Previously, the NHS Service Standard held that “public services are built with public money, so unless there's a good reason not to, the code they're based on should be made available for other people to reuse and build on.” This is what the current policy should be reverted to.

NHS England has issued guidance, called SDLC-8, which requires that all source code repositories be private from the 11th of May, 2026, unless there is an exceptional need, approved by the Engineering Board. The Free Software Foundation Europe have warned that open repositories allow security researchers to inspect and report vulnerabilities, and that de-publishing code does nothing to prevent attackers from analysing already-deployed systems, binaries, or previously copied source code.