Policy paper

UK Government UK COVID-19 Inquiry Response - Module 1 Implementation Update

Updated 8 July 2025

Module 1 - Resilience and Preparedness

In January 2025 the UK government responded to the UK Covid-19 Inquiry’s Module 1 report and committed to monitoring the implementation of the commitments made in the response. This Module 1 implementation update sits alongside a suite of key publications which demonstrate this government’s determination to build the UK’s resilience and pandemic preparedness for the future. These publications, including the UK government Module 1 response from January, are listed below and should be referred to in conjunction with this update.

• UK Government Response to the Covid-19 Inquiry Module 1 Report (published January 2025)
• The Amber Book (published April 2025)
• UK Resilience Academy (UKRA) website (updated April 2025)
• SAGE guidance (published December 2024)
• National Risk Register (updated January 2025)
• National Security Strategy (published June 2025)
• Biological Security Strategy implementation report (published July 2025)
• Chronic Risks Analysis (published July 2025)
• Resilience Action Plan (published July 2025)

Implementation update for recommendation 1: A simplified structure for whole-system civil emergency preparedness and resilience (updated: June 2025) - recommendation closed

1. As set out in the government’s response to the Module 1 report, the government has established strong and simplified governance of resilience issues. In July 2024, the Prime Minister established the National Security Council (Resilience), a single ministerial committee to oversee action to build medium to long term resilience. The National Security Council (Resilience) is chaired by the Chancellor of the Duchy of Lancaster (CDL).

2. Since the publication of the government’s response, the Cabinet Office and respective Lead Government Departments (LGDs) have worked to refresh and reinvigorate the governance for each catastrophic risk, including co-chairing risk boards where appropriate (further information at recommendation 2). Issues are then escalated for collective decision through the National Security Council (Resilience). 

Implementation update for recommendation 2 - Cabinet Office leadership for whole-system civil emergencies in the UK (updated June 2025)

3. As the government stated in the Module 1 response, we agree with the Inquiry that whole-system risks (such as pandemics and national power outages) clearly require a stronger and more directive role from the centre. We have now explicitly embedded the leadership role of the Cabinet Office within our central crisis management doctrine, the Amber Book, as well as our risk-specific planning. This means that the Cabinet Office now co-leads each whole-system risk.

4. However, stronger leadership from the centre should bolster the LGD model rather than replace it. LGDs continue to have a critical role in planning for whole-system risks. It is vital that the bodies with the day-to-day responsibility for an issue or sector lead work on risk planning, response and recovery arrangements. LGDs are best placed to leverage relationships with their sectors, alongside having vital policy expertise, tools, and resources. Duplication of these responsibilities at the centre would risk a lack of clarity around engagement, communications channels and planning. The government will therefore retain the LGD model, reinforced by the  stronger role for the Cabinet Office.

5. For example, in the case of a National Power Outage, the Department for Energy Security and Net Zero (DESNZ) as the lead government department for this risk would be focused on working with the National Energy System Operator (NESO) to ensure that power restoration is achieved as quickly as possible. All government departments would be focused on responding to the impacts to their individual sectors, e.g. the health service or the education sector. The Cabinet Office would facilitate the rapid co-ordination of the Government’s overall response and effective decision-making.

6. The Cabinet Office also co-chairs a number of catastrophic risk boards with LGDs, which have been strengthened through increased meeting regularity and undertaking more in-depth reviews of individual sector plans. These risk boards can then escalate issues, including up to the National Security Council (Resilience) which has responsibility for readiness and resilience.

7. Working closely with respective LGDs, the Cabinet Office has written internal central operational plans for each catastrophic risk. These set out indicative thresholds for a move to a Cabinet Office-led response as well as what this would look like in practice for that specific risk (e.g. structures, roles and responsibilities and expected data requirements). The Cabinet Office has also undertaken a substantial piece of work to map existing response plans and capabilities for cascading impacts to identify and fill capability gaps.

8. To ensure consistency, good practice, and accountability in planning and responses, the government will publish Lead Government Department Expectations by the end of 2025, setting out the role of Cabinet Office and other UK government departments. It will set clear responsibilities for LGDs throughout the risk cycle (from risk identification through to recovery), including articulating minimum expectations and good practice. A greater emphasis will also be placed on ensuring the needs of vulnerable people are at the forefront of planning.

9. In summary, the Cabinet Office role has been strengthened through the publication of the Amber Book, which provides an overview of the Cabinet Office role in whole-system emergencies; the creation of internal operational plans (drafted by the Cabinet Office with the support of the LGD) for each catastrophic risk, which uses the concepts of the Amber Book to set out the trigger point for Cabinet Office involvement, and the role of the LGDs and other government departments if that risk manifested; and finally the development (for future publication) of the LGD Expectations, which will set out LGD responsibilities throughout the risk cycle, from risk identification to recovery.

10. Updates on specific commitments made in the government response include: 

a. Work to publish updated guidance for all government departments on catastrophic risk management has now been incorporated into a wider piece of work on Lead Government Department Expectations, due to be published by the end of 2025.

b. The government published the updated Central Government Concept of Operations for Emergency Response and Recovery (the Amber Book) in April 2025. The publication of the Amber Book has codified the leadership role the Cabinet Office plays for responding to whole-of-system emergencies. For this category of risks, the Cabinet Office co-sponsors the planning phase with the LGD which owns the risk, with a particular focus on ensuring the right concept of operations is in place should a response be required. The Amber Book provides detail on roles and responsibilities, as well as appropriate governance structures for whole-of-system crises. While the framework is risk agnostic, it provides the basis for risk-specific planning, including for whole-of-system risks. This provides the basis for the internal central operational plans for each catastrophic risk, which set out the role of the Cabinet Office versus the LGD for specific catastrophic risks.

Implementation update for recommendation 3 - better approach to risk assessment (updated June 2025)

11. The National Security Risk Assessment (NSRA) is the UK government’s single, authoritative articulation of the most serious acute risks facing the UK and its interests overseas. In recent years, to keep pace with the rapidly changing global risk landscape, extensive reforms have been made to the NSRA. However, the scale of the challenges means we must go further. The Resilience Action Plan sets out how we plan to expand our approach, to: understand drivers and risk interdependencies; increase sharing of our risk data to help policymakers understand and plan for different scenarios; and refocus our assessments on the underlying factors that make some people vulnerable to emergencies. This represents a further fundamental step change in our approach to risk assessment.

12. The Cabinet Office published an updated version of the National Risk Register (NRR), the public-facing version of the NSRA, in January 2025. For the first time, the NRR aligns with our new dynamic assessment model, enabling more frequent risk evaluations to better respond to our rapidly changing security landscape. 

13. Risks are identified for inclusion in the NSRA by consulting a wide range of experts from across UK government departments, the devolved governments, the government scientific community and outside of government.

14. Updates on specific commitments made in the government response include: 

a. In late 2025, the government will begin a review of the NSRA methodology. This will examine how risk variations and additional scenarios can be referenced more prominently – over and above the guidance already issued to departments. In the dynamic NSRA model, if there is a change to a risk, for example if the impact increases substantially following a risk update, it will be identified as a priority area for exercising through the National Exercising Programme.

b. To more explicitly challenge the assumptions that underpin risk assessments, the government has established the NSRA Expert Advisory Programme. During the latest cycle of updates to the NSRA earlier this year, expert groups provided insights and recommendations across key impact dimensions, including human welfare, behavioural science, security, and essential services. Building on this, economics experts and vulnerable people experts have been secured to provide constructive challenge for risks in the next NSRA cycle, which launched in June 2025. 

c. Development of the Risk and Insight Navigator (RaIN) continues in the Cabinet Office. This contains the digital version of the NSRA which visualises risk information and allows interconnections to be analysed. RaIN is currently available to Cabinet Office teams and testing is underway to rollout access to risk owning departments across government. RaIN will improve the efficiency and transparency of the NSRA production process with risk owners updating risks via the platform and having up to date risk information that is easy to engage with.

d. The government has enhanced the assessment of societal vulnerabilities within the NSRA and the public-facing National Risk Register, by creating a specific, independent Vulnerable People panel as one of the NSRA Expert Panels and developing a Risk Vulnerability Tool, allowing for rapid UK-wide analysis and understanding of disproportionate impacts of societal vulnerabilities, before and during crises. The UK government will build on this by commissioning the Government Office for Science’s Social and Behavioural Science for Emergencies group to develop new guidance for lead government departments by autumn 2025, that will support departments to strengthen their assessment of societal vulnerabilities. The government will also review the NSRA methodology to take a more holistic approach to the assessment of societal vulnerability and aligning with the Risk Vulnerability tool, to ensure that emergency planning and response decisions are informed by accurate comprehensive data sources. The Cabinet Office has recently published guidance to support Local Resilience Forums to develop plans for identifying and supporting individuals who may be vulnerable in an emergency, to ensure their needs are systematically considered throughout a crisis.

e. The UK government has published the first ever public analysis of chronic risks in the UK, alongside the Resilience Action Plan this summer. This analysis aims to build understanding amongst risk practitioners, businesses, academics and policymakers of the most critical medium to long term challenges facing the nation, to support their planning and preparations. The 26 chronic risks identified by the UK government cover seven themes, spanning Security, Technology and Cybersecurity, Geopolitical, Environmental, Societal, Biosecurity and Economic issues. 

f. Work has commenced with the Royal Academy of Engineering to develop a pilot of an alternative approach to risk assessment, where we consider our capabilities to respond to a broader range of risk scenarios, alongside their impact. A group of academics and industry experts is being established to advise on the methodology for this pilot.

Implementation update for recommendation 4 - A UK-wide whole-system civil emergency strategy (updated June 2025)

15. As set out in the full government response, the UK and devolved governments agree that a single UK-wide strategy which covers all of the sub-recommendations would be unwieldy and would not be appropriate given devolution arrangements, responsibilities and accountabilities. However, the UK government believes the publication of the Resilience Action Plan coupled with the central operational plans for each catastrophic risk and the NSRA, covers all the aspects of the strategy the Inquiry recommended.

16. The UK Government’s Resilience Action Plan was published on 8 July 2025. While significant aspects of resilience are wholly the responsibility of the devolved governments, the UK Government is committed to working in partnership to align policies and facilitate closer cooperation for the benefit of all our citizens. It sets out this government’s refreshed approach to resilience through deepening our understanding of how resilient the UK is to target interventions and resources; enabling individuals, businesses and civil society to increase their resilience and maximising the impact of the public sector resilience system. As set out under recommendation 2, for each catastrophic risk there are now central operational plans which detail structures, roles and responsibilities, thresholds, and expected data requirements. Updates on specific commitments made in the government Module 1 response are included below, however others are covered in response to recommendation 2 due to the thematic overlap:

a. DHSC is working with health and care partners and other departments with support from the Cabinet Office to develop the pandemic preparedness strategy. The aim is to publish this in autumn 2025, after incorporating interim findings of the PEGASUS Tier 1 Exercise taking place.

b. The Department for Health and Social Care’s (DHSC) respiratory response plan is due to be completed in summer 2025. Following its completion, DHSC will look to adapt the plan to other routes of transmission, learning from the experience of developing the respiratory response plan and informed by Exercise PEGASUS.

Implementation update for recommendation 5 - data and research for future pandemics (updated June 2025)

17. There are a number of initiatives across government contributing to this work, including the National Situation Centre, which provides situational awareness for crisis response and national resilience. It is highly regarded internationally as a benchmark for the use of data in crisis. Separately, the government’s commitment to invest up to £600m with the Wellcome Trust to launch the world’s first Health Data Research Service will drive research and innovation, enabling us to be better prepared for future health emergencies. Creating a single-entry point to NHS data saves researchers time they would otherwise spend navigating complex systems and helps them access information more quickly and securely. Updates on specific commitments made in the government response include:

a. The Biothreats Radar has been launched across government on the National Situation Centre’s secure data sharing platform. It brings together open source reporting on global biological incidents and further data sources will be added throughout 2025.

b. The Risk Vulnerability Tool (RVT) has been developed by the National Situation Centre and Office for National Statistics to estimate the number of individuals vulnerable to the negative impacts of selected NRR risks. The RVT is now accessible to all officials and ministers in UK and devolved governments. The pandemic risk will be added to the RVT, along with the associated data on household and individual characteristics that may be more negatively affected by the emergence of a pandemic or mitigating actions such as lockdowns by the end of 2025.

c. Building on the existing NHS Research Secure Data Environment (SDE) Network. As of the end of March 2025 there were: 105 projects completed across the SDE Network Pipeline; 314 projects live across the network; and 85 further projects in the pipeline and close to going live, pending final data confirmations. This equates to 504 projects delivered, in progress, or in the pipeline across both regional and national SDEs.

d. As of May 2025, NHS DigiTrials has invited over 29 million citizens to participate in research, with 1.35 million consented into 7 large-scale clinical trials. This includes 1 million participants that NHS DigiTrials has supported Our Future Health to recruit since June 2023.

e. The National Situation Centre has been working with the devolved governments to improve how we each share data in crisis. A Memorandum of Understanding to formalise the UK government and devolved government data sharing relationship is agreed and will be signed by officials in the coming weeks. 

Implementation update for recommendation 6 - a regular, UK-wide pandemic response exercise (updated June 2025)

18. Updates on specific commitments made in the government response include:

a. The Tier 1 exercise (Exercise PEGASUS) on pandemic preparedness and response will take place between September and November 2025. Participation will be at a national and local level, and will include the four nations.

b. The completion of the National Capabilities Assessment review has informed the proposed National Exercising Programme, which sets out annual Tier 1 exercises from 2026 until 2030. Tier 1 exercises are large-scale national exercises involving the devolved governments and regional/local tier responders, as well as relevant industry engagement from key businesses, voluntary and community organisations. 

Implementation update for recommendation 7 - publication of findings and lessons from civil emergency exercises (updated June 2025)

19. The Cabinet Office provides a range of resources to promote Lessons Management, including the Lessons Management Best Practice Guidance, Lessons Digest, UK Resilience Academy (UKRA) Exercising Hub and the Joint Organisational Learning platform. Work is underway across government to scope and test solutions to create a UK-wide online repository of information relating to civil emergency exercises. The Cabinet Office has established a cross-government Lessons Management Special Interest Group to lead work to develop a lessons management framework for central government. This framework will define how lessons are managed across government, ensuring that a system wide approach is taken to managing lessons with cross-cutting implications. The framework will also define expectations on the publication of lessons and how these are made accessible across government.

20. Updates on specific commitments made in the government response include:

a. The government is committed to publishing findings and lessons from all Tier 1 civil emergency exercises unless there are justifiable reasons not to, such as national security. The process of governance, debriefing, evaluating, disseminating, and reviewing means it may take up to 12 months to make Tier 1 exercise reports publicly available. 

b. The UKRA launched in April 2025. The Exercising Hub within the website’s ‘Validate’ section aims to help individuals to develop the skills they need to conduct exercises in their own organisations. The website will be regularly updated with relevant resources to strengthen exercising and lesson management across the whole of society, including central, devolved, and local governments. 

Implementation update for recommendation 8 - published reports on whole-system civil emergency preparedness and resilience (updated June 2025) - recommendation closed

21. The 2025 Annual Statement to Parliament on risk and resilience was delivered by CDL, on 8 July 2025. It accompanied the laying of the Resilience Action Plan. The government will continue to make an annual statement to Parliament on risk and resilience to engage Parliamentarians in the overview of the current risk picture, performance on resilience, and the current state of preparedness and what the UK government is doing to respond.

22. The 2023 UK Biological Security Strategy committed the lead minister to report annually to Parliament on its implementation. The CDL gave his first update to Parliament in October 2024. He delivered a further update on 8 July 2025, alongside the publication of the first full implementation report setting out detailed progress against each of the outcomes. 

Implementation update for recommendation 9 - regular use of red teams (updated June 2025)

23. The Government Office for Science (GO-Science) continues to improve the way the Scientific Advisory Group for Emergencies (SAGE) provides scientific advice and supports resilience efforts across government more broadly. For example, updated SAGE guidance was published in December 2024. 

a. The Cabinet Office and GO-Science are working closely together to integrate Red Teaming into the 2025/26 Capabilities Assessment. A pilot will be delivered during autumn 2025, before a full assessment of response capabilities takes place during January and February 2026. This will inform the development of a broader red teaming capability, led by GO-Science, that can be drawn in on a case by case basis by Cabinet Office and LGDs to test risk planning, due autumn 2026.

b. The Cabinet Office is holding the first sessions of Crisis Management Excellence Programme (CMEP) training for ministers in July. We are exploring options for further widening the scope of CMEP training over the course of 2025/6.

c. To date, we have stood up five advisory groups of technical and scientific experts as part of the Cabinet Office and GO-Science Expert Advisory Programme. These groups meet regularly to review risks during the NSRA update cycles and will be meeting again in the coming months. We are in the process of standing up the remaining three groups which are expected to be ready by early 2026. Further detail on the role of these groups can be found at recommendation 3.

d. The SAGE Continuous Improvement programme is ensuring that our processes and guidance remain fit for purpose and align with good practice. Recently completed work has covered engagement of experts outside of emergencies to support preparedness and the use of new technologies to support the SAGE secretariat.

e. Work between the Cabinet Office and GO-Science to strengthen expectations and guidance on the use of science to support resilience and emergency response is in development. It will form part of the broader suite of guidance for LGDs published by the Cabinet Office later this year. As part of this, GO-Science will include guidance on how to identify and access relevant expertise and how science can be used in the risk assessment, planning, mitigation and response stages.

Implementation update for recommendation 10 - independent statutory body for whole-system civil emergency preparedness and resilience (updated June 2025)

24. The UK government agrees that further independent scrutiny in this area is required in order to introduce new ideas and perspectives on our work to plan for the risks we face and to mitigate the risk of groupthink. This is especially the case for the most complex, whole-system risks that touch on the work of every area of government and whose impacts would be felt in every area of society and across every sector of the UK economy. However, the UK government does not consider that the creation of a new statutory body is necessary to provide this input. 

25. We are committed to enhancing the provision of independent advice to the UK government on our preparedness, bringing the perspectives of the UK’s leading experts on a range of the most complex risks to bear on our work, on top of the independent advice and external scrutiny we already receive from a number of well established routes, including the National Audit Office, the Public Accounts Committee, and NSRA expert panels. 

26. In addition to the scrutiny provided through these existing independent perspectives, the Cabinet Office will instruct the UK Resilience Academy to convene panels of relevant experts to scrutinise plans and preparedness for whole-system civil emergencies across the UK. These panels will be chaired by a figure from outside government who will be selected for their expertise and experience in the risk under consideration. They will scrutinise our planning via document reviews and interviews with key officials. They will offer recommendations on improvements that can be made to the Cabinet Office as well as the Lead Government Department for the specific risk they are considering. These panels will work in a systemic and programmed way across the most significant risks in the classified NSRA - each whole-system risk will be considered in turn.

27. These experts panels will consider preparedness for these whole-system risks across the UK and will set out their conclusions and recommendations, which the government will publish alongside an account of actions taken in response (subject to any security classification considerations). 

28. A pilot process will run in the second half of 2025 to test and refine this new mechanism. The Cabinet Office will instruct the UKRA to begin convening these panels before the end of 2025 and the panels will commence work from April 2026. We have developed this approach in collaboration with the devolved governments and we will continue to work with them as we move towards operationalising the new expert panels.