National Risk Register 2026

The publication of the UK National Risk Register is an important moment in the calendar for futurists. The NRR is a valuable insight into the UK Government’s thinking on acute risks, and hence a valuable addition to futurists’ work on everything from horizon scanning to wildcards.

Because of SAMI’s previous work with Cabinet Office and Government Office for Science on a Risk Resilience Toolkit, we declare a particular interest when the National Risk Register is published. This year’s NRR includes 87 standalone acute risks, and 8 linked scenarios for a total of 95 risks. Chronic risks – those that pose continuous challenges that erode our economy, community, way of life, and/ or national security - are treated separately in the Chronic Risk Analysis.

As usual,  the risks are positioned on an impact vs likelihood matrix. Impact is rated on a scale of 1 (Minor) to 5 (Catastrophic) based on the scope, scale and duration of the harm that the reasonable worst‑case scenario could foreseeably cause; Catastrophic could mean over 1,000 fatalities, over 2,000 casualties or economic cost of tens of billions of pounds.

Likelihood is assessed in groups from 1 (<0.2%) up to 5 (>25%). The horizontal axis shows the likelihood of each risk occurring at least once in the assessment period (up to  5 years).

The most impactful and most likely risks are shown in the chart below. Fortunately, there are no highly likely, catastrophic risks.

The risk of terrorist attacks in publicly accessible material is broken down into those using explosives such as the Manchester Arena attack in 2017, and “marauding” attacks like the 2017 London Bridge attack and the 2025 Manchester synagogue attack.

That a pandemic is still considered fairly likely and catastrophic might surprise many who imagined that Covid-19 was a historic one-off event. In fact, the uncertainty range for pandemics does stretch into the >25% bracket. The Government’s preparations for an unknown pathogen (“Disease X”) assume a reasonable worst-case scenario where 50% of the total population becomes infected and experiences symptoms, and up to 840,000 deaths. The emergency response stage in the UK is at least 9 months.

The failure of critical water infrastructure serving a large urban area would result in the loss of drinking water supply to a large population. An incident of this magnitude is likely to overwhelm the capacity of the water sector to provide alternative water via tankers or bottles and require evacuation of households and closure of businesses in the affected area.

Society’s reliance on technology shows up in the 4/4 cell. Disruption of space-based services has long been one of SAMI’s high-risk concerns.

Natural and environmental hazards – including heatwaves - generally are assessed at a lower likelihood. This will probably be re-assessed in future publications, in the light of increasing evidence of climate change.

Threats of outright conflict – or even hybrid conflict – with Russia (or others) do not feature highly, despite much public and political discussion.  It may be that the classified National Security Risk Assessment covers this in more depth.

There are seven new risks included in this edition of the NRR:

• the risk of digital resilience failure, based on lessons from the global IT outage in July 2024, and rated 4/4

• a ‘cyber-attack water infrastructure’ risk – to reflect learning from reported cyber-attacks targeting the water sector;

• two new risks focused on data infrastructure (one focused on a cyber-attack and the other on disruption);

• one new risk of interference in democratic processes; and

• two risks focused on operational and system‑wide pressures ‑ ‘significant disruption to the criminal justice system’ and ‘accidental damage to the national gas transmission network’

The NRR itself is supplemented by A guide to the National Risk Register 2026. This addresses 6 “spotlight” risks, and considers geographical/regional implications to provide more practical help to Local Resilience Forums. Guidance for the general public on how to bolster personal readiness can be found at the Prepare website.

Spotlight risk 1 - the “disease X” pandemic

As well as the scale of deaths and casualties, there is a major pressure on care services - Health and social care services would face significantly increased demand for several years.

Preparedness actions include

• reviewing business continuity plans to manage prolonged staff absences and potential international supply chain disruption

• assisting with national vaccine rollouts, providing practical care for patients, and ensuring vital health messages reach every community.

Spotlight risk 2 - threats from states and our home defence

Defence does feature in the Guide, with a reference back to an “era of radical uncertainty” described in the National Security Strategy.  So-called "sub-threshold” threats and hybrid threats such as cyber-attacks on infrastructure could disrupt essential services, while attempts at undermining our democracy, and eroding public trust could weaken national resolve.

Communities should look to build resilience with practical support plans, whilst organisations should develop plans to protect or replace supply chain disruption.

Spotlight risk 3 - water supply interruptions or outages

This vital resource is vulnerable to a range of threats of varying scale. Health hazards would increase and institutions such as care homes struggle to cope. In extremis, people may need to be evacuated from affected areas.

Organisations need to understand the basic requirements of their water demand and prepare plans to maintain that. The volunteer community may be called upon to supplement the response.

Spotlight 4 - power outage

A major, widespread power failure would disrupt critical services. Consumers without back-up generators would be unable to cope, and there could be cascading impacts across water and sewage, fuel distribution, and communications networks, multiplying the effects.

Organisations should plan for back-up power and audit their supply chains. Communities need to plan how to support vulnerable people.

Spotlight 5 – terrorist incident

There have been enough previous incidents to gain an understanding of the impact and ideal responses. The form of the attack may vary, but an “threat agnostic” response plan can be put in place. As well as the immediate casualties, a large enough attack can affect morale, with a significant psychological impact.  Damaged infrastructure takes time to repair, causing an ongoing damage to the economy.

Organisations should review security measures, internal risk registers, and staff training. For example, public-facing sites should ensure that staff are trained to support others during a lockdown and update local emergency plans to account for the evacuation of people with mobility issues.  Community groups can help provide victims and their families with welfare services and practical help.

Spotlight 6 – major flooding

The Environment Agency estimates that 6.3 million properties in England are currently at risk of flooding, a figure that could rise to 8 million by 2050 due to climate change. The reasonable worst-case scenario for river flooding assumes an event lasting two weeks in a large urban area, leading to the loss of essential services like electricity and telecommunications for several weeks. Vulnerable people will be disproportionately affected.

Food and housing providers need to work with local authorities to guarantee access to essential food supplies and temporary housing. Volunteers can offer practical help during evacuations and stay involved to guide communities through the recovery phase.

Geographical implications

The Guide outlines the different risks faced by Local Resilience Forums in England (the devolved administrations have their own approaches).

Shared responsibility

The Guide argues that a “whole-of-society” approach is required to respond to these risks. This ensures that during whole-of-system crises, national resources can be targeted with maximum efficiency toward those most vulnerable and to protect our way of life.

Is it enough?

The NRR is the public version of the classified NSRA, written in the straightforward, clear language typical of government documents. It embodies extensive work that has been distilled to be brief, accessible, and easy to understand. We understand the challenges faced by authors in achieving this balance.

Additionally, as in the work SAMI did on the Risk Resilience Toolkit, it is important to consider the interaction of threats – increasingly we need to worry about the “polycrisis”.

SAMI’s work, covering both acute and chronic risks and their application in futures and foresight, offers a way to interpret the risks in the NRR and beyond. It helps organisations prepare for those concerns, deepen their understanding through research, analysis, and scenario planning, and turn risks into opportunities. The NRR is a sound basis – but true Futures and Foresight needs more.

Written by Huw Williams, SAMI Principal

The views expressed are those of the author(s) and not necessarily of SAMI Consulting.

Achieve more by understanding what the future may bring. We bring skills developed over thirty years of international and national projects to create actionable, transformative strategy. Futures, foresight and scenario planning to make robust decisions in uncertain times. Find out more at www.samiconsulting.co.uk.

If you enjoyed this blog from SAMI Consulting, the home of scenario planning, please sign up for our monthly newsletter at newreader@samiconsulting.co.uk and/or browse our website at https://www.samiconsulting.co.uk

Image by Steve Buissinne from Pixabay