Preparing to go to market in the NHS

Know your buyer and who signs off

In health and care, one decision can involve clinicians, managers, finance, procurement, information governance, councils, care providers and families. The person who feels the problem is often not the person who signs off the spend.

• Who has the problem? Patients, carers, ward teams, discharge teams, community services, care providers or councils.
• Who decides? Find out who signs off, and who they listen to.
• Who pays, and from which budget? The answer changes your price, your proof and your route in.

How public buying works

The Procurement Act 2023 has applied since 24 February 2025. [S25] The Cabinet Office said the new rules give small businesses greater access to “nearly £400billion of yearly spend”, and introduce a mandate of 30 day payment terms for all public sector contracts. [S24] Suppliers can register their details and see bidding opportunities in one place on the Central Digital Platform. [S24]

Some health care services are arranged under a different set of rules, The Health Care Services (Provider Selection Regime) Regulations 2023, which came into force on 1 January 2024. [S26] Check which rules your buyer is working under before assuming a standard tender.

The DTAC form and what to have ready

NHS England’s Digital Technology Assessment Criteria (DTAC) is an assessment framework for care commissioners and providers to use when assuring digital health technology. [S27] Buyers should request the DTAC form when acquiring a product, and manufacturers must keep an up to date DTAC form and supporting documents for each product version. [S27]

NHS England introduced an updated DTAC form on 24 February 2026, and says organisations should move to it before 6 April 2026. [S27] As part of the form, you may be asked for further documents, such as a Data Protection Impact Assessment (DPIA). [S27]

• We have completed the current DTAC form for this version of our product.
• Our supporting documents are ready to share on request.
• We have a DPIA, written with the help of the ICO’s guidance on DPIAs. [S48]
• We know who in our team keeps the form up to date when the product changes.

Data security and the DSPT

The Data Security and Protection Toolkit (DSPT) is an online self assessment tool. All organisations that have access to NHS patient data and systems must use it to provide assurance that they are practising good data security. [S47] Find out whether your buyer expects you to complete it, and plan the time it takes.

Is your software a medical device?

Some software counts as a medical device, depending on what it is intended to do. The MHRA publishes guidance on software and AI as a medical device. [S29] Read it early. If your product could be a medical device, take specialist regulatory advice before you make claims about what it does.

Accessibility

Public sector bodies have legal duties for the accessibility of their own websites and apps, and GOV.UK says they meet them by meeting the WCAG 2.2 AA standard and publishing an accessibility statement. [S32] Expect buyers to ask how your product meets the same standard.

Pricing and evidence

Buyers will ask what your product does, for whom, with what evidence and what it means for their staff. Have short, honest answers ready, with sources a buyer can check. Never borrow NHS identity or imply NHS endorsement you do not have.

• A clear price, and what is included.
• What it takes to get started, how long it takes and who supports the buyer.
• Evidence you can stand behind, with its date and source.

Readiness checklist

• We can name the buyer, the decision maker and the budget for our first customer.
• We know which procurement rules apply to that buyer.
• We are registered on the Central Digital Platform.
• Our DTAC form and DPIA are complete and current.
• We know whether the DSPT applies to us.
• We have checked whether our product could be a medical device.
• Our product meets WCAG 2.2 AA, and we have an accessibility statement.
• Our price and evidence fit on one page.