Somewhere along the way, “vulnerability” became a leadership skill. Something senior people perform in a town hall — the story about the failure, the admission that they don’t have all the answers, the deliberate pause.
That isn’t the vulnerability that matters.
The vulnerability that matters belongs to the healthcare assistant who thinks a colleague is cutting corners on medication rounds. The junior analyst who noticed the numbers don’t add up. The person who was harassed at the Christmas party and has to decide, on Monday morning, whether to say anything.
For them, speaking up isn’t a leadership style. It’s a risk. And people are quite good at calculating risk.
The number that should worry you
Every year the NHS asks 766,000 staff how it feels to work there. The 2025 survey, published in March 2026, contains two figures that belong side by side:
60.29% of staff feel safe to speak up about anything that concerns them. Not brilliant, but not a catastrophe — and it’s the lowest that measure has ever been.
47.59% are confident their organisation would then address the concern. Down from 49.51% the year before. Also the lowest ever recorded.
Read those together and you get the real picture. A substantial share of NHS staff feel safe enough to raise a concern and expect nothing to come of it. They’ll take the personal risk. They just don’t believe it buys anything.
It’s worse for clinical concerns, where you’d hope the machinery works best: 71.10% would feel secure raising a concern about unsafe clinical practice, but only 55.49% think their organisation would act on it.
It isn’t your managers
The tempting conclusion is that line managers are the problem — that people don’t speak up because their boss isn’t approachable. The data says otherwise, quite emphatically.
In the same survey, 73.04% of staff say their immediate manager encourages them, and 72.65% say their manager is genuinely interested in listening when they describe the challenges they face. Both are the highest those measures have ever been.
So the individual conversation is going better than ever. It’s what happens after the conversation that has collapsed.
You can see the drop-off in the incident data:
- 86.16% say their organisation encourages staff to report errors
- 67.30% believe action is taken so it doesn’t happen again
- 61.02% were given any feedback about what changed
- 59.29% believe staff involved in incidents are treated fairly
Twenty-five percentage points between “we encourage you to report” and “someone told you what happened next”. That gap is not a communications problem. It’s a systems problem wearing a communications problem’s clothes.
People aren’t afraid. They’re unconvinced.
This isn’t a healthcare quirk. Culture Shift surveyed more than 1,000 UK employees at the start of 2026 and found that 28% had experienced bullying or harassment in the previous twelve months — and almost 60% of them said nothing. Thirty-seven per cent said speaking up “isn’t worth the personal risk”. Junior employees were twice as likely as senior leaders (54% against 27%) to describe speaking up as pointless because nothing meaningful would be done.
That last split is the one to sit with. The people with the most to lose are also the people who believe least in the system. And they’re not being cynical — they’re being empirical. They’ve watched what happened the last three times someone raised something.
Fear gets all the attention in speak-up campaigns. Futility does more damage, because futility is rational. You can address fear with reassurance. You cannot address futility with reassurance, because the person has already run the experiment.
Anonymity doesn’t rescue it either: in the same research, more than two-thirds of employees said their workplace offered anonymous reporting, but 41% were worried they’d be identified anyway.
From October, the law stops taking your word for it
There’s a deadline attached to this now.
On 30 October 2026, the Employment Rights Act 2025 raises the duty to prevent sexual harassment from taking reasonable steps to taking all reasonable steps — and extends it to harassment by third parties, meaning customers, patients, contractors, suppliers and members of the public. Separately, since April 2026, a disclosure about sexual harassment is automatically a protected disclosure, giving the person who raises it full whistleblowing protection against detriment or dismissal.
The word doing the work is “all”. A policy and an annual training module were arguably “reasonable”. They are not “all reasonable”. The standard now expects proactive risk assessment, documented preventative action, and — this is the part most organisations will fail — evidence that the system responded when someone used it.
Which turns a cultural aspiration into an evidential one. In a tribunal, “we have a strong speak-up culture” is a sentence. “Here are 41 reports over 18 months, with dates received, owner assigned, action taken, feedback given, and time to closure” is a defence.
Culture Shift’s 2026/27 research found that 91% of senior UK HR professionals were confident they could evidence taking all reasonable steps if challenged today — but only half could show clear reporting processes were in place, and only a third had measures to prevent retaliation. Confidence and evidence are not the same asset.
One more piece of timing: the National Guardian’s Office, which oversees Freedom to Speak Up guardians across the NHS, closes in 2026 with its functions moving into NHS England. Guardian roles remain mandatory. But the national scaffolding around them is being rebuilt at exactly the moment the numbers are at their lowest.
Closing the loop is the whole job
If you take one thing from the data, take this: the problem is almost never getting the first report. It’s what the organisation does in the fortnight afterwards.
Practical, in rough order of impact:
Tell people what happened. Not the confidential detail — the fact of movement. “Your report was reviewed on the 14th, it’s with Sarah in HR, you’ll hear by the 28th.” Sixty-one per cent got any feedback at all. Fixing that one number moves the futility number more than any poster campaign.
Put a clock on it. Every report needs an owner and a due date from the moment it lands. Concerns don’t die from being rejected; they die from drifting.
Count the silence. A department reporting nothing is not a healthy department. It’s an unmeasured one. Reporting rates that vary wildly between similar teams tell you where the trust is, and where it isn’t.
Separate treatment from outcome. Fifty-nine per cent believe people involved in incidents are treated fairly. If reporting an error is indistinguishable from being blamed for one, the rate will fall regardless of what your policy says.
Keep the record whether or not anything comes of it. Most concerns are resolved quietly and correctly. Those are the ones that prove the system works — and they’re the ones nobody writes down.
Let the pattern surface. Three low-level complaints about one manager, spread across eighteen months and three different inboxes, look like nothing individually. Held in one place, they look like exactly what they are.
The honest version
Vulnerability isn’t something leaders demonstrate. It’s something employees spend.
Every person who raises a concern is spending social capital, and sometimes career capital, on the belief that it will be worth it. Your speak-up rate is simply the running total of how well that bet has paid off for the people who made it before them.
You can’t talk your way out of a poor track record. You can only build a new one — visibly, in public, one closed loop at a time.
Where our platform fits
This is the problem CalmER was built for. Every concern that arrives gets an owner, a due date and a status the reporter can see. Cases stay linked to the people and patterns behind them, so the third complaint about the same manager doesn’t look like a first. Nothing sits in an inbox waiting for someone to remember it.
For healthcare providers, CompliantCare does the same for incidents and clinical concerns: reported, triaged, actioned, and — the step almost everyone drops — fed back to the person who raised it, with the audit trail intact. See incident management and case management for how that works in practice.
Come 30 October, you’ll want to be able to prove all of it.
Related reading: the Worker Protection Act and the preventative duty, PSIRF, SAF and the new bar for assurance, and the human cost of non-compliance.
Sources: NHS Staff Survey 2025 briefing, NHS Confederation and NHS Providers; National Guardian’s Office speaking-up data; Culture Shift, “UK Employees Are Scared to Speak Up About Bad Behaviour in the Workplace” (February 2026) and the Culture Shifters Annual Report 26/27; Acas guidance on the Employment Rights Act 2025.