Facial recognition gets the scrutiny. The national police data service is the bigger change.

The public argument about police artificial intelligence in Britain is almost entirely about cameras. Vans in town centres. Watchlists. Faces scanned, arrests made, false alerts counted.

Meanwhile, a programme that would change what every one of those systems is able to see has been in design for over a year, has already moved millions of pounds to a defence contractor, and has no supplier announced for the main contract.

It is called the National Data Integration and Exploitation Service. Almost nothing about it is secret, and almost nothing about it is settled.

What is actually being built

The service is being delivered by the National Data and Analytics Office within the National Police Chiefs' Council, working with the Home Office. Its purpose is to let police forces reach data held by other forces and by other parts of the criminal justice system, rather than each force working from what it happens to hold locally.

At the centre of it sits what Computer Weekly, reporting in July 2026 on documents obtained under freedom of information law, described as a "police data factory". That component would draw together data from more than fifty law enforcement agencies, the Home Office, the Ministry of Justice and other partner bodies for analysis and reporting. According to the NPCC, those departments would not themselves see operational data or intelligence.

The director of the National Data and Analytics Office has framed the aim narrowly: not a single national platform, not collecting more data, but making sure data can be brought together when it is needed. That is a meaningful distinction, and it is worth taking seriously rather than dismissing. It is also, on its own, not verifiable from outside.

The money has started moving

The Home Office ran a request for information on national data integration and exploitation capability in June 2025, describing it explicitly as market engagement rather than a competition. Pre-market documents reported by Computer Weekly put the expected cost of the capability at between £75m and £250m over five years.

No supplier has been announced for that. What has been awarded is design work. Statewatch reported on 1 September 2026 that BAE Systems Digital Intelligence holds two Home Office contracts under the Police Efficiency and Collaboration Programme: one worth close to £1.3m running from December 2025 to May 2026, and a second worth £2.3m running from June 2026 to May 2027. The first, per a Home Office freedom of information response, covered technical and service design for integrating data across policing and linking it to other agencies.

The Police Efficiency and Collaboration Programme is itself a savings programme, aiming to remove £354m from a policing budget for England and Wales of roughly £20bn. The design work is the upfront cost of a plan whose stated justification is efficiency.

Statewatch's report is critical of the choice of contractor on grounds unrelated to policing capability, and readers can weigh that themselves. The procurement facts stand independently: two contracts, publicly listed on Contracts Finder, for designing how police data gets joined up.

The tools that would plug into it

The service is being designed so that analytical tools can connect to national policing datasets. Three appear in the documents obtained by Computer Weekly.

Prometheus is an in-house system for analysing data extracted from seized digital devices. It does not perform the extraction itself; it cross-references what has already been extracted against other police records to surface links and patterns. It is described as intelligence-only, and the outputs of intelligence-only systems are generally not admissible as evidence. It has been used primarily in child sexual abuse investigations, with a stated intention to widen the range of offences and eventually make it available to all forces. The NPCC has declined to say which five forces currently use it, citing exemptions relating to security bodies.

Palantir Nectar, built on the company's Foundry framework, is being piloted by Bedfordshire Police within the Eastern Regional Special Operations Unit, with Cambridgeshire and Hertfordshire able to access it through Bedfordshire. Leicestershire is leading a parallel trial in the East Midlands equivalent. One application maps locations an individual has visited from forensically extracted phone data. Bedfordshire declined to explain the mechanism by which it does so.

BAE Systems' Intelligence Lead Assessment Service appears alongside them as an existing commercial platform in the same space.

Police chiefs' documented concern was that running several overlapping platforms against the same underlying data produces duplicated cost and incoherent architecture. That is a reasonable engineering objection. The proposed answer is consolidation, which solves the engineering problem and concentrates the governance one.

Why none of this is a deployment on this site's tracker

The deployment tracker records systems in operational use, sourced to something that establishes use rather than intent. A procurement notice is not a deployment. A design contract is not a deployment. A framework a supplier hopes to sell into is not a deployment.

By that standard, the National Data Integration and Exploitation Service does not belong on the tracker today, and the police data integration and link analysis record carries far fewer entries than the scale of activity in this area would suggest.

That is the standard working correctly, and it produces an uncomfortable result: the largest police AI programme in the country is close to invisible in a record designed to track police AI. The same discipline that stops a tracker filling up with vendor announcements also means it lags the thing most likely to matter.

Which is worth stating plainly rather than quietly working around. The tracker records what is running. It is not a forecast, and it should not be read as one. Programmes of this size become visible in it late, and by then the architectural decisions have already been taken.

What is not established

Several questions about this programme have been asked by journalists and parliamentarians and have not been answered.

• Which supplier will build the main capability. None has been announced.
• Whether data attached to the Single Unique Identifier being piloted for schoolchildren would become reachable by police and criminal justice agencies. Design proposals reportedly contemplate integration with criminal justice data. Asked directly, the NPCC referred the question to the Home Office, which did not answer it.
• Which five forces are running Prometheus.
• Whether the National Police Service, the new agency the government intends the data service to sit within, will be subject to the Freedom of Information Act. A written parliamentary question on exactly this point was answered without addressing it.
• How location mapping from extracted phone data actually works, and therefore what its error characteristics are.

None of these is a claim that something improper is happening. They are gaps in the public record, and they are the specific gaps that would need filling before anyone outside policing could assess whether the system is proportionate.

The freedom of information point is the one with the longest reach. The NPCC's own AI covenant commits policing to transparency by default. If the body operating the national data service is structured in a way that puts it outside the Act, that commitment becomes considerably harder to test.

The pilot has already produced the documents to read

The Bedfordshire pilot is the closest thing to evidence of how this works in practice, and the force's own paperwork is more informative than any announcement.

A data protection impact assessment obtained by Computer Weekly recorded an unmitigated medium risk that personal data would be processed where doing so was neither proportionate nor necessary, and that the volume processed might be excessive. One feeder system held records on more than a thousand individuals in 2025 who had not been charged with any offence. An equality impact assessment produced before contracts were signed addressed impacts on the staff using the tool rather than on the people whose data it would process.

The force reports a genuine operational result from the pilot: a trebling of domestic violence disclosures. That is not nothing, and a fair account has to carry it alongside the risk register.

Part of the pilot is being audited by a consultancy that has a global partnership with the platform's vendor. The force did not answer questions about whether it considered that a conflict, though it says it is also evaluating the work internally.

Separately, the Mayor of London blocked a £50m Metropolitan Police contract with the same vendor on value-for-money grounds, while the force continues using the software for a further year.

Integration is the capability

The vendor's position, stated publicly, is that its software does not acquire data the customer does not already hold. It organises what is there so decisions can be made faster.

That is accurate, and it is also the point. The Metropolitan Police Commissioner has described his own force as holding thousands of datasets across hundreds of separate systems, and has argued for the ability to connect them and see patterns at speed.

Fragmentation has never been a deliberate safeguard. It has been an accident of procurement history. But it has functioned as one. Data held in six hundred systems is data that no single query can traverse, and a great deal of practical privacy in British policing has rested on that friction rather than on any rule.

Removing the friction is the purpose of the programme. Whether the legal framework that governed the fragmented version is adequate to the integrated one is a separate question, and it has not been asked as loudly as the question about vans.

What would move this onto the record

For anyone tracking this rather than arguing about it, a small number of documents would change the picture:

• A contract award notice naming the supplier for the main capability.
• A published data protection impact assessment for the service itself, not for an individual force pilot.
• Confirmation of whether the National Police Service falls within the Freedom of Information Act, which the Police Reform Bill should settle.
• Evidence that a force is querying national data through the service operationally, rather than testing a component of it.
• The promised public registry of AI deployed by forces, and whether a data integration service appears in it at all or is treated as infrastructure rather than as AI.

That last point may end up mattering most. A registry that lists facial recognition, report-writing tools and call triage, but treats the layer underneath them as plumbing, would describe the applications while omitting the thing that determines what the applications can reach.

Which leaves a question worth putting to the people building it: if a system decides what data every other police AI tool is able to see, is it infrastructure, or is it the most consequential AI deployment in British policing?