By David Clark

Three articles have diagnosed the structural failures of the NHS digital pathology programme. This one asks what recovery looks like. Bent Flyvbjerg, whose Iron Law of Megaprojects has framed this series, does not only describe how large programmes fail. He also describes how the best ones succeed — and the leaders who deliver them repeatedly. He calls them Masterbuilders: not heroic individuals, but disciplined thinkers who define the destination before committing resources, plan slowly before acting fast, learn from comparable programmes rather than assuming their project is unique, and build from repeatable components rather than bespoke experiments. These principles did not shape the first wave of NHS digital pathology investment. They must shape the next one.

Where It Has Worked, and What We Have Learned

The NHS digital pathology programme is not a story of uniform failure. There are several beacons of success. The National Pathology Imaging Co-operative in West Yorkshire has achieved 100% digital scanning across its network and has been notably open about its journey, sharing learning through webinars and educational events that have reached pathology teams across the country. Nottingham University Hospitals has successfully transitioned to a 100% digital pathology reporting workflow and integrated AI into the routine reporting of prostate biopsies — one of the small number of NHS services to achieve this at clinical scale. But even here the Nottingham digital system remains trapped behind Trust firewalls unable to import cases for specialist review; cases cannot be shared across the regional pathology network.

These achievements are real and significant, but  successful implementations continue to face the headwinds that this series has described: the challenge of integrating with other systems, the complexity of connecting and sharing across pathology networks, the practical necessity of continuing to provide glass slides for pathologist training, and the unresolved question of securing long-term revenue funding for archive storage, scanner capacity and ongoing service transformation. Success in digital pathology, even at its most advanced, is not a destination that has been fully reached here in the UK NHS. It is a direction of travel that demonstrates the destination is achievable — and that the structural barriers between here and there are systemic, not technical.

What enabled these services to get further than most is not fully understood. Committed multidisciplinary implementation teams, strong clinical leadership, and in NPIC’s case a long-term institutional commitment to digital pathology that predates the national programme, are likely contributing factors. But the honest answer is that the NHS does not yet know with sufficient precision what determines the ability to deploy successfully in a system as complex as this. Studying local successes tells you a team hit its own targets — for my own service in Nottingham 100% digital pathology reporting. It cannot tell you whether those were the right targets, or whether the system-wide transformation across networks has been achieved.

That question requires a framework capable of treating the whole system — not the technology — as the unit of analysis. The Royal Academy of Engineering’s Engineering Better Care, developed in partnership with the Royal College of Physicians, provides exactly this. It organises the analysis of any change programme around four perspectives: People, Systems, Design and Risk. Viewed through that lens, the partial successes of the first wave are explicable. The system boundary was drawn at the Trust, the targets were local, and the technology was optimised accordingly. The benefits that required cross-boundary action were never in scope. What NPIC, Nottingham and other successful deployments have shared has been primarily technical: the challenges of implementing whole slide imaging at scale, the infrastructure requirements, the quality assurance processes. This is valuable, but technical knowledge transfer is not the same as system transformation knowledge transfer. What has not been shared — because it has not yet been achieved at scale anywhere in the NHS — is the blueprint for the organisational, workforce, and governance transformation required to make digital pathology the default operating model. The NHS invested in digital pathology earlier than many other health systems and has accumulated six years of its own reference class data. It has not yet found a way to use it.

Thinking Right to Left: Defining the Destination

Flyvbjerg’s most fundamental principle for successful programme delivery is to start with the desired outcome and work backwards. Engineering Better Care’s Design perspective asks two questions that give this principle operational precision: at what level is the system boundary drawn, and was that level chosen or assumed? And do the programme’s success metrics include the clinical benefit being built towards, or only the operational outputs within direct control?

In the first wave of NHS digital pathology investment in many cases the system boundary was drawn at the Trust, not because that was the right unit for transformation, but because that was the funding vehicle. The money came to the Trust; the system was therefore a Trust system. And success was measured in operational outputs — percentage of cases reported digitally within individual Trusts — not in the network-level benefits the programme was created to deliver. The second wave must make those choices explicitly rather than inheriting them.

What does a fully functional digital pathology service actually look like? Not in aspirational terms, but in operational ones. It is a service in which digital reporting is the default for all appropriate specimen types, not a parallel option available to willing early adopters. It is a service in which the pathologist’s physical location is irrelevant to their ability to report a case, enabling genuinely flexible workforce deployment across networks. It is a service in which computational pathology tools are integrated into the diagnostic workflow, validated for clinical use, and operated by a workforce that has been trained and assessed in their use. It is a service in which the whole slide image is part of the patient record, stored, retrievable, and available for second opinion, multidisciplinary review, longitudinal comparison, research and innovation.

That is the target condition. Every decision about procurement, integration, workflow design, training, and financial modelling should be evaluated against it. Working backwards from that destination makes visible what the current state lacks, what the transition requires, and what dependencies must be resolved before capital is committed. It also makes visible what success looks like — which is the precondition for measuring whether progress is being made.

This right-to-left thinking must happen before the next wave of investment begins, not after. It must involve every part of the system with a stake in the outcome: the Trusts delivering services, the networks coordinating them, the professional bodies defining competence, the regulators setting the standards for AI tool validation, and the patients whose diagnoses depend on getting this right. The consensus that was absent from the first wave must be built into the design of the next.

Plan Slow, Act Fast: Gateway Conditions for the Next Wave

Flyvbjerg’s principle — invest heavily in planning before committing to delivery — failed entirely in the first wave. Year-end capital pressure, the absence of clear goals, and the rush to procure combined to produce the opposite: act fast, then think slowly as the consequences unfold. The next wave must invert this.

Engineering Better Care provides the organising logic for what pre-deployment planning must cover. Before any capital is released, each of its four perspectives must be satisfied.

From a People perspective: whose working practice must change for the clinical benefit to be delivered, and who owns that change? A workforce readiness assessment must confirm that training infrastructure exists, or is being built in parallel with technology deployment. This is not a checkbox; it is the precondition for the clinical and scientific workforce to use the system rather than work around it.

From a Systems perspective: what does this deployment depend on that it does not control, and who owns those dependencies? LIMS integration must be mapped, costed, and sequenced, with middleware requirements identified and budgeted, before a procurement decision is made. Network-level connectivity — the ability to share images and pool reporting capacity across Trusts — must be designed in, not discovered as an absence after local deployment is complete.

From a Design perspective: has the system boundary been chosen rather than assumed? The entire end-to-end histopathology workflow should be mapped and redesigned using proven systems engineering and Lean approaches before technology is specified. The full lifecycle cost of the deployment must be modelled, including maintenance, licence renewal, WSI archive storage, and the revenue transition plan when capital funding ends. A defined operating model — the target condition described above — must be documented and agreed by the key stakeholders before a single scanner is procured.

From a Risk perspective: what contradictions exist between this deployment and the wider structures it sits inside, and what failure modes have already been documented in comparable programmes? The missing feedback loop identified in Part 2 must be built into this gateway architecture. When any deployment encounters a critical path blocker — an integration failure, a workflow breakdown, a sustainability crisis — there must be a structured mechanism to classify that problem as systemic risk, escalate it centrally, and trigger a mandatory assessment across all current and planned deployments. The NHS cannot afford to rediscover the same failures independently for a third time.

These are not bureaucratic additions to an already complex process. They are the work that should have been done before the first wave began. There is an old maxim: if the best time to do something was seven years ago, the next best time is now.

The Outside View: Using What the NHS Already Knows

Engineering Better Care’s Risk perspective asks which failure modes are already documented in comparable programmes, and whether this programme has modelled them. This is Flyvbjerg’s reference-class forecasting expressed as a design requirement rather than a retrospective observation.

The NHS digital pathology programme now has six years of its own implementation data. That data exists in the experience of every laboratory that has attempted deployment, every network that has tried to coordinate across sites, every Trust that has confronted the sustainability cliff. It is distributed, informal, and largely unexamined at programme level. Globally, there is a rapidly expanding number of digital pathology deployments which, if studied systematically, can add to the NHS reference class database.

The next wave of investment must begin by collecting and analysing that experience — not to apportion blame, but to build the reference class that should have existed before the first wave began. This requires the kind of structured transparency that the profession currently does not reward. Creating those conditions is itself a systems design challenge. Organisations that share honest accounts of failure need to be protected from reputational damage and recognised for contributing to a public good. That culture will not emerge spontaneously. It must be deliberately designed, commissioned, resourced, and led.

Modularity: Standardising the Connectors

Flyvbjerg argues that big things should be built from small, repeatable modules that allow learning to accumulate and errors to be caught before they propagate. The most successful large-scale programmes — what Flyvbjerg and Gardner call modular natives — are defined not by the sophistication of their components but by the consistency of their connectors. A simple house and a complex castle use the same brick; the join is identical on both. The ambition of the model is infinite; the connector is constant. That is the source of predictable risk and predictable outcome.

Engineering Better Care’s Systems perspective asks what this programme depends on that it does not control, and where data must flow across an institutional or governance boundary. Applied at NHS programme level, both questions point to the same failure: the connectors between organisations were never specified. The rescanning problem in regional networks — where images that have already been digitised must be physically transported and scanned again at the receiving site — is not an imaging failure. The images exist. The standard connection required to move them between organisations was never defined. The first wave of NHS digital pathology was a series of bespoke, isolated implementations, each one starting from scratch, each one optimising within the system boundaries against the goals set. The problem is not the components. It is that nobody specified the joins.

The next wave should standardise those connectors: a national interoperability specification for digital pathology platforms defining the integration requirements any system must meet before procurement; standard middleware specifications that resolve the LIMS bridging problem once rather than in every laboratory independently; a common WSI archive standard that addresses the regulatory retention requirement at system level rather than leaving individual Trusts to solve it alone; and validated AI tool evaluation frameworks that allow the workforce to assess computational pathology tools against consistent criteria rather than navigating a fragmented and largely unregulated vendor landscape.

AI deployment makes the consequences of connector failures especially visible, and especially costly. Every governance boundary that was not resolved during digital pathology implementation must be crossed again, from scratch, for every AI application deployed across it. Validation work that could be done once and shared gets repeated at every site. The cost scales with the number of unresolved boundaries, not with the complexity of the algorithm. AI deployment is a stress test of the system already built. If the governance is fragmented, AI inherits it. If image access is fragmented, AI inherits it. If the workforce model is fragmented, AI inherits it. Standardising the connectors before AI deployment begins is the precondition for AI to be deployable at a cost the system can sustain.

The Systemic Changes the Next Wave Must Deliver

Recovery from the failures of the first wave requires more than better project management. It requires specific, named systemic interventions that address the root causes identified across this series. Engineering Better Care’s four perspectives help assign each to the part of the system that owns it.

The Risk perspective surfaces the contradictions that nobody owned in the first wave. The most consequential is the FRCPath curriculum. A national strategy funded digital pathology programmes across the NHS. The professional training curriculum and FRCPath examination remained aligned to glass slide microscopy. That contradiction was present from the beginning — a national investment strategy sitting outside the system boundary of the professional body that owns the qualification framework. The 2019 Digital Pathology Strategy committed RCPath to integrating digital pathology into the qualification framework. The 2023 Downing Street joint report restated that commitment. The next curriculum revision must deliver it and a commitment to a virtual microscopy option for the FRCPath examination. This is already the case in the USA and Canada board examinations; the precedent exists, the technology is proven, and the case for following it is now unanswerable. It could be run as an option alongside glass microscopy until the digital transition is complete. If this requires investment, the NHS should fund the transition.

The Design perspective owns capital funding reform. Attaching the Engineering Better Care gateway conditions to digital pathology capital — with phased release against independently verified readiness milestones — would change the incentive structure that currently rewards speed over planning. It would also make the system boundary decision explicit. The boundary cannot be assumed, because the gateway requires it to be stated, examined, and verified before funding is released.

The Systems perspective demands a central technical authority with genuine gateway powers — the ability to withhold deployment funding until integration readiness is confirmed. NHS England (and whatever replaces its Digital Diagnostics function) has the standing to establish this. This is not a new bureaucracy. It is the minimum governance structure required to protect public investment in a system of systems that cannot function without coordinated architecture. Its purpose is to create, for the first time, a named owner for the dependencies that individual Trusts cannot resolve: the network-level joins, the cross-boundary image sharing standards, the programme-level risks that are currently nobody’s specification.

The Choice That Remains

The NHS digital pathology programme is not beyond recovery. The technology works. The clinical case is established. Whole slide imaging delivers location-independent reporting and enables computational pathology tools that glass slide microscopy cannot. The potential to transform diagnostic services, reduce turnaround times, support workforce flexibility, and integrate AI-assisted diagnosis into clinical pathways is real and within reach.

What the first wave demonstrated is that the technology alone is not sufficient. The system into which it is deployed must be designed to receive it. Engineering Better Care provides the framework for that design work — asking People questions about who must change and who owns that change; Systems questions about what the programme depends on that it does not control; Design questions about whether the system boundary was chosen or assumed and whether success metrics reach the clinical benefit or stop at operational outputs; and Risk questions about what contradictions exist between this programme and the wider structures it sits inside.

Flyvbjerg’s Iron Law predicts what happens when programmes cannot answer those questions before capital is committed:

Over Time, Over Budget, Under Benefits, Over and Over….

The next wave of investment is coming. The question is whether the system will be designed, this time, to succeed.

Explore more from the series

• How NHS digital pathology obeyed the Iron Law of megaprojects – Part 1: The Strategy Gap and the Iron Law
• How NHS digital pathology obeyed the Iron Law of megaprojects – Part 2: The Critical Path and the LIMS Trap
• Part 3: Engagement, Training, and the Sustainability Cliff
• Part 4: The Masterbuilder’s Path to Recovery

References

Clarkson, P.J., Bogle, D., Dean, J., Tooley, M., Trewby, J., Vaughan, L., Adams, E., Dudgeon, P., Platt, N. and Shelton, P. (2017) Engineering Better Care: a systems approach to health and care design and continuous improvement. London: Royal Academy of Engineering. Available at: https://www-edc.eng.cam.ac.uk/files/engineering-better-care.pdf

Flyvbjerg, B. and Gardner, D. (2023) How Big Things Get Done. London: Macmillan.