Summary

  • The 2026 inclusion survey covers 44 providers with live services and records how suppliers say they handle access and incomplete checks.
  • OfDIA says the survey still cannot show whether individual people complete a check, why they leave, or whether anyone can obtain a vouch.

An identity check can be counted three ways: what the provider’s system offers, what the receiving organisation accepts, and what the person completes. Britain’s latest digital identity survey sees the first clearly, catches a glimpse of the second, and publishes no count for the third.

The Office for Digital Identities and Attributes (OfDIA) published its third inclusion monitoring report on 13 October. This is not a certification scorecard for individual apps. It is an annual, anonymous provider survey intended to give government a broad picture of inclusion across certified services. The 2026 analysis covers 44 organisations with live services, out of 45 providers in the initial population. Responses were collected in April and May. Thirty-eight organisations had appeared in an earlier cycle; six were new. Across three years, 57 distinct providers have taken part.

The distinction matters because the survey’s unit is the provider. A provider may run several services, and the report says some answers may include uncertified services too. Individual services are not assessed. A service that offers an alternative route can therefore sit in the same aggregate table as another service from the same company that does not.

There is useful evidence in that table. Eighty per cent of providers said they collect data on incomplete user journeys. Among those, 66 per cent said they also record reasons. The reason table has a base of 23 providers: session time-out and changing one’s mind were each reported eight times; lack of identity evidence and lack of understanding seven times each. In free-text “other” answers, most providers said they did not know the specific reason.

That is a map of what suppliers can see, not a count of people who passed or failed. The 23 are providers answering a survey question, not 23 users. The table can show that organisations recognise time-outs or missing evidence as recurring friction. It cannot say how many people were affected, whether they later finished through another route, or whether the relying party accepted the result.

The same gap runs through the report’s feature measures. Eighty-nine per cent of surveyed organisations use biometric technology. Of those, 49 per cent hold information on accuracy for different demographic groups, and 49 per cent offer an alternative for someone who does not want to provide biometric data. Forty-five per cent collect some demographic information; 19 per cent of that group use it to monitor inclusion. These figures describe tools and internal practice. They do not say how often a person who needs an alternative completes the check.

Vouching exposes the hand-off between supplier and recipient. Three certified providers reported live vouching services; six planned to add them, while 31 reported no plan. In the provider survey’s list of barriers, fraud risk was cited 26 times and reluctance among relying parties to accept vouches 21 times. The report records a supplier-side view of the problem. It does not identify which receiving organisations accept a vouch, under what conditions, or what happens to the person whose evidence is refused.

OfDIA says this plainly in its conclusion: the survey does not capture what the provider statistics mean for individual users, including whether people complete a check, why they drop out, or whether anyone can obtain a vouch. The office says it will consider how to understand the practical implications for users and services. That is the report’s most consequential finding. Britain has built a routine way to ask suppliers about inclusion; it has not yet built a public measure of the result at the end of the user journey.

The difference is more than a statistical nicety. A provider can install an accessible feature, record an abandoned session and report the result. The receiving organisation can still reject the evidence, ask for a different document or send the person back to the start. Those are separate decisions, made by different actors. A survey that stops at the provider cannot assign responsibility for the whole transaction.

The 2026 figures also need a stable measuring stick before anyone turns them into a trend line. The sample is small and changed: six providers joined this cycle. OfDIA says the results are descriptive and do not support causal claims. The report also merged two previous questions on drop-outs in one-off and reusable checks, which changes how this year’s reason counts compare with 2025. The table is informative; it is not a clean before-and-after test.

The next report needs one denominator the present survey lacks: people who began a check, followed through each available route, and reached an accepted result. OfDIA can protect privacy while publishing aggregated completion, abandonment and refusal measures, with a clear owner for each step. The record should distinguish a failed provider check from a receiving organisation’s refusal and from a person choosing another route. Until then, the UK can describe its suppliers’ inclusion features. It cannot say who gets through.

Sources