a future before too long where people have AI assistants as part of their desktop that helps them with drafting documents, writing emails, etc. In some ways, that is a shift about as profound—I think back to earlier in my career—as when we first started putting PCs with graphical interfaces, mice and things on. We had to go through a big change management process. People are aware of those challenges. I would not claim that any of those challenges are profoundly solved. Part of our role in the centre is to try to help people collaborate on solving them. They are trying to get to grips with them, but there is still a lot of work to do to get over them.

Might I add one thing? Whether Departments take this seriously enough is part of your question, I think.

No. It would be wrong not to say, even though it is always hard as an organisation to be truly self-critical, that we have to be self‑critical about digital leadership across Government. It really comes out in the state of the state report. Many non-digital public sector leaders with sizeable delivery responsibilities have insufficient technical expertise or training, lack the digital orientation to implement tech-enabled programmes or do not fully understand mission-critical technology dependencies or high-priority opportunities, such as AI. Digital leaders are not well represented at executive level across the public sector. There are lots of good things, but leadership needs work.

I do not know whether you are going to come on to it, but would it be worth going through some of the things that we are doing on skills in the civil service? You are going to come on to it. That is fine.

That is one of the reasons why what I said about local government at the beginning of the hearing really applies, which is that there is actually an enthusiasm for help and support. To give you an example—we are mid-flow on this, so this is not a done thing—we have from the Incubator for Artificial Intelligence, i.AI, a tool called Minute, which essentially helps you record a conversation or a meeting into a particular format. There are obviously lots of commercial services that do that kind of thing, but this is about being able to put it out in a particular format. At the moment it is optimised for minute-taking for Cabinet-style meetings. There are a lot of local authorities across the country at the moment that are procuring solutions to try to record some case conversations that need to be laid down in particular formats by statute. In terms of the experience to run and manage those procurements, the cost of doing them and the lack of ability to properly assess that, all of those challenges that you are talking about are real and we have the potential prospect of being able to offer something that is open-source, optimised for a public sector environment and well tested for all of the transparency and data compliance issues at cost or whatever. We have to work on whether that is really correct and do more analysis, but those are the sorts of things that you can imagine doing that, rather than putting on more burden, actually take burden off hard‑pressed and challenged teams, not just in local authorities but across the wider public sector as well.

I will start with the second part of that question and David should add on the specific targets for professionals. At macro level, we have a huge challenge and we are not alone. The private sector and other public sector organisations around the world are facing exactly the same challenge of how you upskill your general workforce at the same time as deploying at scale these technologies and making sure you have professional experts at scale. We are all competing for the same people and that is a massive challenge for central Government and the civil service. I will start with what we are doing to upskill the general civil service. We have set out a digital excellence programme, which is for all civil servants at grade 7 and above. That has currently taught 2,500 or so senior colleagues on the basics of what AI is, how you deploy it, what the opportunities are and how you act as an intelligent customer of some of the services that you can now adopt. I am a great believer that it starts with leadership. We have to set the tone. In fact, all Permanent Secretaries have been on a couple of away days on AI in detail to make sure that we are keeping our own skills up to date, but there is more of that we need to do. For the whole of the civil service, we have modules on our learning and development platform looking at AI ethics, AI tools and applications, how to get them, how to use them, what to think about and how you might apply some of these tools to use cases. The NAO Report commented on One Big Thing. We have only done this for the last two years, but this is our at-scale training approach for all of the civil service. We started with data. As David said, that is one of the biggest challenges, so knowing what data you need, deploying it, sharing it and making sure the quality of data is right. We trained 34% of the civil service on data as part of our first One Big Thing. We are partway through innovation, which has application for AI and how you actually choose to use AI in your problem solving. About a third of the civil service has already gone through our innovation masterclasses. AI itself will be a candidate for the next stage of One Big Thing. We are also creating a specific digital data and innovation pathway to give even more in-depth learning and development for people who need it as part of their jobs. In the actual profession, one big challenge we have is getting a reduction in contingent labour. The NAO Report looks at the phenomenal level of contingent labour and contractors that we are having to use in this space. We have introduced the DDaT pay framework, which is now deployed across nearly all Government Departments. There are a few that we have to still onboard it to. Pay and, fundamentally, being able to compete with other sectors is part of it. It is not going to be fully competitive and we should be frank about that. We have tried to peg the pay framework in a way that is competitive and does enough while maximising value for money. We know that we need to have different specific entry routes. We have got the digital fast stream, the TechTrack and targets for new digital apprenticeships also. That is the holistic package. The final thing I will say, though, is that I have just come back from the Global Government Summit, where I have been meeting with countries around the world and talking about some of these issues. I genuinely think that we are the most advanced in quite a lot of our thinking on skills, but every single part of the economy is struggling with this question. We have to constantly evaluate and look at why we are struggling to convert, recruit and retain some of these skills in the round. David and his team will lead on that for the profession.

I will just comment on where we are on progress toward that target. We were set a target of 6%. To be honest, even the target of 6% we always regarded as a milestone on the journey, not the final destination. If you look at comparable organisations that have a similar resource mix to civil service Departments, you typically expect the private sector to see between 8% and 12%, depending on the industry, so even 6% is not enough. Of that 6% we have got to about 5.4%. That is higher than it was, but still not enough. The measures that Cat described are increasing the trajectory, but we are conscious that we need to steepen that slope quite significantly. I would also comment that, again, as mentioned in the State of digital government report, that is not evenly distributed. That describes central Government Departments. There are some areas, particularly the bodies that Sarah mentioned earlier, such as the Met Office and the ONS, that are specialist areas. They will have percentages as high as 15%, but they are the outliers. In other areas such as the NHS and local government—it is not a perfect read-across, because they have a slightly different workforce mix—they are in much lower percentages and have a challenge. One thing to add in describing the challenge and the problem that we have is that, as well as significant dependence on third parties and outsourcing organisations, our analysis also shows that, even within that percentage, our distribution of roles is not quite right. We would like to see many more deep technical roles—engineers, data scientists and model builders, etc. Our split at the moment is too skewed towards people who are in the digital data profession but doing fewer of the technical roles, because the technical roles tend to be the ones that are most heavily outsourced, so looking at how we bring those back into the civil service will be a key priority.

I want to come back in with a question on this, because these skills are so important. You might have anticipated that I would ask this question, because I asked it to the Prime Minister in the Liaison Committee the other day. In the NAO Report, paragraph 3.3 on page 45 shows that you have around 4,000 vacancies in the digital and AI sector. It is all very well, and it is a good thing, to do the things that you were telling Ms Hall in terms of training up your existing civil servants, but what I am really interested in—and it was a very thoughtful remark that you made, Ms Little—is how you are thinking about how to improve the pipeline of people who might want to come into digital and AI in Government. That is two-fold, really. It is promoting it within schools and colleges as an attractive area to go into, and that must be accompanied by pay. You were candid enough, Ms Munby, to quote from your State of digital government review, which says, “35%: Pay gap (%) between public and private sector for technical architects; equivalent to £30,000 a year”. You are quite right that there is a huge problem. How do you recruit and retain people in the public sector to fill these 4,000 gaps? How do you encourage today’s students? This is a young person’s field. Today’s students will become tomorrow’s digital and AI specialists, so this is a really important aspect.

I could not agree more, and I am sure that Sarah and David will both want to answer this, because it is probably the biggest challenge that we have to grapple with. We have to create more porosity between the private sector and the civil service, Government and the public sector generally. I speak as someone who came from the private sector. It is not just about money. It is about public service and the opportunity to deliver great outcomes for the country that you care about. In all of our outreach work, and all the polling and understanding of what attracts people to work in the public sector, pay is not the dominant factor. It needs us to amplify that sense of public duty and the opportunity to serve. What we tend to find is that people want to come and do a secondment period in Government. They see it as an incredibly rich, diverse and challenging environment to be within, but they might not want to stay here. Dare I say that is okay. They do not have to stay in the civil service or in the public sector, and the same is true of our civil servants. I passionately believe that it is right that we create the conditions where civil servants can go and do tours of duty in the private sector, and enrich themselves in different ways in other parts of the public sector. As the Chancellor of the Duchy of Lancaster said in his speech just before Christmas, we are looking at these tours of duty and really cracking this secondment challenge, as well as building on what the employment offer for the civil service is, in a way that really plays up some of the benefits. We also do not talk enough about the pension as part of our remuneration package. It is an incredibly generous pension. We have to look at all of the factors to attract people into what we do.

Ms Munby, I can see that you are anxious to come in on this.

It is such an important topic. I really agree with everything that Cat said. We can do a lot on some of those things. We have made secondments quite a big priority in DSIT. We brought over 100 into our new programme in the first year of the Department’s creation, and I am looking forward to expanding that thinking into the new bits of the Department. I would add one other thing, though. I really agree that it is not all about the money, but it is about impact. Where we have teams who feel respected and valued, whose work follows through into scale-up and delivery, and who can see that they are having an impact on people’s lives across the country, recruitment works. Where recruitment does not work is where experienced digital professionals feel that they are not heard and not properly integrated in what can be policy-led teams with excessively hard barriers around the edge. There are tools of pay, recruitment processes and all of these things. We should be brilliant at all of that, and I do not, in any way, dismiss it, but the work is the thing that will really get people in. If we can really demonstrate that the UK, and the UK Government, is a leading place to drive digital transformation, which, in pockets, it already is, our recruitment problems will look much easier to solve.

I was looking for the evidence, but we have had evidence that, in the private sector, for example, the chief digital information officer would be one of the most senior persons—if not the most senior—in the company. That does not appear to be the same in the Government, and I wonder what the Government are doing to make sure that more information and digital specialists are at the very senior level within each of their organisation’s teams.

It is just after the bit that I was quoting earlier in this report. It talks exactly about that point: that CDIOs are not sufficiently represented at the executive committee level. Of course, that is then replicated in all sorts of ways down the organisation. As part of the blueprint, we talk about that being set as a much stronger and clearer norm across Government. We have also been doing work, even before the machinery of Government changes, on making sure that all groups of non-executives of Government Departments have serious digital representation at that level. Both of those things are helpful, and we should do them, but it is also about making sure that that is embedded into the way teams then behave right through the organisation, which comes back to the leadership challenge that I was mentioning.

This is always a dangerous thing to do, but I am going to do it. I have not consulted the C&AG on this, but I am wondering whether we could have a passage in each organisation’s annual report and accounts on their progress on digital and AI transformation. That might be an idea that all of you take away.

Hear, hear.

It sounds as though we have a thumbs-up to that.

Good morning to our witnesses. I would like to go back to pilots, but look at them from an evaluative point of view. You were quite clear that there has been a lot of experimentation. In an innovation environment, you do want lots of things going on, but at some point you have to know which ones to stop and which ones to progress. Given that you have used language like “dynamic” and “fast-paced”, I just wondered what evaluative methodologies you are able to even employ to know what is and is not working.

There are lots of tools and techniques out there, but the evaluation taskforce, which sits across the Treasury and the Cabinet Office, has just published its evaluation framework for AI. I am not a specialist in evaluation, but it is the first time that we have tried to set that out comprehensively in one place, including the research tools and methodologies, and how you can draw on experts in evaluation to support AI evaluation generally. There is quite a lot of guidance on evaluating these programmes from a financial, commercial and, of course, technological perspective. Having the guidance is one thing, but making sure that people understand it, can use it and know who to turn to to get support is really the challenge that we will need to work through.

In the way that you have talked about workforce and skilling up, it is about making sure that the analysts who are embedded, but also the research community on the outside, are equipped to take on some of that advice. Thank you for flagging that. Coming to the outcomes, you talked there about the financial perspective. What are the key outcomes that you would be looking for from these evaluations of pilots in order to inform a decision about whether there is a scalability there and what the benefit realisation would be?

As Sarah alluded to earlier, we are not doing AI just for AI’s sake. You would hope that, at the start, you have a clear outcome and benefits objective, or a problem that you are trying to solve as you develop use cases. I would simplify it to say that there has to be some sort of service outcome improvement. We are absolutely going after productivity, whether that is for our workforce or for the end user or citizen. By “productivity”, I specifically mean freeing up input so that we can use it elsewhere on other value-added activities. We are looking for efficiency and cost savings. That has to be a part of it. We talked a bit about quality earlier. The quality and consistency of decision-making are probably some of the harder things to evaluate, but they are the kinds of big benefits that we are looking for across the board.

You have a mix of projects at the moment, some of which are more just operational and making processes more efficient, where I can see some of those metrics. When you start to get into the more generative AI and its use in decision-making support, I would suggest that that poses particular challenges for trying to evaluate. David, do you want to add anything more about an approach to evaluation that is able to address that?

I do not have much more to add beyond what Cat said already. The people whose job it is to figure out how evaluations should work are working on this and being supported by the technologists. We are probably seeing that generative AI in particular, or the interpretation and productive language, is being used less extensively in decision-making, largely because it is just less suitable for decision-making. For uses in decision-making, the kind of thing that would appear in the ATRS records, etc, are things that are more traditional AI—it seems odd to describe a new field of AI as traditional—from a few years ago, which was more classic algorithmic machine learning.

In terms of these pilot initiatives, it seems very much that Departments pick their issues and work on them. Clearly, there are some things, as we have already talked about, that are common across Government Departments and the public sector. We have heard about many of them through this Committee, such as identity verification. You talked there about case notes, for example, which would be relevant. How are you ensuring that, where there are opportunities for larger-scale testing and, indeed, not reinventing the wheel, that is happening at the earliest stage, rather than waiting for lots of pilots and then going, “There are six that are all the same”, and then trying to stitch them together at that stage?

First of all, I am really glad that you mentioned identity, because we just announced that one of the central products that we are going to be building to solve exactly that kind of problem is a wallet. That will allow digital credentials to be uploaded into a Government wallet. What that means is that any Department that has a use case that involves proving your identity, either digitally or physically, can use a common set of frameworks. That should be both lower-cost, because it prevents you procuring a load of other, frankly, costly and inconsistent things, but also a much better user experience, because it is consistent, understandable and transparent, and all of those good things. That is an excellent example of a collective use case that we are acting on at the moment. We have said that, around the time of the spending review or maybe a little after—and let us see—we will come up with a new digital and AI roadmap for Government. That is really about taking the vision and direction that is put into the blueprint and starting to talk about the set of deliverable projects. On the AI side, the most important bit of work that we are in now, but which is not ready for prime time, is identifying, across the picture, which are the use cases where there is the most value, broadly defined in line with everything that Cat said, and where there is sufficient consistency for it really to make sense to work on a solution together. For example, at the moment, there are a couple of products in Government that support agents who work directly with the public, such as in call centres, with, in essence, a behind-the-scenes chatbot that helps them search more quickly for the information that the person they are interacting with might need. i.AI has a product that it is piloting or, indeed, scaling with Citizens Advice, called Caddy. The question is, “How much commonality is there in that use case across Government? Is there sufficient commonality for it to make sense to do it centrally, or is there a subset of Government that we should be scaling that across?” I am sorry to get nitty gritty, but we just have to work through that and then come up with, “These are the big ones, this is the scope that we are trying to scale them across, and this is the programme plan for making it happen”.

We are very grateful that you have given us those. Hopefully, it will deal with one of the issues that we were looking at the other week, which is fraudulent registration of companies. Please solve as many of these problems in a collective way. That would be encouraging. My final quick question was this point about how much you are AI makers or takers. Are you going to continue in this new structure while you are pushing for scale, which is absolutely the right thing? Will you continue to have some sort of incubation or innovation, so that we are not always going to be AI takers, as in the public sector always having to buy in, but will continue to be AI making, where we can have open source or our own solutions?

I might ask David to add to my answer on this one. In essence, of course you need a mix. There are going to be things where what we should be doing is buying low-cost, off-the-shelf solutions at scale, and can be delivered instantly to thousands or millions of users. There are going to be specific cases where what we need is a particular product for a particular use case. That use case, in some cases, will be so specific that it is really a Government use case. There, being able to build, protect and govern in-house, and implement at scale, makes sense. In our current vision for how GDS will evolve, we imagine an incubator function being permanently part of it.

Would one of the criteria be security, though, because the issue is too sensitive to leave it to the private sector?

Yes, although it is fair to say that, done right, you can get high-security solutions from the private sector.

I definitely agree with what Sarah said. Part of our role is to work with colleagues in the more sensitive parts of Government and to make sure that any market solutions are fit. The only thing that I would add to what Sarah was saying is that the answer to what we take and what we make will probably also change over time. As I said before, this is a highly dynamic market. Things will happen where we will say, “Here is an opportunity where we need to build a solution right now”. Twelve months later, there may be a product on the market that does it better, and our best choice may be to switch to the commercial product. Vice versa, we may see pricing for commercial products go up, and decide that it makes more sense for us to buy it. Part of our role is just to keep a really dynamic view of that market and find the right answer for the day.

The Chinese example the other day has just proved that the existing systems can very rapidly be overtaken.

I have so many questions around these areas, but I will try to focus on just one or two. We have moved from ID cards to ID wallets, have we?

They are quite different, because the wallet is, essentially, about being able to digitise credentials that already exist. We have talked about, for example, a digital driving licence, which is, in essence, no different from your current driving licence, except that you do not have to physically carry your driving licence card. It also means that, when you show your driving licence at the moment, your address is on it, and you can only use your driving licence to prove your age by also revealing your address. A digital driving licence allows you to change that. It is really just about a better, modern version of the things that we currently have.

Presumably, in terms of the sharing that needs to go on in Government, that information for one purpose in the wallet could be used by other Government Departments for other purposes.

That is not just a function of the wallet. That could be true whether or not you have a wallet. Data sharing across Government and making it easier for information to be shared across Departments is important, but always needs to be done with the right authorisations by the person involved.

Just moving on to data and data sharing, your reports have said that this is absolutely key to getting this right. AI with bad historic data that is no longer fit for purpose is not going to be of any use at all. What are you doing to encourage Departments to address the issue of data, how they hold it and how usable it is? Is it your role to prompt Departments to do it, or is it to be there to help Departments if they come to you for advice?

It is both. It definitely goes a lot further than just, “Come and ask us if you are interested”. It needs to, because we need to make a lot of progress. I will come in one second to what we have been doing in terms of results to date. It is just worth mentioning that everybody is due an update on our plans that have already been announced for a national data library, which is an initiative to really try to accelerate work on data sharing right across Government. We are not starting from scratch, because the team that was previously CDDO has been working on this issue for a while, essentially trying to identify the critical data assets across Government. They have identified 191 what we call ESDAs, or essential shared data assets, and have started putting them into a form that makes it easier to share them across Government through a data marketplace that is in beta at the moment, with 120 assets on it. Those are good and useful things. Nevertheless, the amount of work that needs to be done to get you to the vision that is described here, where you are really using shared data across Government, is a lot. Going back to what we have been talking about in other themes—and I am sorry to harp on about the same topics—skills and culture, and all of those things, are just as important in the data arena as they are in digital.

I just want to pick a few issues up there. One is about culture. You mentioned it, so I will home in on that. The NHS has massive data challenges and massive challenges of potential to use AI and bring the administration of services into the modern world. I sponsored a project at the Sheffield teaching hospital, where they are using AI there to do investigations into heart defects. It is absolutely incredible, with an increase in productivity of 10 times in terms of how quickly they can go into and look at 3D images of a heart. Next door, you will find that, “No, we cannot send electronic messages out to patients, because it is far too sensitive and breaches confidentiality. We have to send letters”. It is in the same building. How do we get that culture changed so that everyone is thinking about how we can use AI and digital productively and safely?

It is really important, of course, to caveat that we want culture change, but in compliance with both the law and good principles of public service around fairness and transparency and so on. I would not want to suggest that everybody should just get into data sharing. I am much closer to examples within central Government, and so, if you do not mind, I will use one from there. What we see between Departments in central Government is that it is not just an abstract culture problem. It really relates to incentives. I have my data. I have a set of legal obligations around my data. It might be useful to somebody else in Government. The reward for the use of that data sits at the user end, and the risk sits at the supplier end. Individual organisations or parts of Government may be making quite rational decisions about what is in their interest, but trying to get Government to really think more about the collective interest of the public on this topic is the unlock. That is the biggest single cultural challenge that we face in this arena. It is a mismatch of incentives and, therefore, we should be careful, but not to the point of being so risk-averse that it impedes public outcomes.

These are just examples where inefficiencies are so obvious but are not being addressed by anybody. In the NHS again—and I know we have to use examples, but it is one that affects so many people—data held by GPs about their patients does not relate to that held by hospitals about the same patients. It is just mind-blowing that we have developed systems in that way. Going back to Covid, we had people who had no concept about the places where they were talking to people on the Covid helplines, yet the data could not be given to public health directors, who could have gone into those communities and been much more effective about the uptake of Covid vaccinations. Again, it was a data blockage and an inability to share. What are we going to do to break down some of those barriers in Government?

Perhaps as one small example of something that we are currently in the process of doing, the data Bill contains measures around health data. One is always at risk of boring on these points, but it is designed to try to standardise structures and formats of data across different parts of the health system, because that is a practical enabler of making this easier. I am not saying, by the way, that this is the magic bullet that makes all the problems go away, but it is evidence that we are working on this issue.

That is a big challenge. You have mentioned local government. I can think back to days of the Audit Commission when I was in local government. They desperately tried to look at value for money across councils. The problem was that the information that they had was all on different bases. When you look at local government, there is a multiplicity of audits. How are you going to encourage them to standardise data in such a way that makes comparisons possible? That is a challenge, presumably, across Government, but particularly where you have lots of bodies doing similar things, but probably collecting the information in different ways.

We have a lot to do there, and you have to go after it chunk by chunk. What are the most important things that you can share? How do you go after it? In terms of the sorts of programmes that we are talking about, we have a programme that has been going for a while called One Login, which is about enabling you to log into multiple Government services using one login, but the effect is that it allows Government to recognise you across different services. As you onboard Departments onto that service, which, at its core, is just about providing an immediately better user experience, you are also bringing them into an ecosystem that gives you the capability, although not yet triggered, to allow them to authorise data sharing across those different services and to give real-time updates. Those are the sorts of changes that we are trying to make in order to bring to light the vision that we have talked about in terms of more responsive services. One Login has been a journey of onboarding Department after Department, working through the legacy systems, getting it into the right form, and putting them on to a shared way of doing things. It is just work, and it takes time, energy and resource to get it right.

Is the knowledge hub that you are creating a place to which Departments and organisations can come to get help and assistance on these issues in terms of how to do things properly, how to do them safely, and how to learn from experience elsewhere?

Yes, exactly. The AI knowledge hub is meant to do exactly that. There are some really outstanding pieces of guidance out there. I would not say that our problem at the moment is that we do not have good guidance. We have lots of bits of good guidance. We talked about people in local government who are trying to do a whole load of stuff with not quite enough resource. What we need is to make the guidance accessible and user-friendly, and trying to bring it together in one place is part of that.

That is going to be up and running in the summer, is it?

Yes, that is right.

Is the published guidance to go with it available now?

Some of it will be about taking bits of guidance that already exist. The ICO, for example, has very extensive guidance on this issue. Some of it is the iteration that we are currently working on, such as the next version of that generative AI framework that David was talking about.

I am just going to pick up the issue of legacy systems. This has been mentioned as a very significant barrier. We are spending a lot of money on maintaining these legacy systems, and it is frustrating for staff if there is lots of time wasted on workarounds. This is a very simple question. How are you getting on with getting rid of all the legacy assets that are holding back this digital transformation?

This is David’s favourite topic, so I should let him take it.

Yes, it is my favourite topic. I have dealt with legacy stuff in the private and the public sector. I would start by saying that this is a topic that plagues everybody who runs any kind of complex technology at all across the private and public sector. Maybe I will recap on what we have done to date and then why that is probably still not enough.

Briefly, if you can, because I know that we are pushed for time.

In the digital and data roadmap that we have been running to in CDDO, which was due to conclude this year, we introduced some approaches to help quantify the legacy problem and to try to accelerate treatment of it. The key tools there were a legacy risk framework, which allowed people to identify the worst of the worst. We also had, in the spending review, funding that was allocated to legacy remediation, as well as cyber risk reduction. The headline on that was that Departments signed up to rate their systems using the legacy risk framework. They identified a few hundred. Of those, about 72 were regarded as what is called “red rated”, which translates as “very bad”, with a high likelihood and high impact of failure. About 51 of those, when we last measured them, had remediation plans. That is giving us visibility. It is not fixing the problem in its own right. In terms of execution, one of the challenges that we have seen with legacy is that, even though many of those remediation plans were executed and legacy systems were exited, legacy is a function of time. These are, basically, old systems. Time passes, and systems continue to get older and age into a state where they are difficult to support. Despite all of those measures, the number of those worst-of-the-worst legacy systems that we measured went up rather than down.

Is that because new ones have moved into that category?

Yes, new ones have moved in, time has passed, and they have not been fixed. Evidently, we helped describe the problem but did not help solve it. There is no magic bullet here and, to quote Sarah, a lot of this is just work.

I assume that you will be putting in bids again to the next spending review to, basically, deal again with funding.

Yes, exactly. The three lessons that we have learned are that the problem is big and we have not solved it, so there is more effort required. The new GDS plays a strong role in working with the Treasury and reviewing all of the investment bids coming through from Departments. We will be reviewing those both for, where they propose to tackle legacy, whether that is a credible bid or whether they need help to do it. Secondly, what we are also, crucially, measuring this time is how much of their legacy estate they are tackling. As we review bids and feed back, we will be asking whether each Department is going at this with sufficient will. The other thing that we found as a lesson from last time is that we were not strong enough in tracking whether the money allocated to remediate legacy was used to remediate legacy. Often, there were challenges of resourcing and bandwidth priority, which means that the work was on the books but just could not get it done. As I said, it is going to be continued, nitty-gritty, hard work over many years. We are just trying to get a better grip and better control of it this time around.

Is there any way of stopping us getting into this position? Is it a bottomless pit, where, every year, there will be just a new lot of legacy? Is this money that, basically, we will be spending in perpetuity, or is some new way of procuring going to solve this?

One of the things that we are working on with Treasury, as mentioned in their modern Government digital blueprint, is about new ways of funding. One of the ways that other organisations, in both the public and the private sector, have put plug in the bottom of the legacy path is by funding on a continuous improvement basis. Typically, our funding models in the past have been very project-focused. The phrase that I tend to use is that we build for decades—and we now know that, when we build systems, they will be around for decades—but we fund for years. We fund for the period of the programme, and then, when the programme stops, so does funding and the system falls into a state of decay. Modern practice is to set up continuous funding lines for systems, and to recognise that, when you onboard a system into your estate, it is not just the upfront purchase. There is an ongoing cost of keeping it current. We will be working with Treasury to see how we can embed those funding lines. We are going to pilot that model. It will still take years to get rid of the current legacy estate, but, hopefully, that means that we are not doing legacy forever.

I confess to having some insights from the MoD. Procurement is a really important issue with getting AI up to speed, because the MoD IT equipment is not the same level as commercial IT equipment. That is because of the weakness of their procurement systems. With that information in mind, maybe it is worth going back to how they procure, what they procure, and changing that procurement system so that they are procuring something that is more AI-compatible or will lead them into an AI system.

Yes, I agree. We referenced the other NAO Report, which we will be coming back to you on shortly. What you said is entirely in line with the findings of that report.

Ms Munby, you are sitting there as the guardian of all this digital policy. At the top end, how are you going to influence the bigger Departments—Health and DWP—to conform to a Government strategy? At the bottom end are Departments such as Defra, which have huge amounts of legacy, or even MoD, as Ms Gilmour has just said. How are you going to exercise your function of trying to bring the whole of Government up to speed with digital and AI in the way that the Prime Minister wants us to do?

There is lots to that. It is worth saying that it is not a one-size-fits-all, because the partnership between the digital centre and DWP, which has a scaled digital team of its own and is well beyond minimum efficient scale for that, looks really quite different to a smaller Department. If I take what DSIT was like before the machinery of Government change, we would not have had that much in-house need for that sort of capability. Those two look very different. We often find that the smaller organisations, such as ALBs, which we talked about earlier, or regulators and so on, are also crying out for support and really need it. Everyone in the room has been around the block on driving change on a cross-Government basis, and I am sure that Cat has plenty of views on this. In my personal experience, for what it is worth, there is one thing that makes you really effective, and that is really clear political sponsorship. We are incredibly advantaged right now, in this moment, by the fact that not only do we have a Secretary of State in DSIT, and CDL and CST, really backing this agenda, but the Prime Minister has also made it a critical priority for Departments. When you have that kind of cover, we, as the civil service, are really pretty good at marshalling the thing to deliver against the priority. What has been a problem—and this is not about any specific preceding Government, but Governments over really a period of a very long time—is that this agenda has not received sufficient prioritisation and political cover to enable really successful delivery. Trying to drive co-ordination across Departments that rightly owe their accountability and allegiances to individual Secretaries of State is always very challenging if you do not have that kind of sponsorship.

That is the theory, Mr Knott. You have heard how it should work. Tell us now how it is going to work. The old maxim is very clear on this—“Rubbish in, rubbish out”. If you do not get the data right and get rid of the legacy systems, you are not going to be in a position to move on to AI. It is a matter of urgency to deal with these legacy systems, is it not? Otherwise, Departments like Defra will not be able to move satisfactorily on to AI.

I would probably compound that by saying that it is a matter of urgency not just for AI, but for other mechanisms as well. There was an NAO Report published on cyber security yesterday, which points to legacy as one of the primary sources of vulnerabilities. As I said, there is no single magic bullet here. I have been trying to remediate legacy systems for many years in my career. The only solution is to knuckle down and do hard work over extended periods of time. The primary vehicle for us is to do amped-up versions of the mechanisms that we tried before, which is funding, which we generally track, that goes in the right places and makes a difference, coupled with an amplification of the risk measurements that we have been trying before, which is useful but really only a start. Other industries have much more sophisticated measures and risks that carry clear accountability associated with them. It is about really clear measurement and metrics, coupled with using that data to drive funding choices. The reason I say that is that fixing the legacy systems will always be a question of compromise. The problem is bigger than we could fix in any one Parliament or spending review. Our big choice, going back to one of the themes of this conversation, is prioritisation. Which are the systems that have the most valuable data, where investing in those will unlock the data? Which are the systems that carry the highest levels of security vulnerability and that we can fix? It is only a matter of using data to drive focus and to drive the investments that we are going to oversee.

We touched on it earlier, but there are things such as public cloud hosting, which will trace all of these legacy systems and put clean data on to the cloud. This technology is moving very quickly. How up to speed are you with that? Could we not use the new technology, both digitally and in AI, to find these legacy systems, clean them up and put them into the cloud?

There are definitely tools there that will help us. Cloud probably helps us in two ways. Apologies for getting slightly technical, but, if I divide our systems into the software layer and the hardware layer, we have legacy problems in both. We have out-of-date hardware that is going to fail, and out-of-date software that nobody understands. Cloud really helps us in the hardware layer, because we can move out of leased and owned data centres, get Government out of the business of running big buildings in the middle of nowhere, and move to subscribing to that as a service. Government have had a cloud-first policy since 2013. Compared to other industries, the move in central Government to cloud is quite advanced. Over 60% of our systems have moved to cloud. That helps us at the hardware layer. It does not fix everything at the software layer. It is still our code. There is definitely a technology opportunity with these new technologies. One of the often mentioned uses of AI is as a coding assistant to make sense of existing code and to automatically produce code. The jury is slightly out, as it is for lots of AI things, in terms of how successful that is at grappling with really old legacy code, where there are lots of examples on the internet for people to train models on, but it is definitely a tool that can help us. As I mentioned earlier, we are running, through my team, wide-scale experiments across Government on the impact of coding assistants. We do not have the data in yet, but that will probably help us accelerate by about 10% to 15%, which is definitely worth having. I do not think that we will find the model where we can feed in all of our own legacy code and get nice, clean code out the other side. Cloud technologies definitely help us with data, but, again, they do not solve the problem. When moving datasets to the cloud, we get access to new means of accessing and analysing data, which is partly because a lot of the companies that build cloud platforms are also global companies that are probably some of the best companies in the world at data. Again, that helps us find the problems. It does not necessarily help us with all the cleansing, because, at the end of the day, it might tell us that something looks wrong, but a human being will probably have to go and look at something that looks wrong and figure out how to fix it. It will help, but it is not a magic bullet, and there is still a lot of work to do.

Nevertheless, if you are pointed to where you need to go for a solution, that is halfway or three-quarters of the way there to fixing it, surely.

Yes.

I am trying to focus on the issue of procurement, which Rachel Gilmour has already raised a specific question about. Are there the skills in Government to procure safely and effectively? What worries me is that you are procuring from companies in this area that have a lot more skills—and probably a lot more people skills—than there are in Government. Is the client sufficiently capable to get the best procurement from very experienced and expert contractors?

It has been a major challenge for Government to upskill our commercial and procurement teams for many years now, and it is ongoing. We have 6,000 digital commercial experts across Government, who are working in very specialised areas. Many of those people have come from the private sector to join Government. We can always do much more. We are continuing to recruit more specialist procurement skills. We need to build that partnership in the centre that Sarah talked about earlier. It is getting much better, and I very much recognise what Rachel said earlier. Having run the commercial function in the MoD, I have seen firsthand some of these challenges. It is constantly getting better, but we must never get complacent.

Is it the role of the centre to provide advice to Departments in this area or to physically go in and put people into the teams that are doing the procurement to help them do it?

We have dedicated teams in the Cabinet Office that we parachute in on complex transactions and specific digital procurement areas. That has existed and worked very well for a long time.

That is great, but they are not there to manage the contracts as they run on.

Contract management is a really big area of focus for us. Over the last 10 years, we have been training contract managers. We segregate our contracts into gold, silver and bronze. There are different skills and levels of training that those contract managers need to go to, and we are constantly trying to push up the levels of training and capability. It is by no means 100%, and it needs to get better, but that is a whole dedicated programme of work in Government.

Can I just say something very quickly? I would like to say to Ms Munby, to Catherine and to David Knott that this is the first time since I have been on this Committee that I have heard civil servants talk about wanting to be gold standard. For that, I absolutely commend you, and I hope you reach and keep that gold standard. Thank you very much.

I just have an offer. Would you like to give one sentence each on any reflections from DeepSeek and the lessons for the UK Government?

The opportunity is even bigger than we thought.

Gosh, how do you follow that up? Maybe not in one sentence, but it has taught us a lot about the pace of technology and just how we have to keep abreast of it.

The field is volatile at the moment, and we need the skills to keep on top of it.

We touched briefly on trust. In evidence that we received from Professor Michael Wooldridge, he said that transparency is essential to build trust. My colleague, Luke, already talked about the algorithmic transparency recording standard. I just wondered if you might say something more, particularly around data handling and public trust. We have seen, in the NHS, particular fears of handing over large amounts of personal data to a US-based company—in this case Palantir—but also the distrust that arises and the difficulties for benefit claimants, for example, where they know that there is some decision-making algorithm. If they get a benefit suspension or an incorrect overpayment, their ability to challenge these decisions is really limited if these things are not transparent. I am just concerned that there are still too many things out there that are undermining public trust. I just wanted to have some reassurances from you about what you think your top priority actions are that are going to provide that reassurance to my constituents and the wider public.

First of all, on automated decision-making, there is quite an extensive set of provisions in the data Bill that are about making sure that, where automated decision-making takes place, there are really good forms of redress, including the ability to challenge. Getting the law right is an important component of this. A second component is that there is more to do on transparency. We were reflecting that our guidance, for example, asks that, if you are giving somebody a letter or an email that has been produced by AI, you say that. That is not about a data protection point. It is about demonstrably being trustworthy and, therefore, driving trust. There is also just more to do—and this is on our plate—on how we talk to and communicate with people across the country on this issue, because it is complex. We know that it has not always been done right by every organisation in the public or private sector. We have to both be trustworthy and help people understand and believe that we are, in order to get trust, which is what we need to drive the change. We are doing some good things, but going even further in being demonstrably trustworthy is a really important part of the agenda for the next few years. Ultimately, if we do not do that, it will become a blocker on progress.

We are in danger of losing quorum on the Committee, so I have a big question that, Ms Munby, you may want to write to me about. How do we keep the legal frameworks up to date? There is currently a debate on artists’ copyright and so on, but there are lots of other legal frameworks that need to be kept up to date. If you can give me a 30-second answer now, that is fine, but, I am more than happy if you want to write to me.

As a 30-second answer, we have a consultation out now on copyright. It is a really important issue. We are trying to tread the right path. Feedback through the consultation from everybody watching this is very welcome. The broader question of agile policy-making is one featured in the AI White Paper before the election. It is worth reading the section in there about it, but it is a real challenge.

Can I thank all of our witnesses for really excellent testimony today? Thank you, all three of you, for your testimonies today, which were really helpful. An uncorrected transcript of this hearing will be published on the Committee’s website in the coming days. The Committee will consider the evidence that we have been provided with, and will produce a report in due course with recommendations.