The National Risk Register (NRR) is a report first released by the Cabinet Office in August 2008 as part of the British government's National Security Strategy. It provides an official government assessment of significant potential acute risks to the United Kingdom. Ten editions of the National Risk Register have been issued, most recently in 2026. It is the public-facing version of the classified National Security Risk Assessment (NSRA), which is maintained by the Civil Contingencies Secretariat within the Cabinet Office.
Contents and methodology
The National Risk Register evaluates acute risks that have a substantial impact on the UK's safety, security, and critical systems at a national level and that would require an emergency response. In the 2023 and 2025 editions, the register covers 89 acute risks across nine broad risk themes, including terrorism, cyber attacks, natural hazards, human and animal health, and major accidents. Each risk is assessed in terms of a reasonable worst-case scenario, the response capability requirements, and the recovery requirements.
The likelihood and impact of each risk are plotted onto a risk matrix, enabling users to compare risks and prioritise resources. The impact scale is logarithmic. Non-malicious risks are assessed over a five-year timescale, while malicious risks are assessed over a two-year timescale. In the 2025 edition, the register shifted to a dynamic assessment process, allowing individual risks to be updated as frequently as needed as new evidence or understanding emerges.
The NRR is intended to support a range of audiences, including risk and resilience practitioners, businesses, voluntary and community sector organisations, and those who operate critical national infrastructure. Alongside the NRR, the government publishes a digital platform and the GOV.UK/Prepare public guidance website to assist individuals and communities in preparing for emergencies.
Relationship to the National Security Risk Assessment
The NSRA is a classified cross-government assessment of the most serious risks facing the UK and its interests overseas. It is used to inform national resilience planning and is the basis from which the NRR is derived. The NSRA assesses risks using scenarios: significant but plausible manifestations of a given risk. These scenarios are used to judge impact, and the scale of impact informs proportionate planning. Each risk in the NSRA is owned by a lead government department, which is responsible for identifying and assessing the risk and for overseeing levels of preparedness within its sector.
Relationship to community risk registers
Under the Civil Contingencies Act 2004, all Local Resilience Forums (LRFs) across the UK have a legal duty to produce and publish a Community Risk Register (CRR) that identifies the risks most likely to affect their local area. The NRR provides the national framework within which these local assessments sit. Academic research has found, however, that the NRR's usefulness at the local level can be limited by a lack of awareness among local stakeholders, restricted local resources, and a lack of actionable strategies for integration.
Chronic risks analysis
Since the 2023 edition, chronic risks have been separated from the acute risk assessments of the NRR. These are defined as long-term challenges that gradually erode the economy, community way of life, and national security. The 2022 UK Government Resilience Framework committed to developing a bespoke methodology for assessing these risks.
In July 2025, the Cabinet Office and the Government Office for Science published the first dedicated Chronic Risks Analysis (CRA), a 132-page document covering 26 chronic risks. The CRA uses futures and systems thinking methodologies, rather than traditional probabilistic impact assessments, to assess risks that are systemic and enduring in nature. For each of the 26 chronic risks, the CRA provides a snapshot of the risk's current status alongside a forward-looking analysis of potential future developments and their system-wide impacts.
Themes and risks covered
The 26 chronic risks identified in the CRA are grouped into seven broad themes:
Theme Risks included Security Changes in the nature of terrorism; changes in the nature of serious and organised crime; fraud and illicit finance Technology and cybersecurity Changes in the nature of cyber security threats; impacts from increasing reliance on digital platforms; dominance of global technology companies and concentration of risk; impacts from the use and capability of artificial intelligence Geopolitical Challenges to international institutions; state threats Environmental Climate change; biodiversity loss; increasing competition for critical minerals; pollution and environmental degradation Societal Impact of demographic change; disproportionate impact on vulnerable persons; disinformation and misinformation Biosecurity Antimicrobial resistance; animal diseases; foodborne diseases; plant pests; impacts from the expansion of engineering biology; increasing collection and use of human biological data Economic Reliance on global supply chains; impacts from emerging financial systems; impacts of ongoing skills shortages and mismatches
The CRA is designed to complement the NRR rather than replace it. Used together, the two documents are intended to enable risk practitioners and the resilience community to improve their understanding of both the immediate risk landscape and the longer-term drivers that could cause risks to evolve.
Reception and criticism
The National Risk Register and the NSRA have been subject to significant scrutiny from parliament, academia, and civil society organisations, particularly following the COVID-19 pandemic.
Pandemic preparedness
The UK's risk assessment system was heavily criticised for its failure to adequately prepare the country for the COVID-19 pandemic. The House of Lords Risk Assessment and Risk Planning Committee concluded in December 2021 that the pandemic had exposed the UK's risk management system as "deficient" and "too inflexible to provide the protection our nation needs". The committee found the government's strategy of "centralised and opaque risk assessment" had left the UK vulnerable, and described the level of secrecy surrounding the NSRA as "unacceptable and unnecessary".
Researchers at the Centre for the Study of Existential Risk at the University of Cambridge and the Future of Humanity Institute at the University of Oxford provided written evidence to Parliament arguing that the NSRA process was "not fit for purpose". They noted that the 2017 NRR had estimated that emerging infectious diseases could lead to "up to 100 fatalities", which they described as a gross underestimation that was out of line with available scientific evidence at the time, and which led to pandemic plans overly focusing on influenza rather than novel pathogens. They further argued that the exclusion of novel and low-probability risks was not a one-off error, but a systematic feature of the NSRA process.
The UK Covid-19 Inquiry's Module 1 report, published in July 2024 under the chairmanship of Baroness Hallett, similarly highlighted flaws in the UK's pandemic preparedness structures, noting that the risk assessment and planning system was overly bureaucratic and siloed.
Methodology and scope
The methodology underpinning the NRR and NSRA has also been questioned by academic researchers and policy analysts. David Blagden argued in 2018 that the NSRA process remains a "flawed exercise" because it fails to adequately address high-uncertainty risks, novel risks, and the limitations of likelihood-impact matrices. The use of capped five-point scales and reasonable worst-case scenarios has been criticised for lacking transparency and for downplaying high-impact risks, as the worst-case scenario for any given risk is based on what is challenging yet reasonable to plan for, rather than on the full scale of possible impacts.
Suzanne Raine of the Royal United Services Institute argued in 2021 that "half of the National Risk Register is missing" because it catalogues threats and hazards but fails to assess risks to the achievement of the country's strategic goals and opportunities. She called for the creation of a central risk assessment function in the Cabinet Office to provide a single, empowered point of analysis.
The Royal Academy of Engineering, commissioned by the Cabinet Office Civil Contingencies Secretariat to undertake an external review of the 2019 NSRA methodology, published seven principles for good practice in risk assessment. These included a recommendation that decision-making should be driven more by impact and preparedness than by likelihood, and that risk assessments should explore interdependencies between different risks rather than assessing each risk in isolation.
Academic researchers at the University of Oxford and University of Cambridge have also called for greater use of external expertise, more transparent publication of quantified risk estimates, and the creation of an independent government chief risk officer to carry out depoliticised risk assessments and hold departments to account.
Transparency and audience
The 2023 edition of the NRR was described by the government as "more transparent than ever", reflecting the principles of the UK Government Resilience Framework to communicate risk information in a more open and accessible way. The 2023 edition was also made available on a digital platform, though this was subsequently decommissioned in November 2024.
Despite these improvements, the National Preparedness Commission (NPC) noted in 2025 that the intended audience of the NRR remains unclear, and that the risk assessments are "still too vague to compel action by intended audiences", dealing largely with immediate or first-order impacts without adequately addressing cascade effects or the implications of assumptions being wrong. The NPC drew a favourable comparison with the Finnish National Risk Assessment, which situates each risk within a broader framework of national functions and clearly shows the potential severity of impact on each function.
Chronic risks
The exclusion of chronic risks from the NRR was itself a subject of criticism. Raine argued in 2021 that the NRR's focus on a two-year horizon and its exclusion of long-term structural risks represented a significant gap in the UK's risk management framework. The NPC welcomed the eventual publication of the Chronic Risks Analysis in 2025 but noted that the methodology for combining or cascading risks remained unclear, and called for greater integration of the CRA with the NRR. The Centre for Long-Term Resilience similarly welcomed the CRA but argued that acute AI risks should be added to the NRR urgently, given the rapidly growing significance of artificial intelligence to national security and resilience.
Parliamentary scrutiny
The House of Lords Risk Assessment and Risk Planning Committee recommended in 2021 that parliament should hold an annual debate on the NSRA, and called for the government to act under a "presumption of publication" and publish the contents of the NSRA except where there is a direct national security risk. The government accepted the principle of greater transparency but declined to publish the NSRA in full. The committee also recommended the establishment of an office for preparedness and resilience headed by a newly created government Chief Risk Officer, a recommendation the government said it would consider further once the outcomes of a crisis capabilities review and the public inquiry into COVID-19 had been published.
In early 2026, the House of Lords appointed a new National Resilience Committee to consider national resilience, including the role of local resilience, and to examine how the UK anticipates, prevents, mitigates, responds to, and recovers from major risks.