NHS England » Emergency Preparedness, Resilience and Response (EPRR) Annual Report and Assurance update

Action required

This papers sets out:

an overview of key risks and mitigations facing the NHS
an update on key activities and response to incidents throughout 2025/26
assurance that NHS England and the NHS in England is prepared to respond to an emergency and is resilient to provide continued safe patient care.

Context: Key risks and mitigations overview

We are operating in an increasingly complex and volatile risk environment, with new and emerging threats that extend beyond those directly impacting the NHS.
NHS England is actively mitigating these through statutory assurance processes, strengthened governance, national training and exercising, incident coordination, and partnership working.
The combination of these measures aims to ensure that the NHS remains resilient and capable of maintaining core services even when confronted with major incidents and emerging risks.
The most significant risk to materialise in the UK in recent years has been the COVID-19 pandemic. This has impacted all aspects of society and will have consequences into the future, and participating in Exercise Pegasus in autumn last year (the largest UK pandemic preparedness exercise in history) has been a key priority for NHSE’s Emergency Preparedness, Resilience and Response (EPRR) programme*

* The Government has published its Pandemic Preparedness Strategy, which reflects on lessons from the COVID-19 pandemic and the UK Covid-19 Inquiry and early findings from the national pandemic exercise (‘Exercise Pegasus’) – Pandemic Preparedness Strategy: building our capabilities – GOV.UK

This cross-government exercise involved significant input and expertise right across EPRR national and regional teams, working closely with other key programmes, to provide expertise.
Following COVID-19 NHS England has been working to identify and address COVID-19 lessons, more recently focussing on specific risk areas around personal protective equipment, fit testing, health inequalities and medical technologies.
Cyber incidents continue to also be a substantial risk to NHS delivery posing a real risk to delivery of care; especially given the current geopolitical climate. While the NHS has strong capabilities to respond to these types of incidents in real-time; often incidents can be protracted over a series of weeks or months which is a different level of risk and can be highly challenging.
Operationally, we continue to exercise at local, regional and national levels to prepare for the cyber response and protracted IT and operational recovery timescales providing further assurance.
For specific Trusts, we have also updated our guidance to advise that they should prepare for cyber related outages of up to 6 months – and that is a requirement through the updated Data Security and Protection Toolkit which now aligns with the National Cyber Security Centre’s Cyber Assessment Framework. This work is supported by Regional Cyber Leads.
Another key focus this year has been on chemical, biological, radiological, and nuclear (CBRN) – specifically on building and sustaining core response capabilities in response to a CBRN attack supported by securing significant funding through the most recent Government Spending Review. This has enabled targeted improvement across key priority areas including equipment, facilities and training to support the local NHS response.
Work is ongoing in relation to the Manchester Arena Inquiry recommendations. This includes, work on improving pre-hospital analgesia as well as working with ambulance trusts on their capabilities as part of a structured, assurance-led approach.
Industrial action remains an ongoing risk.
Furthermore, there is wider interdependent work ongoing further highlighting the depth and scale of resilience across the NHS, including the Ambulance Radio Programme and 999/111 review; although not core EPRR business.

Statutory responsibilities

EPRR is a statutory requirement for the NHS under the Civil Contingencies Act 2004, the NHS Act 2006 and the Health and Care Act 2022. It is designed to ensure that NHS England, alongside all providers and commissioners of NHS funded services are prepared to anticipate, respond to and recover from a wide range of incidents while continuing to deliver safe patient care.
During 2025/26, NHS England’s EPRR oversight was provided by Sarah-Jane Marsh as the Accountable Emergency Officer, with additional leadership from Dr Mike Prentice, National Director for NHS Resilience, and Leaf Mobbs, National Urgent and Emergency Care Programme Director.

Incident response

Throughout 2025/26 incident response arrangements have been activated for a wide range of incidents requiring regional or national oversight. Some of the key responses in year included:

May 2025 – Liverpool vehicle collision
June 2025 – National 111 outage
July 2025 – SW Ambulance Service 999 telephony outage
August 2025 – Gaza medical evacuation scheme
October 2025 – Manchester synagogue attack
November 2025 – Huntingdon train attack
December 2025 – Kent and Medway water infrastructure disruption
January 2026 – 2 unexploded ordnance in Exmouth & Plymouth
February 2026 – University Hospital Southampton NHS Foundation Trust fire
March 2026 – Meningitis outbreak in Kent

NHS England has also led the national operational response to Resident Doctors industrial action in November and December 2025 working with Trusts and integrated care boards (ICBs) to set out key actions to manage and plan these incidents, minimise disruption, and support patient care – drawing on significant lessons identified from managing previous rounds of industrial action.
Overall, for each instance of Industrial action we met our key strategic objectives to protect patient safety; minimise impact on planned activity; and recover effectively. This was particularly challenging for December industrial action, given it coincided with the most vulnerable time for the NHS in terms of resilience, capacity, and winter pressures; however all key objectives were successfully achieved thanks to strong incident management and effective planning at all levels of the system.
Other key incident responses in year included several supply disruptions and provider failures – most notably recently with the NHS securing a ‘rescue package’ of alternative bone cement to ensure trauma and elective operations can continue, when faced with a supply shortage and more recently managing our response to the impacts of the Stryker cyberattack.
To support managing an effective incident response, several EPRR documents have been developed or updated, and published throughout the year including:

EPRR assurance

The annual assurance process for 2025/26 remained largely unchanged from previous years with regional teams supporting ICBs to lead local assurance, using the process to identify areas of good practice, issues requiring further development and guide annual work plans and priorities. As we move through the transition period, we will be looking to review the way in which assurance is undertaken.
Overall, assurance was gained that NHS England and the NHS in England are prepared to respond to emergencies and are resilient in providing continued safe patient care. The level for compliance against core standards is set at 75% meaning even organisations which do not achieve fuller levels of compliance still have high levels of preparedness.
Following assurance, organisations have developed action plans to address areas of non-compliance to work towards an improved position the following year.

Training and exercising

Training and exercising are core components of NHS England’s approach to strengthening preparedness, resilience and response capability. The year marked the completion of the first full cycle of the national exercise programme which has provided a more coordinated approach to exercising across national, regional and system levels, supporting greater consistency, prioritisation and efficiency.
Regional exercising played an important role in enabling a proportionate national approach. Exercise Tangra, delivered in the Midlands, tested NHS infectious disease outbreak and pandemic arrangements system wide across the region. This preparatory regional activity meant that the subsequent national level Exercise Pegasus could build on existing assurance rather than repeat activity at the same depth.
NHS England also participated in a range of cross government and multiagency exercises, supporting interoperability with partners and reinforcing the NHS role within the wider resilience landscape. These covered key risk themes including mass casualty incidents, cyber disruption, infrastructure failure and overseas casualty reception – and of course Exercise Pegasus.
Leadership development also continued to be supported through targeted exercising and learning activity, including the Principles in Health Command courses and work with the Graduate Management Trainee Scheme (GMTS) to support early understanding of system leadership and decision-making during incidents.
In November 2025, NHS England, the Department of Health and Social Care (DHSC), and the Ministry of Defence (MoD) collectively agreed to support mass casualty planning for the NATO Alliance.

Priorities for 2026/27

Looking forward, the EPRR work programme for 2026/27 will focus on:
- Progressing areas of development that have been identified through EPRR assurance 2025/26 including cyber, estates and infrastructure resilience, EPRR workforce capability and digital dependency
- Continuing to support CBRN, pandemic, and home defence preparedness
- Continuing to support the implementation of the health recommendations from the Manchester Arena Inquiry report.

The Board is asked to note the content of the report and the annual assurance, to acknowledge the priorities that have been identified for 2026/27 and support the NHS Resilience team in achieving them.