NeuroPathway & Safe Space — official guidance reference pack

Compiled 5 October 2026. England-focused health, social care and education sources, with relevant UK-wide privacy law and professional codes. This is a curated starting collection, not every rule across every service or UK nation.

How to use: start with the checklist, then check the publication page, download and applicability for each relevant source. Guidance, statutory codes, legislation, professional standards and procurement frameworks have different authority. Professional codes apply to their respective workers; school, council and NHS duties do not automatically transfer to the software supplier.

Versions: official pages confirm Working Together 2026; KCSIE 2026 in force from September; September 2026 safeguarding information-sharing guidance; and the current DTAC form, replacing the previous form from April 2026. DCB standards are under review: use published current releases until replacements are formally issued. ICO guidance may be under review following the Data (Use and Access) Act; check commencement and current guidance.

Downloaded files retain their original publisher content and copyright. Web snapshots may need internet access for images and styling. Link-only entries are clearly marked. A saved publication landing page is not necessarily the whole guidance: see its linked documents and supplements. Archived, older, translated and accessible alternatives may also appear; use the current applicable English source for governance decisions.

Apply the guidance: pilot readiness checklist

This is a suggested implementation checklist, not a completed audit or legal sign-off. Assign named owners and attach evidence before changing any status to complete.

1. Define the service. Record intended users, ages, purposes, organisations and actual features. Separate child wellbeing, professional EHCP evidence, research and clinical care.
2. Confirm responsibilities. Agree controller/processor roles, supplier duties, deploying partner duties, safeguarding lead and deputy, and decision-making authority.
3. Map data. Record each data item, lawful purpose and basis, special-category condition, access, sharing, storage, transfers, retention and deletion. Pseudonymised data can still be personal data.
4. Complete the child-focused DPIA. Consider shared devices, coercion, distress, inference, AI errors and misuse. Explain privacy in age-appropriate language. Establish a lawful consent or other lawful-basis process for each use.
5. Agree safeguarding. Document escalation, local thresholds, allegations routes, operating hours and cover. Do not imply journals are monitored unless a staffed service actually provides this.
6. Keep evidence credible. Preserve author, date, setting, source observation, intervention, review, outcome and child/parent views. Label hypotheses and missing evidence. An EHCP evidence summary does not guarantee a needs assessment or plan.
7. Assess clinical scope. A qualified clinical safety officer should help determine DCB applicability. Supplier safety work and a deploying organisation’s local safety assessment are distinct. Assess medical device intended purpose where relevant.
8. Prepare assurance. Use the current DTAC form where in scope; evidence security, technical testing, access controls, audit trails, accessibility, usability and interoperability. DTAC is an assessment framework, not a universal NHS certificate.
9. Classify the pilot. Decide whether activity is service evaluation, audit or research. Agree approvals, sponsor responsibilities where relevant, recruitment, consent, measures and stopping criteria.
10. Maintain a review record. For each source record the version, relevant duties, owner, implementation evidence, gaps and next review. Check current publication pages at point of use.

Official source register