The NHS spent £330 million on a data platform built by Palantir, the American defence and surveillance contractor. Fewer than a quarter of England’s 215 hospital trusts are actively using it. In February 2026, the British Medical Association told doctors to limit their engagement with the system entirely. The reason is not technical — it is trust.
This matters to every UK business considering an AI-powered data tool. If the largest employer in Europe cannot get staff to use a platform they did not ask for and do not trust, a 20-person office has no chance either.
What actually went wrong at the NHS
Palantir’s Federated Data Platform was meant to help hospitals share patient data to cut waiting lists and improve care. On paper, it made sense. In practice, staff revolted.
Clinicians, data analysts, and administrators are quietly refusing to use the system. Some are deliberately slowing their work when forced onto it. The concerns are not trivial: Palantir has deep ties to intelligence agencies and contracts with US Immigration and Customs Enforcement. Staff do not want a surveillance contractor handling the medical records of tens of millions of British citizens.
The NHS insists Palantir cannot see identifiable records. Critics point out that pseudonymised data — where names are removed but other details remain — is easy to reverse-engineer. Patients were never clearly told how their data would be used.
Only 24% of NHS hospital trusts were actively using the Palantir platform by late 2024, despite the £330 million contract being signed in 2023.
The lesson is stark: a powerful tool that staff refuse to use is not an asset. It is a very expensive liability.
Why this pattern repeats in smaller businesses
You do not need a £330 million contract to hit the same wall. Any business adopting a new data analytics or AI platform faces the same risks on a smaller scale.
A recent survey found that 68% of UK businesses report employees regularly using unapproved AI tools — the so-called “shadow AI” problem. Staff go around official systems when they do not trust them, do not understand them, or were never consulted about them.
Meanwhile, only 7% of UK businesses have fully embedded AI governance frameworks. That means 93% are adopting AI tools without clear rules about what data goes in, who sees the output, and what happens when something goes wrong.
98% of UK businesses surveyed reported financial losses from unmanaged AI risks, averaging around £3.1 million per organisation.
Five questions to ask before you sign up
Before adopting any AI-powered data platform — whether it is a CRM with built-in analytics, an AI bookkeeping tool, or a workforce management system — work through this checklist.
1. Where does our data actually go? Ask the vendor whether your data is stored in the UK, processed abroad, or used to train their AI models. Under UK GDPR, you are responsible for knowing this — not the vendor.
2. Who can access it — and under what circumstances? Palantir said it could not see identifiable NHS records. The NHS’s own documents said it would “collect and process confidential medical information.” Get clarity in writing, not in a sales pitch.
3. Have you involved your staff before buying? The single biggest lesson from the NHS story. Staff who are consulted before a tool is chosen are far more likely to use it properly. Staff who have a system imposed on them will find workarounds.
4. What happens to your data if you leave? Can you export everything? In what format? How long does the vendor retain your data after you cancel? Lock-in is a real risk with platforms that centralise your business data.
5. Does the vendor have a track record you are comfortable with? NHS staff objected to Palantir’s wider business — surveillance contracts, immigration enforcement work. You may not have the same concerns, but it is worth checking who you are handing your data to.
What to do this week
If your business already uses an AI-powered data tool, run through those five questions now. If you cannot answer them confidently, ask your provider.
If you are evaluating a new platform, involve at least one person from each team that will use it before you commit. Ask for a UK data processing agreement in writing. And check whether the vendor’s privacy policy matches what the sales team told you — the NHS found out the hard way that those two things can be very different.
| Before You Buy | What to Check |
|---|---|
| Data residency | Is data stored and processed in the UK? |
| Staff consultation | Have end users tested and approved the tool? |
| Data access controls | Who sees what — and is it documented? |
| Exit terms | Can you export all data in a usable format? |
| Vendor background | What else does this company do with data? |
The technology is not the problem. The NHS platform likely works well. But technology only delivers value when the people using it trust it — and trust starts with transparency, consultation, and clear data governance. Get those right before you spend a penny.
Not sure whether your current tools meet UK data protection standards? Book a free review with our team.
Learn more →Topics