Research and data community feed

Emergency registration has ended

enquiries@nhsdigital.nhs.uk (NHS Digital) — Fri, 07 Jul 2023 11:35:40 GMT

Emergency registration allowed Registration Authorities to verify someone’s identity using video calls.

This was put in place when face-to-face identity checks were not possible during the COVID-19 pandemic. It ended on Wednesday 31 May 2023.

There are now 3 ways to verify an identity:

Electronic Staff Record (ESR) - if your organisation has the RA workbench enabled
Apply for Care ID
an in-person, face-to-face appointment

Change to smartcard passcode requirements

enquiries@nhsdigital.nhs.uk (NHS Digital) — Thu, 24 Jul 2025 08:23:16 GMT

We are changing the passcode requirements of NHS smartcards as part of a national update to the Care Identity Service for health and care staff. We are making this change as part of our preparation for rolling out a more advanced smartcard, the series 9.

The minimum security passcode length on all smartcards will change to 6-8 numbers only. We will no longer accept letters as part of your passcode.

Health and care professionals with a smartcard: your current passcode will continue to work. You do not need to change your passcode now.

You will only notice this change when the time comes to choose a new passcode, for example if your smartcard is locked.

The change will take affect from Wednesday 19 July 2023.

For health and care professionals with a smartcard, you will only notice this change when the time comes to change or reset your passcode.

Please ensure that the passcode you use is not easy to guess and contains 6-8 numbers only. Avoid using birthdays.

Remember that your passcode is the safety check that proves it is you using the card. All operations performed using that card are linked to you, so do not share the passcode with anyone.

If you have any queries about this change, please contact your local Registration Authority.

For registration authorities

You need to be aware of the new requirements to passcode in case staff approach you about the change.

If a user tries to set a passcode of fewer than 6 numbers, this will return an error message indicating that the passcode is too short.

Setting a new passcode with letters will also return an error.

Passcodes in Care Identity Management

The Care Identity Management smartcard passcode policy is still 4-8 characters.

This is out of step with the revised Care Identity Service application passcodes, which must be 6-8 numbers.

A future release of Care Identity Management will align the two services. This is expected by the end of September 2023.

Care Identity Management will replace the Care Identity Service application on 12 June 2024

enquiries@nhsdigital.nhs.uk (NHS Digital) — Wed, 19 Jun 2024 15:20:19 GMT

We have resolved the technical issue affecting the switch-off of the CIS application. The service will be switched off on 19 June 2024 after 8pm and all users will be redirected to Care Identity Management.

Care Identity Management is replacing the Care Identity Service application. From 12 June 2024 you will no longer be able to access the old service.

This means that all users of the Care Identity Service application must migrate to Care Identity Management before that date.

We had previously planned to close the legacy service on 28 March 2024. In response to user feedback, we extended the availability of the legacy service to give people more time to switch to Care Identity Management.

All users should switch to using Care Identity Management now.

All user types are able to access the service, including:

Registration Authority managers, agents and advanced agents
sponsors
unlockers and ID checkers
clinical users with no admin role

As of 9 May 2024 there remains a handful of functions that require the old Care Identity Service application, such as user reports and bulk position edit and removal. These will be available in Care Identity Management before the old application is switched off. You can keep up to date with the latest functionality via our release hub.

We have created support and guidance for all users adopting Care Identity Management. This will be expanded as new features are added to the service.

For further information about what features are being added in the coming weeks, visit our roadmap.

Deprecation note update 10 February: deprecated identity agents and smartcard update

enquiries@nhsdigital.nhs.uk (NHS Digital) — Thu, 08 Jan 2026 12:27:21 GMT

This news release updates on the ongoing and new plans to deprecate support for Identity and Access Management (IAM) Platform technology areas and ultimately the dates by which we will no longer allow those technology areas to access the national infrastructure.

After the success of the legacy Identity Agent deprecation work, which resulted in over 95% reduction in the use of unsupported Identity Agents, NHS Digital are now expanding the deprecation plans to include all versions of the NHS Digital Identity Agent that is not supported in the Warranted Environment Specification. This includes version up to and including NHS Identity Agent v2.1.16.

The Identity and Access Management team are finalising plans for how to support NHS Organisations deprecate Gem Series 05 and 06 smartcards and will provide further details soon.

Product/service	Unsupported	Access unavailable
Gem Series 4 cards (Gemplus)	30 March 2022	30 March 2022
BT IA Client	30 June 2021	30 September 2021
HSCIC v1 IA Client	30 June 2021	30 September 2021
HSCIC IA v2 Client	30 September 2022	30 December 2022
HSCIC IA v2.1.16 Client	30 September 2022	30 December 2022
Gem Series 05 or 06 (JCOP41 and JCP 41 cards)	30 September 2023	30 September 2023
CIS (authentication only)	30 September 2023	30 September 2023

NHS Digital will be contacting organisations affected by this deprecation directly. If you have any queries or require any further information, please contact IAMplatforms@nhs.net

The NHS Long-Term Plan has two clear areas that support the introduction of NHS Care Identity Service 2 (NHS CIS2) as a priority.

It will:

ensure that clinicians can access and interact with patient records and care plans wherever they are
mandate and rigorously enforce technology standards, as described in The Future of Healthcare, to ensure data is interoperable and accessible

For Series 5 and 6 smartcards there is no need to do anything at present, other than be aware that some NHS organisations may be required to start preparing for replacing these smartcards. NHS Digital will begin contacting organisations directly.

For version of the IA that are due to be deprecated, we are asking NHS Organisations to replace this software with the latest version. IA v2.3.2.0 overwrites all current version of the IA on a user’s machine, streamlining the replacement of updating.

If you require a smartcard report for a breakdown of the Series 4 smartcards still in operation within your organisations, please contact IAMplatforms@nhs.net

If you are a supplier or you lead a team that delivers a service that currently supports authentication via the Care Identity Service and want to move to NHS CIS2 then please start your planning now. Find out more about CIS2 Authentication.

We have a team who will also be driving up adoption of the new service over the next few years to allow us to switch off the Care Identity Service so watch out for further communications and engagement notes and events.

Position assignment expiry issue resolved

enquiries@nhsdigital.nhs.uk (NHS Digital) — Wed, 26 Feb 2025 09:49:21 GMT

On 25 February 2025, multiple sites reported multiple users experiencing a loss of access to services that require certain roles when using their smartcard to authenticate.

This issue was resolved on the evening of the same day, 25 February. No further action is required.

Affected users were unable to access specific services via smartcard authentication due to expired position assignments. NHS England technical teams developed a fix which reassigned the incorrectly expired position assignments and workgroup assignments for all affected users.

We apologise for any inconvenience this issue caused.

Action required by IT teams to support ongoing use of Care Identity Service

enquiries@nhsdigital.nhs.uk (NHS Digital) — Fri, 27 Feb 2026 14:57:37 GMT

IT teams need to:

work with Registration Authorities to make sure all series 4,5,6 (Gemplus, JCOP 41 and JCOP41) smartcards have been replaced by series 8 or above smartcards
install Oberthur middleware on all devices
update to the latest version of Identity Agent

It's important to complete all these steps as soon as possible. Failure to do so could result in authentication issues and service disruption.

End of June 2025

Oberthur middleware must be installed

Oberthur middleware must now be installed on all devices to maintain service access. Read about Oberthur middleware and how to install it.

If you are having issues with Oberthur installation you should raise it directly with the National Service Desk by emailing ssd.nationalservicedesk@nhs.net. You should:

use ‘OT Middleware Deployment – Prescription Signing’ as the subject of the email
include a description of the issue
if possible, include the output of the NHS England Diagnostic Tool

You can also raise the issue using the National Service Desk customer portal.

Identity Agent must be updated

All unsupported Identity Agent versions must be replaced. Find out how to update to the latest version of Identity Agent.

Updating Identity Agent will enable removal of TLS 1.0/1.1 ciphers. The National Cyber Security Centre (NCSC) and Microsoft advise that TLS 1.0 and TLS 1.1 should no longer be used. Organisations should upgrade to at least TLS 1.2 to maintain security.

July and August 2025

We intend to block authentication at planned intervals throughout these months for systems using unsupported Identity Agent versions.

This is to ensure that organisations update Identity Agent to enable the upgrade to at least TLS 1.2.

September 2025

Authentication will be blocked for unsupported Identity Agent versions using TLS 1.0/1.1. You must update to the latest version of Identity Agent to authenticate.

October 2025

The CIS1 Authentication service will drop to Silver Service Level Agreement (SLA).

Operational hours will remain 24 hours a day, 365 days a year, but support hours will be reduced to 8am to 6pm Monday to Friday and 99.5% availability (target maximum of 3.5 hours of downtime per month).

NHS CIS2 Authentication will continue to be run to Platinum SLA.

Read more about the retirement of CIS1 Authentication.

Moving from CIS1 Identity Agent to CIS2 Smartcard Connect

enquiries@nhsdigital.nhs.uk (NHS Digital) — Tue, 24 Jun 2025 10:17:59 GMT

As of November 2024, there are no planned or anticipated additional functionality or fixes to any of the NHS CIS1 Identity Agent versions currently supported.

The following NHS Identity Agent versions (including all previous versions) are deprecated, meaning they will no longer be supported and are expected to be retired from February 2027:

v2.4.6.0
v2.4.5.0

NHS CIS2 Smartcard Connect is available now and should be used by all organisations that no longer have a dependency on CIS1 Authentication. IT teams should ensure that users who prefer to use an NHS-issued smartcard have NHS CIS2 Smartcard Connect and NHS Credential Management installed.

NHS CIS2 Smartcard Connect is not required for users who rely on non-smartcard authenticators.

NHS CIS2 Authentication strengthens security practices in local organisations by requiring applications to ensure authenticated sessions are terminated.

These security standards introduce changes to the ways in which users authenticate using NHS CIS2 Smartcard Connect.

Users of NHS CIS2 Smartcard Connect may notice that:

inserting the smartcard no longer prompts the entry of the smartcard passcode - users will need to access an application or resource in order to be prompted to use the smartcard
removing the smartcard no longer terminates an authenticated session - applications using NHS CIS2 Authentication will introduce changes to ensure that users are logged out after periods of inactivity

users may be asked to authenticate more than once throughout a working day - in line with OIDC standards, we are introducing changes to ensure that patient data remains protected, which may mean that users authenticate more frequently

Download the supported version of NHS CIS2 Smartcard Connect.

We will be releasing further guidance based on feedback. For more information about NHS CIS2 Authentication or NHS CIS2 Smartcard Connect, please email iamplatforms@nhs.net

End of support for TLS 1.0 and 1.1

enquiries@nhsdigital.nhs.uk (NHS Digital) — Wed, 15 Oct 2025 06:33:55 GMT

Your IT team must make sure you are running the latest version of Identity Agent. If you are not running the latest version, you may have problems logging in.

The information below is for IT teams.

To ensure sensitive authentication data is properly protected in line with National Cyber Security Centre (NCSC) and Internet Engineering Task Force (IETF) guidance and best practice, we stated that protective measures will be used to stop all use of TLS 1.0 and 1.1 from 1 July 2025.

Key date: TLS (1.0 and 1.1) will be retired and permanently blocked from use on Wednesday 15 October at 6:00am.

IT teams need to update to the latest version of Identity Agent. Failure to update could result in authentication issues and service disruption.

Users impacted by the retirement of TLS 1.0 and 1.1 will receive an error message and will be unable to authenticate. The error message looks like the image below.

The error message will read: "The underlying connection was closed: An unexpected error occurred on a send."

Anyone who sees the error message must immediately get in touch with their local IT team to upgrade their software.

If you are a supplier supporting the NHS or responsible for IT at an NHS organisation and you are requested to support, you should arrange for users to upgrade to the latest version of Identity Agent.

If local IT teams need further support, they should contact the National Service Desk.

Spine Directory Service (SDS) upgrade on Saturday 19 July 2025

enquiries@nhsdigital.nhs.uk (NHS Digital) — Wed, 09 Jul 2025 11:20:35 GMT

Summary 

We are carrying out an upgrade to the Spine Directory Service (SDS) DEX hosts on Saturday 19 July 2025 between 10:00am and 11:00am.

This upgrade will provide greater observability of both system connectors to our Directory Services, and specific queries in use. This will allow us to more safely manage future Directory Services upgrades, and service stability.

Impact

Within the upgrade window there will be a 5-minute outage across all SDS DEX hosts. During the outage you will be unable to connect to the hosts or run searches, until they are back up.

Authentication will not be affected.

Support

If your organisation observes any unexpected issues, please immediately report them via the normal routes to our National Service Desk:

Tel: 0300 3035 035
Email: ssd.nationalservicedesk@nhs.net
Portal: https://www.support.digitalservices.nhs.uk/csm

Service vulnerability in NHS Identity Agent - mandatory update required

enquiries@nhsdigital.nhs.uk (NHS Digital) — Thu, 11 Sep 2025 11:04:59 GMT

There is a medium-severity service vulnerability with all previous versions of the NHS Identity Agent, including v2.4.5.0, and v2.4.6.0.

Organisations are required to move to v2.4.10.0 as soon as possible, within your regular patching schedule, and no later than 12 October 2025, as this version resolves this vulnerability.

All previous versions of the Identity Agent client are retired with immediate effect.

You can:

Update and reminder of service level agreement (SLA) changes on CIS1

enquiries@nhsdigital.nhs.uk (NHS Digital) — Tue, 30 Sep 2025 10:33:46 GMT

On 1 October 2025 the support level on the CIS1 Authentication service will reduce from Platinum to Silver.

Support hours will be reduced to 8:00am to 6:00pm Monday to Friday, and availability targets will also be reduced.

NHS England are in contact with all suppliers who still need to migrate to CIS2 to urgently determine their plans, and to confirm that they have clearly communicated to their customers and users the change in support and any risks they are now facing.

See a list of all applications that have migrated to CIS2.

If you have any concerns about whether your application is impacted, please speak to your supplier to determine their status, plans and how they intend to mitigate operational and clinical risks.

Other SLA changes

There are more changes in SLA planned. On 1 March 2026: 

CIS1 will no longer have an SLA and will be supported on a 'reasonable endeavours' basis

costs will be reduced as much as possible by scaling down infrastructure and support to a bare bones service with little or no redundancy

By 28 February 2027 we will remove CIS1 Authentication from operational service, meaning it can no longer be used. 

Why we're doing this

We are retiring CIS1 Authentication and migrating to CIS2 Authentication to:

help NHS organisations take advantage of more modern authentication methods, including multi-factor authentication, security keys and biometrics
remove dependencies on HSCN connections

CIS2 Authentication is also based on open standards, making it easier for suppliers to adopt changes compared to CIS1.  

What this means for you

Suppliers and users of CIS1 Authentication services should switch to CIS2 Authentication now.

Suppliers who have not switched to CIS2 should inform their customers that their services will be on a reduced SLA from 1 October 2025.

If you as an NHS customer are impacted by these changes, the suppliers of your product is contractually obligated to inform you of upcoming changes. Please consult with your supplier or email iamplatforms@nhs.net for more information.

Slides from the Identity and Access Management roadshow November 2025

enquiries@nhsdigital.nhs.uk (NHS Digital) — Thu, 06 Nov 2025 15:39:34 GMT

Thank you to everyone who attended our November roadshow on 6 November 2025.

The agenda was as follows:

CIS Service Level Agreement updates
Major Incidents (October 2025)
Single Sign on Proof of concept
Smartcards & Printers
IAM Software and deprecation
IAM User research panel -
SRA and TAC
National RA updates
Comms channels updates
Best practice updates

Download a PDF of the slides from the event.

CIS1 Authentication moves to no SLA on 1 March 2026

enquiries@nhsdigital.nhs.uk (NHS Digital) — Fri, 27 Feb 2026 14:48:50 GMT

We are reducing the service level for CIS1 Authentication to no SLA on 1 March 2026.

The service is still planned for retirement on 28 February 2027.

As part of the deprecation, the service level for CIS1 Authentication dropped to silver on 1 October 2025.

The CIS1 Authentication service will move to no SLA on 1 March 2026, in line with CIS1 Authentication deprecation timelines. This means that from this date CIS1 will no longer have an SLA and will be supported on a 'reasonable endeavours' basis.

CIS2 Authentication operates to a platinum service level, meaning it is available and supported 24 hours a day, 365 days a year.

By 28 February 2027 we will remove CIS1 Authentication from operational service, meaning it can no longer be used.

For more information please see the CIS1 Authentication deprecation notice.

Slides from the Identity and Access Management roadshow March 2026

enquiries@nhsdigital.nhs.uk (NHS Digital) — Thu, 26 Mar 2026 11:36:58 GMT

Thank you to everyone who attended our November roadshow on 24 March 2026.

The agenda was as follows:

IAM user research panel
Recent and upcoming changes
NHS CIS supplier updates
NHS smartcards
Identity Agent and Smartcard Connect
National RA updates
Non-smartcard authenticators
AAL2 self-service
Series 10 smartcards
Comms channels updates
Best practice updates

Download a PDF of the slides from the event.

Older smartcards and Identity Agent versions now blocked

enquiries@nhsdigital.nhs.uk (NHS Digital) — Thu, 07 May 2026 08:21:05 GMT

Care Identity Service authentication with older smartcards and Identity Agent versions was blocked permanently at 8:00am today, 7 May 2026.

Series 5 and series 6 smartcards have now been permanently blocked from authentication. This follows the permanent block of series 4 smartcards in February 2026.

If your smartcard is blocked, you will see this message.

The following versions of Identity Agent are now permanently blocked from authentication:

BT Identity Agent v13
NHS Digital v1
NHS Digital v2
2.1.2.16
2.2.1.0
2.2.2.0
2.2.3.7
2.2.3.9
2.3.0.0
2.3.2.0
2.4.5.0
2.4.6.0

If your Identity Agent version is blocked, you will see this message.

If you see this message, you need to update to the latest version.

Find out more about the blocking of:

Introducing series 10 smartcards

enquiries@nhsdigital.nhs.uk (NHS Digital) — Thu, 25 Jun 2026 08:47:13 GMT

Series 9 smartcards are no longer being manufactured and we are about to introduce series 10.

We recommend that organisations update to the latest version of Smartcard Connect. For series 10, smartcard management services such as issuing and renewing smartcards will only work with Smartcard Connect, not Identity Agent.

Authentication with series 10 smartcards will still work with Identity Agent, but this is being retired in February 2027.

For printing all smartcard versions with Smartcard Connect v4.2, you will need to make sure you have the latest printer smartcard reader driver.

Find out more about series 10 smartcards.

Online broadcast session

We're also running a session aimed at Registration Authority and IT teams who support end users, covering:

series 10 and Smartcard Connect requirements
series 10 and legacy Identity Agent limitations

The half-hour event will be on Wednesday 3 June 2026, at 12:30pm. You can register for the event here.

You can also submit a question for the event by emailing IAMplatforms@nhs.net

Help with series 10 smartcards

For any issues with or feedback on series 10 smartcards, please complete this form.

Video, slides and key messages from the series 10 smartcard intro broadcast

enquiries@nhsdigital.nhs.uk (NHS Digital) — Thu, 25 Jun 2026 08:48:56 GMT

Our series 10 smartcard intro broadcast took place on Wednesday 3 June 2026, at 12:30pm.

View video full-screen.

Good afternoon everybody and welcome to this Identity and Access Management series 10 smartcard broadcast. My name is Richard McDermott. I'm part of the NHS England Identity and Access Management engagement team.

We've got some colleagues with me today that will be talking through some of the requirements for software and hardware related to series 10 smartcards. Very briefly, the broadcast today will be recorded. It will be made available on our website as soon as possible. There's a significant amount of interest in this session and this session is in fact full, but please feel free to share the recording with colleagues that have been unable to register for this session today.

As I said, the agenda today will be talking about Series 9 and 10 smartcard supply, talking about Smartcard Connect version 4.1 and the various requirements for IT and RA teams going forwards.

I'm going to pass over to my colleague, Phil Gill, who I'll let introduce himself as he runs through the early part of our slides. Phil.

Thanks, Richard. Good afternoon, everyone. So I'm Phil. I'm the product owner for Client and Credentials, which covers smartcards and associated software at NHS England and IAM. Yeah, so series 10 smartcards. The Series 9 cards are no longer being produced. So as a result, can't get any more. And we will be issuing series 10 smartcards probably from next month onwards. We certainly need to start doing that for everyone by the end of July because our series 9 stock will be exhausted then. So, there'll be no further series 9 held in stock.

We've got an image of a series 10 smartcard on the screen. So you'll see the serial number is preceded by 10. That's how you identify it's a series 10 smartcard. These are now active on the ordering portal. So If you request them, we will manage the supply of them through till we start going to full supply from later on in July.

Next slide, please, Richard. Oh, thank you. You've done it already. So a couple of points to make. Series 10 smartcards work with our new version of Smartcard Connect that was released last week. That's version 4.1. And it's required to perform all smartcard management operations. So that includes issuing and printing a card,
unlocking it, self-service and Registration Authority and legacy local smartcard administrators and Registration Authority repair because part of repair is renewing certificates as well.

The legacy Identity Agent version 2.4.10 and the legacy Credential Management, which our latest version is 1.4.2.0, work with series 10 smartcards, but only for authentication. So each of your end users can continue to authenticate if they've got those components. But as we say there, only until the 28th of February 2027, because we're retiring CIS1 at that time. You can't use legacy IA for any other smartcard operations for a series 10.

Series 10 smartcards only work with our only assured printer now, which is the Magicard DOH 300 V2. If any of you have the very old turquoise or blue printers, series 10 smartcards do not work with them. It's to do with various processing speeds. There's nothing we can do about that. And we've got a link there to where you will find details of the printers.

Next slide, please, Richard. So Smartcard Connect version 4.1 is a software package that includes Credential Management, includes Smartcard Connect, and now it's also bundled with the NHS Smartcard Diagnostic Tool. When you install it, it will overwrite previous versions of Smartcard Connect. If you are putting it on a machine that has the legacy Identity Agent, you do need to uninstall the legacy Identity Agent. And another thing to mention, we are looking at developing a single installer that will install required software, middleware and drivers, that might be useful to some organisations. And once that comes to fruition, we'll put some more information out about it and make it available to IT teams. And again, we've got two links there as to where you can get further details.

Next slide, please, Richard. So try to do a summary table here in terms of Smartcard Connect and legacy Identity Agent with series 10 smartcards. Both packages will allow for authentication, but RA issue, RA repair, RA renew, self-service smartcard unlock, self-service smartcard passcode change and self-service renew will only work with Smartcard Connect 4.1. They will not work with the legacy Identity Agents.

And a couple of notes there at the bottom. Series 8 and series 9 smartcards also work with the legacy Identity Agent and this new version of Smartcard Connect. And the legacy Identity Agent and the latest version of Credential Management version 1.4.2.0 will not work after the 28th of February next year in line with CIS1 retirement.

Next slide, please, Richard. And now I think I'm handing to Owain.

Yeah, hi everyone. So following on from what Phil has just explained around series 10 and the crossovers with Smartcard Connect, we wanted to bring to everyone's attention the user behaviour changes that we're going to see with Smartcard Connect. And this applies to all versions of Smartcard Connect itself.

So the main one is that it will be different to how the Identity Agent works today. So when you put your smartcard into a card reader today, the Identity Agent pops up your passcode entry box. This won't happen with Smartcard Connect. What you'll need to do is go into an application, for example the National Care Record Service, and that will then trigger the passcode pop-up within Smartcard Connect. This is similar across all applications where you're doing smartcard access using Smartcard Connect.

In a similar fashion, removing your smartcard from the card reader will not log you out of the session. This is part of the CIS2 Auth functionality as well as specific to Smartcard Connect. You will need to manually log out of an application when you are finished in order to retain IG and information security.
You will also need to enter your passcode every time you open up a new application. So for example, if you are opening up the National Care Record Service or the e-Referral Service, each time you load one of those and go to enter your passcode, you will have to enter it each time. This is because of the way that CIS2 Auth works and how each of the individual applications have chosen to interact with CIS2 Auth. There's a setting that they're using which prompts each time you log in.

And for everyone's benefit, Smartcard Connect works over internet and HSCN, whereas the legacy Identity Agent only works on HSCN.

Further to what Phil said about series 10, Smartcard Connect is required to use self-service unlock and self-service smartcard renewals. This is a reiteration of what Phil has just gone through with the previous table.

We also wanted to draw to everyone's attention that as things progress, they may not feel they need smartcards within your organisation or any of the additional software such as Smartcard Connect. So when we share these slides, you'll be able to find out more about our other authenticators by clicking on the link.

We did have a few questions ahead of time around potential challenges with third party suppliers.

So we only know about two issues at the moment. So the Access Group, and specifically here it's the Rio application. When using Drop Zone, it does not support Smartcard Connect or any other CIS2 Auth non-smartcard authenticator. As a result, it will only support series 10 when using the Legacy Identity Agent. So there's no crossover there between series 10 and DropZone and it not working. It is about the software that's in use, i.e. Smartcard Connect versus Identity Agent. I believe the Access Group this morning has released some updates about the DropZone functionality. We've not had chance to digest those updates just yet, so this may be slightly incorrect compared to that update.

When it comes to virtual smartcard providers, due to the way that virtual smartcards have a hard dependency on CIS1 Authentication and basically the underlying infrastructure, they are unlikely to work when Smartcard Connect is installed. We are having dialogue and we continue to have dialogue with the two vendors or the two known vendors of virtual smartcards at this point to ensure that we can facilitate a CIS2 Authentication aligned solution or solutions. That dialogue has changed a little with our move to support the 10-year plan. So we are working on it, but it is known that the virtual smartcards themselves are unlikely to work.

And fundamentally, these are the two that we know about. If you come across any other issues with series 10 or with Smartcard Connect not working with different systems, please use the link that we've got on screen and will be in the notes when we share them. This will make us aware and we can pick up with that supplier.

Thanks very much, Owain. So thanks to Phil and Owain there for running through some of the details around series 10 physical smartcards and Smartcard Connect version 4.1.

As a roundup, we want to make sure everyone's aware of the key takeaways from the presentation that we've just shared there. So series 10 smartcards will be issued from July 2026 - exactly when in July, that, as Phil said, that depends on kind of the running out and expiring the series 9 stock. The legacy Identity Agent version 2.4.1.0 and Credential Management version 1.4.2 will only support authentication and this is until the 28th of February 2027.

So again, as a reminder, all card management operations, whether they're via an RA or whether they're via self-service or self-service unlock, require Smartcard Connect version 4.1 in order to perform these.

And as a final reiteration, Smartcard Connect and user behaviour change that we expect to require some changes in behaviour from some users. Removing your smartcard no longer logs you out of an application and a user is expected to log out of an application when they're finished. Inserting a smartcard no longer presents the passcode pop-up box as a number of people will be familiar with with the legacy Identity Agent. A user has to go to the application they're looking to authenticate into in order to see the passcode pop-up box and the expectation be on based on supplier implementation of CIS2 Authentication is that passcode input is required each time you open a new application.

And finally from us today, as I highlighted, there are a number of systems and suppliers that work with series 10 smartcards and Smartcard Connect. But if you do have concerns or if there are any system suppliers that have some challenges with series 10 smartcards and Smartcard Connect. There's a web form there available to capture the key information so we can gather that at an Identity and Access Management team level and work with you and system suppliers to resolve those challenges.

Final slide we have, which will be available on the NHS England's Identity and Access Management website, is some helpful links around Smartcard Connect series 10s, non-smartcard authenticators, and our news headlines where we put kind of up-to-date changes based on latest news from within the IAM space.

Finally, thanks very much for everyone for joining us today. Appreciate the questions that we had in advance on request, and hopefully we've covered those off in the slide deck. We are available via the IAM platform's email address for questions ongoing.

But yeah, thanks very much everyone for joining us today and that's everything from us.

Download a PDF of the slides from the broadcast.

Series 10 smartcards will be issued from July 2026.

Smartcard Connect is required for all series 10 smartcard management operations.

Legacy Identity Agent software must be uninstalled before installing Smartcard Connect.

Legacy Identity Agent (v2.4.10.0) and Credential Management (v1.4.2.0) will only support authentication, until 28th February
2027 (CIS1 retirement date).

Smartcard Connect may require user behaviour change:

removing your smartcard no longer logs you out of an application
inserting a smartcard no longer presents the passcode popup box
passcode input will be required each time you open a new application

For printing all smartcard versions with Smartcard Connect v4.1 and any future versions, you will need to make sure you have the latest printer smartcard reader driver.

Use this form to highlight any supplier issues with series 10 smartcards.

Upcoming improvements to Care Identity Management reports

enquiries@nhsdigital.nhs.uk (NHS Digital) — Thu, 13 Aug 2026 14:18:54 GMT

We're improving the Authenticators report to include:

every active authenticator assigned to every user in your organisation, including all CIS1 and CIS2 authenticators registered before and since 1 January 2025
the last login date for authenticators using either CIS1 or CIS2 Authentication
when and by whom each authenticator was issued

We're also permanently removing the Logins report.

We're planning to have these changes live by the end of September 2026.

As organisations move from CIS1 to CIS2 Authentication, this has highlighted the limitations of the current Authenticators and Logins reports.

Removing the Logins report

Currently the Logins report only shows the last login date of smartcards, and only those through the legacy Identity Agent.

The majority of smartcard and non-smartcard authentications now use CIS2, and as we approach the retirement of CIS1 and Identity Agent in February 2027, the information in the Logins report will become less useful.

The improved Authenticators report will cover the last login date for both CIS1 and CIS2 authentications, including both smartcards and non-smartcard authenticators.

Data before 2025

The current Authenticators report can only show authenticators registered since the start of 2025.

The improved report can now access data for all authenticators as far back as exists in our database, including the last successful login date for each authenticator.

Other reports

We're not changing the other reports. You should be able to use the Users, Requests, Smartcards and Positions reports as usual.

We're keeping the Smartcards report separate for now, but both CIS1 and CIS2 smartcards will also appear in the improved authenticators report.

If you have any feedback or concerns about these changes, you can join one of our twice-weekly Feature Focus sessions.

Detailed plan for update of Authenticators report

enquiries@nhsdigital.nhs.uk (NHS Digital) — Fri, 18 Sep 2026 10:45:03 GMT

We previously outlined how we plan to update the Authenticators report in Care Identity Management.

We can now provide more detail on the plan and associated dates.

Our users have asked us to provide more helpful data than is currently available in the Authenticators and Logins reports.

The huge number of authentications each day produces data that would slow down the service if it was accessed every time a report is generated. By reformatting the historical data related to non-smartcard authenticators, we can access the data without affecting the stability and speed of the service.

This means we'll need to take a 2-step approach to updating the Authenticators report.

Our release on 17 September 2026 will introduce the following fields:

Last login
Status (active, inactive or expired)
Expiry date
Issued on
Issued by
Issuing ODS

Authenticators available

The report will include:

all smartcards
non-smartcard authenticators that have been registered since the start of 2026

We will not be able to show any non-smartcard authenticators registered before 2026 at this stage.

Data available

For this first part of the update, Issued by and Issuing ODS will only contain data for smartcards, and will be blank for non-smartcard authenticators.

The Issued on, State and Expiry fields will be populated for all authenticators.

The Last login field will show the last login date of:

any smartcard used to authenticate into a system using CIS1 Authentication
a smartcard user authenticating into a system using CIS1 Authentication - note if the user has more than one smartcard, the report will not show which they have used, only the login date
any non-smartcard authenticator since 10 August 2026 - we need to begin with a small set of data due to the changes we're making to the database

Users with multiple smartcards

We cannot differentiate between different smartcards held by a user, and will only be able to show when they last logged in with any of their smartcards.

From the end of October 2026, we will start adding more data.

This may happen in multiple releases. We will only add data where we are certain it will not affect the speed or stability of the service.

This could mean we add all authenticators to the report in one release, before adding data for last login data in a later release.

We do still plan to remove the Logins report, but we do not have a date for this yet.

All other reports will be unaffected by these changes.

If you have any feedback or concerns about these changes, you can join one of our twice-weekly Feature Focus sessions.

Update to the National Role-based Access Control (RBAC) table

enquiries@nhsdigital.nhs.uk (NHS Digital) — Fri, 18 Sep 2026 10:15:10 GMT

We've published an updated version of the National Role-based Access Control (RBAC) table, with the following changes:

simplified the database for Registration Authority users and suppliers
updated to reflect changes since version 27.2, such as codes relating to ARRS (Additional Roles Reimbursement Scheme)
provided an expanded and detailed view of baseline activities and further downstream dependent activity codes, to show what attributes are inherited when assigning a particular job role code or activity code

Download the new version of the RBAC table.

Identity and Access Management Q3 update November 2026

enquiries@nhsdigital.nhs.uk (NHS Digital) — Wed, 23 Sep 2026 08:50:56 GMT

Our next update will take place on Tuesday 3 November 2026, from 11.00am to 12:30pm.

This event is aimed at people with a Registration Authority role and IT team members.

Registration is now open via this link:

https://events.teams.microsoft.com/event/e428b438-1429-4fd0-b398-8f85378bc1a7@37c354b2-85b0-47f5-b222-07b48d774ee3

The full agenda will be confirmed soon.