The National Risk Register: What It Says and How to Read It

The National Risk Register (NRR) is the government's public list of the most serious risks facing the UK, from flooding and severe weather to pandemics, cyber attacks and terrorism. It is the public-facing version of a classified document called the National Security Risk Assessment (NSRA), and it sets out the government's assessment of how likely each risk is and how bad its effects would be¹. The latest edition was published in January 2025 and covers 89 risks within 9 risk themes³.

For an ordinary household, the register matters for one reason: it tells you what the government itself is preparing for, and therefore what is worth preparing for at home. It is not written for the public, and the 2025 edition states plainly that it is aimed at risk and resilience practitioners rather than households³. But the risks it describes, a national power outage, a pandemic, flooding, are the same ones that would arrive at your front door, and the register's own preparedness advice includes steps households can take, such as keeping bottled water, a torch and batteries, and a wind-up radio at home⁵.

What the register is, and who publishes it

The National Risk Register is published by the UK government. It sets out its assessment of the likelihood and potential impact of a range of risks that may directly affect the UK on a national scale⁷. Behind it sits the National Security Risk Assessment, the government's classified assessment of the national security risks facing the UK or its overseas interests; the register is the unclassified summary of that work¹. In a statement to Parliament in July 2026, the government described publishing "a version of this document, the national risk register, which includes a summary of all but the most sensitive, classified risks"⁸.

The register was first published in 2008, and the 2023 edition was the first since then to align with the structure and content of the classified assessment². That alignment matters if you are comparing editions: documents before 2023 presented risks differently, and the 2020 edition, for example, covered the most significant risks that could occur in the next two years⁵. The 2023 edition was based directly on the government's internal National Security Risk Assessment completed in 2022².

The register focuses on acute risks: discrete events that require an emergency response, such as a flood, an outbreak or an attack. Chronic risks, longer-term pressures that build over years rather than arriving as an event, are not included, and were last included in the register in 2020³. The government has said it will publish a version of its Chronic Risks Analysis alongside its resilience action plan, so the long-term picture sits in separate documents¹⁰.

The register covers the whole of the UK, assessing risks that would have a substantial impact on the UK's safety, security or critical systems at a national level. Scoring focuses primarily on domestic impacts even where a risk occurs internationally². For local detail, each area has its own document: every Local Resilience Forum across England is responsible for publishing a Community Risk Register that sets out the specific emergencies their region is most at risk of⁶. You can read more about these bodies on our pages about Local Resilience Forums and what your council does in an emergency.

How often it is published, and which edition is current

The government publishes the National Risk Register every two years, setting out the most serious risks facing the UK⁶. In practice the gap has varied: the 2025 edition followed the previous edition of August 2023³, and before that the most recent edition had been published in December 2020 to cover the coming two years¹.

The current edition is the one published in January 2025¹¹. Two things about it are worth knowing as a reader. First, it is not targeted at the general public; it is written for risk and resilience practitioners, including voluntary and community sector organisations, businesses and academics, and the government says it will continue to provide tailored guidance to help people understand the risks most likely to affect them⁹. Second, the classified assessment behind it no longer sits still between editions: the NSRA now operates on a dynamic model, updated in regular cycles several times a year, with risks reassessed as often as necessary¹¹. The public register is therefore a snapshot, not a live list.

Some entries move between editions. The 2025 edition notes that the matrix entry for a malicious drone incident was removed from that version, and that disruption to global oil trade routes had its likelihood score changed from a 2 to a 3³. Serious and organised crime, which featured in the 2020 register, is now defined as a chronic risk and was removed, with the National Assessment Centre publishing an annual National Strategic Assessment of the threat instead².

How to read the risk matrix: likelihood against impact

Every risk in the register is placed on a matrix using two scores. Likelihood is scored on a scale from 1 to 5, where 1 represents the lowest likelihood and 5 the highest³. Impact is scored on a similar scale. The two together tell you which risks the government treats as most pressing: a risk that is both likely and severe sits at the top of the government's attention, and the same logic is worth applying at home.

The likelihood numbers are not percentages in the everyday sense, and the scale is compressed at the top. All risks in the NSRA are relatively low likelihood events, which is why the highest score, 5, represents a greater than 25 per cent likelihood over the assessment period⁹. A score of 4 corresponds to between 5 and 25 per cent probability of the reasonable worst-case scenario occurring within a 12-month period in the London Risk Register's version of the scale¹². And the steps are not even: a score 3 risk is approximately 5 times more likely to occur than a score 2 risk³.

The assessment period differs by type of risk: 5 years for non-malicious risks, which can be assessed with confidence over a longer timeframe, and 2 years for malicious risks³. So a likelihood score for flooding answers the question "how likely within five years", while the same score for a terrorist attack answers "how likely within two years".

One more feature of the matrix matters: a number of the most sensitive risks are thematically grouped, and the position of each grouped risk on the matrix is an average of the impact and likelihood scores of all the risks in that category². Risks marked with a number and a letter represent multiple scenarios of the same risk: the flooding risks, for example, are 51a, b and c, covering coastal, fluvial (river) and surface water flooding respectively². If you want the scoring system in more depth, see our page on how emergency risks are scored.

The nine risk themes

The 2023 and 2025 editions both cover 89 risks within 9 risk themes⁹. The themes span the full range of what could go wrong, and earlier summaries of the register grouped them into categories including environmental hazards; human and animal health; major accidents; societal risks; malicious attacks; and risks occurring overseas¹. The 2020 edition added new risk summaries for serious and organised crime risks, disinformation and hostile state activity⁵.

Local risk registers use similar but not identical groupings. West Mercia's community risk register, for example, focuses on seven risk categories: terrorism; cyber and fraud; serious and organised crime; accidents and system failures; natural and environmental hazards; human and animal disease; and societal risks¹³. Community risk registers are built from a combination of the National Risk Register, professional judgement, historical evidence, scientific input and expert analysis¹⁴, so your local register is the National Risk Register translated into what actually threatens your area.

The sections below take the themes most relevant to households in turn.

Environmental hazards: flooding, severe weather and the rest

Environmental hazards identified in the register include flooding; severe weather, including in space; volcanic eruptions; poor air quality; and earthquakes¹. Of these, flooding and severe weather are the ones most households will actually experience. The risk of coastal flooding is one of the most significant risks on the National Risk Assessment¹⁷, and the flooding risks are split into three scenarios, coastal, river and surface water, because each behaves differently².

Typical hazard scenarios considered in community risk registers include transport accidents, severe weather, flooding, industrial accidents and environmental pollution, human health, animal health and industrial technical failure¹⁸. Wildfires are rated as a high national risk¹⁵. The Welsh Government's winter planning statement names the risks it is preparing for as severe weather, flooding, pressure on health and social care services, transport disruption and impacts on critical infrastructure¹⁹, and Pembrokeshire's severe weather guidance lists the effects of heavy rain as flooding, hazardous driving conditions and power surges²⁰.

What this means for your household is straightforward: the register's own preparedness advice for these risks is to sign up for flood alerts or weather updates, and to check online which areas are at immediate risk of flooding or likely to flood in the future⁹. Flood risk information is published separately for England, Scotland, Wales and Northern Ireland². In England, nearly 90 per cent of properties at flood risk are in areas suitable for the new national flood risk data and mapping, with the aim of 100 per cent coverage by summer 2026²¹.

For practical steps, see our guides on flooding, storms, snow and ice and heatwaves and drought.

Widespread electrical failure: the register's power scenario

A national power outage is listed in the National Risk Register as "failure of the national electricity transmission system (NETS)", which refers to a total power outage affecting the whole of Great Britain²³. The government describes this as a very unlikely scenario, but it plans for it seriously: the National Exercising Programme has run two successful major exercises to test preparedness for a national power outage and a terrorist attack²⁴.

The scoring shows why it is treated as serious despite the low likelihood. Failure of national electricity is assessed as a very high risk, with a likelihood of 3 out of 5 and an impact rated 5, the highest on the scale²⁵. The London Risk Register rates failure of the national electricity transmission system as very high, with likelihood 3 and impact 5 on its 1 to 5 scales¹². The reason a total outage scores so high on impact is cascade failure: the government's public health advice for a national power outage notes that it could also result in the loss of mobile and internet telecommunications, water, sewage removal and treatment, fuel, gas, and the ability to make electronic payments²³.

Responsibility for responding sits with the Department for Energy Security and Net Zero (DESNZ) as lead government department, working with the National Energy System Operator to restore power, while the Cabinet Office provides oversight, coordination, decision making, situational awareness and public communications¹⁰. Local risk registers also flag the everyday safety effects of power outages: public safety risks from traffic light failures, increased crime, and fire hazards²⁶.

The register's own household advice for utility failures is simple: know how to turn off gas, water and electricity in the home, and keep some basic supplies at home such as bottled water, a torch and batteries (which the register notes is safer than candles), and a wind-up radio to get updates during a power cut⁴. For what to do when the power actually goes, see our guides on power cuts, backup power and staying informed.

The pandemic scenario: plan for months, not weeks

The register treats a pandemic as a leading risk. The National Risk Register (2025) has assessed that the likelihood of a pandemic occurring in the next 5 years is 5 to 25 per cent, and that the impact would be rated 5, the highest on its scale²⁷. On the London Risk Register's scale, pandemic influenza scores 4 for likelihood and 5 for impact¹², and Wiltshire and Swindon's community risk register calls pandemic influenza "the top risk and has been for some time", with a likelihood/impact score of 4/5²⁸.

Two durations in the register's scenario matter for household planning. First, the government anticipates that it would take at least four to six months after a pandemic begins before a vaccine becomes available for influenza, and vaccines for other new viruses may take longer to develop¹. Second, the London Risk Register's planning states that the emergency stage of the pandemic in the UK will last at least 9 months and potentially significantly longer¹². Beyond the emergency stage, the register notes that recovery from a serious incident can last months, years or even decades³.

The reasonable worst-case scenario for pandemic planning was previously based on an influenza-like illness pandemic, and has been reshaped into a more generic pandemic scenario reflecting a broader range of possible manifestations⁴. The register also outlines the response measures the UK has in place: detection; clinical countermeasures; vaccines; and personal protective equipment (PPE)¹.

For households, the practical reading is that a pandemic is a months-long event, not a fortnight of disruption, and home stores and medicine arrangements should be planned on that timescale. See our guides on health emergencies and emergency food.

Animal disease outbreaks and how they are controlled

Animal disease is a distinct theme in the register, and one where rural and pet-owning households have a direct part to play. Animal disease is rated as high on the Wiltshire and Swindon Community Risk Register, referenced as NRR56¹⁶. The London Risk Register breaks the theme into scenarios: a major outbreak of avian influenza (bird flu) is rated high, while African horse sickness and African swine fever are each rated low, with likelihood and impact both scored 1 on the 1 to 5 scale¹².

The reasonable worst-case scenarios give a sense of scale. For avian influenza, the London Risk Register describes viral spread leading to an outbreak with a 6 to 8 month duration, resulting in up to 8 million poultry and captive birds either killed by the virus or culled for disease control, and export restrictions on trade¹². For foot and mouth disease, the scenario involves the culling and disposal of approximately 1.9 million animals on over 2,900 premises¹².

Control measures outlined in the register include monitoring disease outbreaks; placing import controls on livestock, pets, zoo animals and animal products; banning the feeding of swill and kitchen waste to animals; imposing strict biosecurity protocols; and humanely culling susceptible animals on infected premises¹. Zoonotic diseases, those that can pass between animals and humans, listed in community risk guidance include anthrax, bird flu, bovine TB, Ebola, rabies, West Nile fever and Zika virus¹⁶.

Household advice from official guidance is to follow government guidance during a declared outbreak to protect livestock and limit spread, vaccinate livestock where possible, follow the Countryside Code, and follow advice from the relevant authorities²⁹. Notable recent examples of outbreaks include foot and mouth disease, bluetongue, anthrax and avian influenza²⁹. If you keep animals, see our guide to pets and animals in an emergency.

Cyber attacks and critical national infrastructure

The register contains over 60 risks that directly relate to critical national infrastructure (CNI), including CNI cyber risks and risks to supply chains¹¹. Major accident risks include widespread electrical failure and major transport accidents¹, and the two categories most relevant here are scored separately in the 2025 edition.

Cyber attacks on infrastructure carry an average likelihood score of 4 (a 5 to 25 per cent chance) and an average impact score of 3 (moderate)³. Conventional attacks on infrastructure carry an average impact score of 4 (significant), and the likelihood score for that category changed from a 4 to a 3 in the 2025 edition³. The scale of activity behind those scores is visible in reporting: the National Cyber Security Centre received almost 2,000 reports of cyber attacks in 2024, of which 90 were deemed significant and 12 at the top end of severity¹¹.

One scenario in the register's materials shows why cyber risks to infrastructure are treated distinctly from ordinary utility failures: a cyber attack involving encrypting, stealing or destroying data upon which critical systems depend, or disruption to operational systems leading to the failure of the national electricity transmission system, has the potential to severely disrupt all other critical systems, resulting in greater consequences than typical utilities failures². The National Cyber Security Centre has also highlighted, alongside the FBI and other agencies, an increase in sophisticated, high-impact ransomware incidents against critical infrastructure organisations globally, and considers ransomware a national security risk given its potential impact on critical national infrastructure and essential services³⁰.

For households, a cyber attack on infrastructure would arrive looking much like a power cut or a loss of payments and connectivity, so the same preparations apply. See our guides on cyber attacks and major IT failures and power cuts.

Criticisms of the register, and what it does not cover

The register has limits, and knowing them helps you read it honestly. Lord Harris, reviewing an earlier edition, said that although there were 38 risks detailed in the register at that time, "they are all in siloes"¹. He also stated that it did not include "threats to plans and opportunities, or the risks to the achievement of the country's goals"¹. Dr Toby Ord, a senior research fellow at the Future of Humanity Institute at the University of Oxford, argued that the time frames in the register were too short and did not account for the risk of less likely events occurring¹.

The register's own design choices also narrow it. It covers acute risks only, not chronic ones⁹. Its assessment periods, 5 years for non-malicious risks and 2 years for malicious risks³, mean a high-impact risk that is unlikely within five years can score low even though it is certain to be considered over decades. And the most sensitive risks are grouped and averaged rather than listed individually², so the public document cannot tell you exactly which classified scenarios sit inside a category.

Local registers have their own limits. Carmarthenshire's guidance notes that the risk assessments in its community risk register cover only non-malicious events (hazards) rather than threats such as terrorist incidents¹⁸, so a local register may be silent on threats the national register covers. Community risk registers are also reviewed on their own cycles: Warwickshire's resilience forum intends to review its risk assessment work every four years⁷, and the London Risk Register is updated annually in the spring, with each individual risk assessment formally reviewed on a 2 year cycle¹².

Using the register to decide what to prepare for

The register is written for planners, but it works as a household checklist of what to take seriously. Its own preparedness advice for households is short and practical¹¹:

• Sign up for flood alerts or weather updates, and check online which areas are at immediate risk of flooding or likely to flood in the future⁴
• Sign up to your local authority or local utilities provider's vulnerable customer schemes and priority services, if eligible⁴
• Know how to turn off gas, water and electricity in the home⁴
• Keep some basic supplies at home: bottled water, a torch and batteries (safer than candles), and a wind-up radio to get updates during a power cut⁴

Beyond that list, the register's risk scores suggest where household effort pays off most. Flooding and severe weather are the most likely risks to affect a home; a national power outage is very unlikely but would cascade into water, payments and communications, so basic supplies cover it cheaply; a pandemic is a months-long event that rewards having stores and medicine arrangements in place before it begins.

Your most useful local document is your Community Risk Register, which describes the risks present in your own community and assesses how likely they are to lead to an emergency and the potential impact they would have³¹. Every Local Resilience Forum across England publishes one⁶, and community registers are built from the National Risk Register combined with local judgement, historical evidence and expert analysis¹⁴. Find your local forum through our guide to Local Resilience Forums, and for the wider system that turns the register into action, see how the UK prepares for emergencies and the UK Government Resilience Framework. If you are new to preparing, start with getting started and our emergency kit guide.