Published: 28th September 2026
Reviewed by: David Small BSc (Hons), MSc, MTOPRA (Founder and CEO)
What Does It Take to Become NHS Procurement Ready?
For a digital health manufacturer, developing a strong product and achieving regulatory compliance do not automatically make the organisation ready to sell to the NHS.
NHS market access brings together several different areas of assurance.
A prospective NHS customer may want to understand whether your technology is clinically safe, protects patient information, meets cybersecurity expectations, integrates appropriately with existing systems, is accessible to users and complies with applicable medical device regulations.
They may also need commercial, contractual and organisational evidence before they can procure the technology.
DTAC plays an important role in this process—but DTAC should be considered part of a wider procurement-readiness strategy.
NHS England’s commercial guidance confirms that framework agreements are one of the most common ways digital and IT products are purchased within the NHS, allowing buyers to purchase from predetermined groups of suppliers without necessarily undertaking a full tender exercise each time.
For manufacturers, the challenge is therefore not simply becoming “DTAC ready”.
It is becoming NHS procurement ready.
This guide explains what that means and how manufacturers can move from initial DTAC assessment towards a structured NHS market-access position.
New to NHS DTAC Compliance?
Understanding the five areas of DTAC is an important part of preparing digital health technologies for NHS adoption. For a practical overview of the Digital Technology Assessment Criteria, including clinical safety, data protection, technical security, interoperability, and usability and accessibility, read our Complete Guide to NHS DTAC Compliance for Digital Health Manufacturers.
What Does NHS Procurement Ready Mean?
There is no single certificate called “NHS Procurement Ready”.
Instead, procurement readiness describes an organisation’s ability to respond confidently when an NHS opportunity arises.
That means being able to demonstrate the relevant regulatory, clinical, technical, information-governance and commercial evidence without discovering major gaps during the procurement process.
A procurement-ready digital health manufacturer should understand:
- what its technology is and how it will be used
- whether it qualifies as a medical device
- which regulatory requirements apply
- its DTAC position
- applicable clinical safety requirements
- how personal and health information is processed
- its cybersecurity controls
- how the technology integrates with NHS systems
- its accessibility and usability position
- what evidence supports its claims
- who owns each area internally
- how evidence will be maintained
The objective is not simply to accumulate documents.
It is to create a coherent assurance package.
DTAC Is an Important Starting Point – Not the Entire Journey
As discussed in our Complete Guide to NHS DTAC Compliance, DTAC provides a baseline assessment framework for digital health technologies.
It covers five principal areas:
- Clinical safety
- Data protection
- Technical security
- Interoperability
- Usability and accessibility
These areas address many of the questions an NHS organisation needs to consider when evaluating a digital technology.
However, completing DTAC does not automatically mean every other procurement consideration has been addressed.
A manufacturer may still need to demonstrate areas such as:
- medical device regulatory compliance
- quality management
- appropriate insurance
- organisational capability
- implementation arrangements
- service support
- contractual compliance
- commercial information
- product evidence
- business continuity
- supplier management
- post-market processes
The precise requirements depend on the technology, NHS organisation, procurement route and contract.
This is why manufacturers should avoid viewing DTAC as a finish line.
It is better viewed as one important component of NHS assurance.
Step 1: Understand Your Regulatory Position
Before approaching NHS procurement, manufacturers need a clear understanding of the regulatory status of their technology.
This is particularly important for software.
Not every digital health technology is a medical device.
But software may qualify as a medical device where its intended purpose brings it within the applicable definition.
The MHRA specifically provides guidance for manufacturers on software and AI as medical devices and notes that software and AI play an important role in health and social care, with many such products regulated as medical devices or IVDs.
Manufacturers should therefore determine:
- the intended purpose of the product
- whether it qualifies as a medical device
- its classification, where applicable
- the appropriate conformity-assessment route
- applicable registration requirements
- post-market obligations
For devices placed on the Great Britain market, the MHRA is responsible for medical-device regulation. Current MHRA guidance confirms that medical devices need to comply with the applicable UK regulatory requirements and that all medical devices must be registered with the MHRA before being placed on the Great Britain market.
Medical-device compliance should therefore be established separately from DTAC.
DTAC does not replace medical device regulation
This distinction is important.
A successful DTAC assessment does not determine whether a technology has met medical-device regulatory requirements.
Likewise, having a CE or UKCA marked medical device does not automatically demonstrate that all DTAC requirements have been satisfied.
The strongest NHS market-access strategy considers both.
Step 2: Establish Your DTAC Readiness
Once the product and regulatory position are understood, the next step is establishing where the organisation stands against DTAC.
For manufacturers approaching this for the first time, the best starting point is generally not writing new policies.
It is assessing what already exists.
A DTAC readiness assessment should identify:
- applicable requirements
- existing evidence
- evidence that is adequate
- evidence that needs updating
- missing evidence
- inconsistencies
- higher-risk gaps
- actions required before procurement
This creates a baseline.
For example, a regulated Software as a Medical Device manufacturer may already have mature risk-management, software-development and usability evidence.
A company certified to ISO/IEC 27001 may already possess substantial information-security documentation.
Another organisation may have strong technical controls but limited formal clinical safety evidence.
The roadmap should reflect the actual organisation rather than applying the same generic checklist to every manufacturer.
Step 3: Close the DTAC Gaps
Knowing the gaps is only useful if they are subsequently addressed.
Some findings may be relatively straightforward.
A policy may require updating.
Existing evidence may need organising.
Responsibilities may need clarifying.
Other gaps can require considerably more work.
For example:
- penetration testing may need to be commissioned
- accessibility testing may be required
- data flows may need documenting
- information-governance procedures may need establishing
- a clinical safety process may need implementing
- security controls may require remediation
- interoperability evidence may need developing
This is where the difference between a DTAC Readiness Assessment and DTAC Accelerator becomes important.
The assessment tells you where you stand.
The implementation phase gets you closer to where you need to be.
For manufacturers with an active NHS opportunity, the remediation roadmap should prioritise issues capable of blocking or delaying procurement.
Step 4: Build Your Clinical Safety Evidence
Clinical safety deserves particular attention because health IT can affect patient care even where the technology itself is not regulated as a medical device.
As we covered in our DCB0129 and Clinical Safety guide, manufacturers may need to address DCB0129 and develop appropriate clinical risk-management evidence.
Depending on applicability, this can include:
- Clinical Risk Management Plan
- Hazard Log
- Clinical Safety Case
- Clinical Safety Case Report
- Clinical Safety Officer oversight
- evidence supporting clinical risk controls
- processes for maintaining clinical safety after release
Manufacturers should also understand how their responsibilities interact with those of the NHS organisation.
DCB0129 addresses the manufacturer’s clinical risk-management responsibilities, while DCB0160 addresses clinical risk management associated with deployment and use by health organisations.
That makes communication important.
An NHS organisation may need information concerning hazards, residual risks, assumptions and required controls so that it can safely deploy the technology in its local environment.
Clinical safety evidence should therefore be ready to share when appropriate rather than reconstructed after a procurement team requests it.
Need to Understand DCB0129 Clinical Safety?
Clinical safety is a key part of NHS digital health assurance and the DTAC process. If you are developing or supplying health IT for use within the NHS, read our Guide to DCB0129 Clinical Safety and DTAC to understand clinical risk management, the Clinical Safety Officer role, Hazard Logs, Clinical Safety Cases and the evidence manufacturers may need to prepare.
Step 5: Get Your Data Protection Evidence in Order
Healthcare technologies can process highly sensitive information.
NHS buyers consequently need confidence that suppliers understand and manage their information-governance responsibilities.
Manufacturers should be able to explain:
- what information is processed
- why it is processed
- where it is stored
- who can access it
- how long it is retained
- which third parties are involved
- whether international transfers occur
- how incidents are handled
- how data-subject rights are supported
Your evidence should also agree across documents.
For example, your privacy documentation, data flows, system architecture and contractual arrangements should describe the same processing model.
An organisation with individually impressive documents but contradictory information can create additional procurement questions.
The aim should therefore be consistency as well as completeness.
Step 6: Demonstrate Cybersecurity Maturity
Cybersecurity is another area where NHS customers need evidence rather than reassurance.
Saying that a platform is “secure” is not enough.
Manufacturers need to demonstrate how security is managed.
Evidence may cover:
- access control
- authentication
- encryption
- vulnerability management
- penetration testing
- secure development
- incident response
- monitoring
- backup and recovery
- business continuity
- third-party dependencies
- cloud infrastructure
- supplier security
Supply-chain security should not be overlooked.
The National Cyber Security Centre’s Cyber Assessment Framework emphasises the need for organisations to understand and systematically manage risks arising from suppliers and third-party services.
That is particularly relevant to digital health businesses using cloud hosting, external development services, analytics platforms or other technology suppliers.
You need to understand not only your own security environment but the dependencies on which your service relies.
Step 7: Prepare for Interoperability Questions
A digital health platform may work perfectly as a standalone product but still struggle during NHS adoption if it cannot integrate effectively into the intended environment.
Before procurement, manufacturers should understand:
- what NHS systems the product may need to interact with
- what data needs to be exchanged
- how interfaces operate
- which APIs are available
- which data standards are supported
- how identity is managed
- what technical dependencies exist
- what happens when an integration fails
Technical teams should be involved early.
A sales commitment to “integrate with anything” can create significant problems later if the architecture was never designed for the proposed integration.
Procurement readiness therefore means ensuring commercial claims are supported by technical reality.
Step 8: Demonstrate Usability and Accessibility
NHS procurement is not solely concerned with whether technology technically functions.
The technology also needs to work for its intended users.
Those users may include:
- clinicians
- administrators
- patients
- carers
- people with disabilities
- people with limited digital skills
- users accessing services through assistive technologies
Manufacturers should therefore retain evidence showing how usability and accessibility have been considered.
This may include:
- user research
- usability testing
- accessibility testing
- representative user involvement
- identified usability issues
- remediation records
- accessibility statements
- evidence concerning relevant accessibility standards
Again, evidence generated during development is much stronger than trying to recreate the story immediately before procurement.
Step 9: Organise the Evidence Into a Procurement-Ready Pack
One of the most practical steps manufacturers can take is creating a controlled procurement evidence library.
Without this, procurement requests often trigger a scramble across the organisation.
Sales asks regulatory.
Regulatory asks development.
Development searches old folders.
Someone contacts the penetration-testing company.
Nobody knows which privacy document is current.
That is avoidable.
A procurement evidence pack could include controlled sections covering:
|
Area |
Example evidence |
|
DTAC |
Completed assessment and supporting evidence |
|
Clinical safety |
Hazard Log, Clinical Safety Case Report, DCB0129 evidence |
|
Data protection |
DPIA support, data flows, privacy documentation |
|
Cybersecurity |
Security policies, penetration test, vulnerability management |
|
Interoperability |
Architecture, API and integration documentation |
|
Accessibility |
Accessibility and usability evidence |
|
Medical device regulation |
Regulatory status, conformity evidence, registration where applicable |
|
Quality |
QMS information and relevant certifications |
|
Business continuity |
Continuity, backup and disaster-recovery evidence |
|
Organisation |
Insurance, company information and key responsibilities |
|
Commercial |
Relevant pricing, service, support and contractual information |
Not every document should automatically be sent to every potential customer.
Some evidence may be confidential or commercially sensitive.
The point is to know what exists, where it is, who owns it and how it can be supplied when required.
Step 10: Understand Your Route to Market
Being compliance-ready does not itself create a procurement route.
Manufacturers also need to understand how NHS customers may actually purchase the technology.
NHS England explains that framework agreements are the most common route for buying digital and IT products in the NHS. Frameworks can allow buyers to purchase from predetermined suppliers without running a lengthy full tender process.
However, NHS England also notes that there are multiple framework agreements covering similar products and services, which can make the landscape difficult for both buyers and vendors to navigate.
Manufacturers should therefore consider:
- who the intended NHS customer is
- who holds the budget
- how that organisation purchases comparable technology
- whether an appropriate framework exists
- whether direct procurement may be possible
- what commercial evidence will be required
- what the likely procurement timetable is
This should happen alongside compliance preparation rather than after it.
What Can Delay NHS Procurement?
Many procurement delays are predictable.
Common problems include:
Starting DTAC too late
A live tender is not the ideal time to discover significant security, accessibility or clinical-safety gaps.
Unclear medical device status
Manufacturers need a defensible regulatory position.
Uncertainty about whether software is a medical device can create wider questions about compliance.
Missing clinical safety evidence
A missing Hazard Log or incomplete Clinical Safety Case cannot always be solved by simply filling in a template.
The underlying clinical risk-management work needs to exist.
Outdated penetration testing
Security evidence should reflect the current technology and architecture.
Inconsistent documentation
Different documents describing different data flows, subprocessors, hosting arrangements or product functionality create unnecessary questions.
Nobody owns procurement assurance
If every request requires several teams to independently reconstruct the answer, the process becomes slow and error-prone.
Overpromising during sales
Commercial teams should understand the boundaries of the product’s technical, regulatory and compliance position.
Promising functionality, integrations or assurance that has not been established can create significant problems later.
The NHS Procurement Readiness Journey
A practical manufacturer journey can therefore look like this:
- Define the product and intended NHS use.
- Establish medical device regulatory status.
- Conduct a DTAC Readiness Assessment.
- Prioritise the gaps.
- Remediate DTAC deficiencies.
- Establish DCB0129 clinical safety evidence where applicable.
- Validate data protection and cybersecurity evidence.
- Confirm interoperability and accessibility readiness.
- Organise the procurement evidence package.
- Identify appropriate NHS routes to market.
- Prepare internal teams for due diligence.
- Maintain evidence as the technology changes.
The important point is that these activities should connect.
Regulatory compliance should not exist in one silo, DTAC in another, clinical safety in another and procurement in another.
The NHS customer is ultimately evaluating one technology from one supplier.
Your evidence should tell one consistent story.
Understanding the Wider DTAC Requirements?
Clinical safety and compliance with DCB0129 form an important part of the NHS Digital Technology Assessment Criteria, but they are only one area of DTAC. For an overview of clinical safety, data protection, technical security, interoperability, and usability and accessibility, read our Five Areas of NHS DTAC Requirements.
From DTAC Ready to NHS Procurement Ready
There is an important distinction between these two positions.
A manufacturer can be relatively well prepared for DTAC while still having significant work to do before NHS procurement.
Conversely, organisations that approach NHS market access strategically can use the same evidence across multiple assurance activities.
For example:
- medical-device risk management may support aspects of clinical safety
- quality-system records may demonstrate controlled processes
- software-development evidence may support technical assurance
- cybersecurity testing may support DTAC security questions
- usability engineering may support usability evidence
- technical documentation may support interoperability discussions
The objective should be to build an integrated assurance system rather than duplicating work unnecessarily.
Is Your Digital Health Technology NHS Procurement Ready?
A useful final check is whether your organisation can answer the following questions confidently:
- Do we know whether our technology is a medical device?
- Is our regulatory evidence current?
- Have we assessed our position against DTAC?
- Have identified DTAC gaps been addressed?
- Have we established whether DCB0129 applies?
- Is our clinical safety evidence current?
- Can we clearly explain our data flows?
- Is our data-protection documentation consistent?
- Do we have current cybersecurity evidence?
- Have we addressed third-party and supply-chain risks?
- Can we explain how the product integrates with NHS systems?
- Do we have appropriate usability and accessibility evidence?
- Is our procurement evidence organised and controlled?
- Does someone own each evidence area?
- Do our commercial teams understand the compliance position?
- Do we understand our likely NHS procurement route?
- Can we respond efficiently to due-diligence questions?
If several answers are uncertain, the organisation may be technically capable of entering the NHS market but not yet procurement ready.
How Patient Guard Can Help You Become NHS Procurement Ready
Patient Guard supports digital health manufacturers across the journey from initial DTAC assessment to wider NHS procurement readiness.
Our NHS Procurement Ready service is designed to help manufacturers bring together the regulatory, clinical, quality and digital health evidence needed to approach NHS opportunities with greater confidence.
Where organisations are earlier in the process, our DTAC Readiness Assessment can establish the current position and identify gaps.
Our DTAC Accelerator can then provide hands-on support to close those gaps and build the required evidence.
For manufacturers requiring specialist clinical safety support, our Clinical Safety Compliance Services can support DCB0129 and DCB0160 requirements.
And where ongoing regulatory and quality support is required, Compliance Essentials can help organisations maintain their compliance position as products, standards and requirements evolve.
The result is a connected route:
DTAC assessment → gap remediation → clinical and technical assurance → procurement readiness → ongoing compliance.
Prepare Before the NHS Opportunity Arrives
The best time to discover a compliance gap is before an NHS customer finds it.
Preparing early gives your organisation time to address issues properly, align internal teams and build an evidence package that accurately reflects the technology.
When the procurement opportunity arrives, the conversation can then focus on the value your technology provides rather than on missing assurance documentation.
If you are planning to introduce a digital health technology into the NHS, Patient Guard can help you understand where you stand and what needs to happen next.
Frequently Asked Questions
Not necessarily. DTAC provides important baseline assurance across clinical safety, data protection, technical security, interoperability, and usability/accessibility, but procurement may involve additional regulatory, organisational, commercial and contractual requirements.
The appropriate procurement route depends on the circumstances. NHS England states that framework agreements are the most common way of buying digital and IT products in the NHS and publishes recommendations to help NHS organisations select appropriate frameworks.
That depends on whether the software qualifies as a medical device and the applicable regulatory route. The MHRA states that manufacturers should first determine whether their product meets the definition of a medical device. Current Great Britain rules permit relevant devices to use the UKCA route, while qualifying CE-marked devices continue to be accepted under transitional arrangements according to device type and applicable legislation.
Yes, under current transitional arrangements. The exact deadline depends on the legislation and device concerned, with current MHRA guidance providing acceptance periods extending as late as 30 June 2030 for certain devices. Manufacturers should check the current requirements applicable to their particular device rather than relying on the maximum date.
Ideally before a live opportunity. Activities such as penetration testing, clinical risk management, accessibility remediation and technical integration work can require significant time and cannot always be completed effectively within a short tender deadline.
References
This guide is based on official NHS England guidance, standards and digital service guidance relating to the Digital Technology Assessment Criteria (DTAC), clinical safety, data protection, technical security, interoperability, usability and accessibility for digital health technologies used within NHS and social care settings.
| Organisation | Reference | Why it's relevant |
|---|---|---|
| NHS England | Digital Technology Assessment Criteria (DTAC): Guidance for Buyers and Suppliers | Provides the principal NHS guidance on the Digital Technology Assessment Criteria. DTAC provides a national baseline for assessing digital health technologies and supports NHS and social care organisations when considering the assurance of digital technology products. |
| NHS England | Medical Devices and Digital Tools | Provides NHS England guidance relating to medical devices and digital health tools, including considerations relevant to the implementation and use of digital technologies within NHS healthcare environments. |
| NHS England | Principles for Using Digital Technologies in Mental Health Inpatient Treatment and Care | Defines DTAC as a set of criteria used when introducing new digital health technology and identifies the national minimum standards covering clinical safety, data protection, technical security, interoperability, usability and accessibility. |
| NHS England Digital | Clinical Risk Management Standards | Provides the NHS framework for clinical risk management of health IT systems and explains the roles of DCB0129 and DCB0160. DCB0129 applies to manufacturers of health IT systems, while DCB0160 applies to health organisations deploying and using those systems. |
| NHS England Digital | DCB0129: Clinical Risk Management – its Application in the Manufacture of Health IT Systems | Defines clinical risk management requirements for organisations responsible for developing and maintaining health IT systems. It is particularly relevant to digital health manufacturers preparing clinical safety evidence for DTAC. |
| NHS England Digital | DCB0160: Clinical Risk Management – its Application in the Deployment and Use of Health IT Systems | Defines clinical risk management requirements for health and care organisations responsible for the deployment, use, maintenance or decommissioning of health IT systems. |
| NHS England | National Review of Clinical Risk Management Standards DCB0129 and DCB0160: Supporting Information | Provides current information on NHS England's review of DCB0129 and DCB0160 and explains their respective responsibilities. DCB0129 establishes clinical risk management requirements for manufacturers of health IT systems, while DCB0160 establishes requirements for care organisations deploying and using health IT systems. |
| NHS England Digital Service Manual | What All NHS Services Need to Do About Accessibility | Sets out NHS accessibility requirements for digital services, including WCAG 2.2 Level AA, compatibility with commonly used assistive technologies, inclusion of people with access needs in user research and publication of an accessibility statement. |
| NHS England Digital Service Manual | Accessibility | Provides NHS guidance on designing, developing and testing accessible digital services. The NHS Digital Service Manual reflects WCAG 2.2 and provides guidance covering accessibility across product development, user research, content, design, development and testing. |
DTAC readiness should not be treated as a one-time exercise. Digital health manufacturers should maintain their supporting evidence as their technology, clinical use, data processing activities, security environment, integrations and applicable NHS requirements evolve.
Patient Guards Recent Posts
FDA Medical Device Regulations: A Complete Guide for Manufacturers
Planning to place a medical device on the US market? This complete guide explains FDA medical device regulations, including device classification, 510(k), De Novo and PMA pathways, QMSR and ISO 13485, establishment registration, device listing, U.S. Agent requirements, UDI and post-market obligations.
How to Become NHS Procurement Ready: From DTAC to NHS Market Access
Preparing to sell digital health technology to the NHS requires more than completing DTAC. This guide explains how manufacturers can build a procurement-ready position by aligning regulatory compliance, clinical safety, data protection, cybersecurity, interoperability, accessibility and commercial evidence for NHS market access.
DCB0129 and Clinical Safety: What Digital Health Manufacturers Need for NHS DTAC
For digital health manufacturers preparing to enter the NHS, clinical safety can be one of the most important—and sometimes misunderstood—parts of DTAC.
It is not enough to demonstrate that your software works.
Manufacturers need to consider what could happen if the technology fails, produces incorrect information, presents information incorrectly, contributes to a workflow error or is used in circumstances that could expose patients to harm.
This is where clinical risk management and DCB0129 become particularly important.
NHS England identifies DCB0129 as the clinical risk management standard for manufacturers of health IT systems. Its counterpart, DCB0160, applies to health organisations deploying and using health IT systems. NHS England states that compliance with these standards is required under the Health and Social Care Act 2012.
For manufacturers working towards NHS DTAC readiness, understanding the distinction—and having the right clinical safety evidence—is essential.
Patient Guards Related Services
Need Training?
Do you need training on Quality Management Systems or EU MDR/ EU IVDR? then check out our training courses.
