Official UK procurement notice
DDaT Enterprise GRC Tooling
Authority: NHS Business Services Authority (Central government)
What is being bought
Published requirement descriptionThe purpose of this Request for Information (RFI) is to conduct market research to identify Governance, Risk and Compliance (GRC) tooling that could support DDaT governance activities.
We are seeking information on platforms or tools that enable:
- Risk Management
- Audit Management
- Compliance Management
CPV: IT services: consulting, software development, Internet and support · IT software package
The lotProcurement structure
single lot · no lot value publishedPipeline intelligence · planning stage: how this market runs before the tender is published
How NHS Business Services Authority buys Communication software package (CPV 4851), and who usually turns up
NHS Business Services Authority’s own published record, next to the published market for the same work. Frameworks and DPS are kept out: they attract a different number of bids. Whole-market view: Communication software package (CPV 4851) →
How the contest usually goes
Winner shares use published awards; bid and price charts use contested lots.
i
How often small and medium firms win.
Share of awards where the winner’s size is known.
The counts under this question show how many awards have a known supplier size.
Small firms have won here. Neither number says whether you qualify; it describes who has been winning.
i
How often local firms win similar work.
Winners with a registered address in the delivery region, out of awards with a known address.
Here, local means registered in North East England (authority’s region).
A local branch does not count if the registered address is elsewhere.
Most of this buyer’s recorded winners are registered outside North East England.
i
How long buyers here take to decide after bids close.
Middle value in days from the deadline to the first award notice, on competitions that published both dates.
Only decided tenders count, so slow ones still waiting are not in.
Half of these awards were announced within 52 days of the bid deadline.
i
How often work is awarded with no recorded rival.
Direct awards and tenders where every published lot count shows one bid.
Both shares are minimums: some awards have no bid count.
Thin markets produce this too; it is not proof of a tailored specification.
Direct awards or one recorded bid are common here. Check the route before spending time on a bid.
How many bids did past lots attract?
i
How many bids past lots received.
Each colour is a bid-count range. Only competed lots with a published count are included.
Past bids do not predict this tender.
1 bid33% / 25%
2–350% / 0%
4–617% / 25%
7+0% / 50%
How did awards compare with estimates?
i
Where winning prices landed against estimates.
Each colour shows awards below, close to or above the published estimate, one lot at a time.
Past prices are a guide, not a bid price.
Below estimate80%
Within ±2%20%
Above estimate0%
Assess each lot i
What past awards tell you about each lot.
See the forecast, this buyer’s earlier suppliers and firms with relevant wins.
No supplier is confirmed as a bidder.
i
What past awards tell you about each lot.
See the forecast, this buyer’s earlier suppliers and firms with relevant wins.
No supplier is confirmed as a bidder.
Open a lot for its forecast, this buyer’s previous supplier and possible competitors, from published award history, not a bid list
Lot #1CPV 4851Published estimate£350k
i
How many bids this lot may attract.
The forecast uses similar past competitions. The bar shows either that forecast or past bid counts; the line below says which.
Each lot shows its own forecast based on its own category; forecasts for different lots of the same notice are not comparative. The bar shows 37 past lots.
A forecast, not a list of bidders.
1 bid14%
2–338%
4–635%
7+14%
i
Where the award price may land.
The forecast uses similar awards and the buyer’s estimate. The band covers the middle half of likely prices.
No comparable awards for this lot yet.
A statistical guide from past awards, not a price to bid.
Who has supplied this buyer on similar work? i
Who has done similar work for this buyer.
Past contracts are matched by buyer, title and type of work.
A past supplier may not bid again.
i
Who has done similar work for this buyer.
Past contracts are matched by buyer, title and type of work.
A past supplier may not bid again.
No earlier contract of this buyer matches this lot on the published record.
Who could compete for this lot? i
Who could compete for this lot?
Firms with relevant past wins. On a framework, we show firms on that agreement.
None is confirmed as a bidder.
i
Who could compete for this lot?
Firms with relevant past wins. On a framework, we show firms on that agreement.
None is confirmed as a bidder.
Candidate suppliers for this notice have not been worked out yet, so this is not a verdict that nobody fits.
About this data
- Source. Official UK public procurement notices (Find a Tender), reused under the Open Government Licence v3.0. New notices arrive through the day; the figures are rebuilt nightly.
- Two views, kept apart. The authority’s own track record and the wider market for the same kind of work sit side by side and are never mixed. Where the local picture is too thin, a figure widens to a broader market and says which one it used.
- Forecasts are labelled. The price forecast and its range, possible competitors and the earlier-work matches are our estimates from past awards: not published facts, not win chances and not price advice. Official notices do not say who is bidding.
- Every figure shows what it rests on. Not every notice publishes a bid count, a value or a delivery region, so each figure carries the number of records behind it, and one built on few records is marked as such. The on a figure explains it; the counting rules are in the methodology. Spotted something wrong? Tell us.
Procedure terms & legal framework
From the official record- Legal basis
- UKPGA · 2023/54 Procurement Act 2023
- Procurement category
- Services
- Notice status
- Planned procurement
- Procurement threshold
- Above threshold (FTS publication)
- Regulatory regime
- Standard
- Commercial structure
- Stand-alone contract (no framework)
- Competition type
- Competitive procedure
- GPA / WTO covered
- Unspecified in notice
- Recurring procurement
- Unspecified in notice
- First published
- 6 Mar 2026, 14:11 GMT
- Last source update
- 6 Mar 2026, 14:11 GMT
- Authority reference
C429685- FTS notice number
2026/S 000-020446- Latest notice
- Preliminary market engagement notice (UK2)
- Classification (CPV)
- Delivery area
- Not published
- Official registry OCID
ocds-h6vhtk-066447Find a Tender
How it was run
Official notice- Submission deadline
- —
Timeline
6 Mar 2026 → 1 Oct 2026 · 3 dates- Planning notice published228 days ago6 Mar 2026, 14:11 GMT
- Market engagement193 days ago10 Apr 2026, 23:59 BST
The NHS Business Services Authority (NHSBSA) is an Arm’s Length Body of the Department of Health and Social Care, responsible for providing platforms and delivering services that support the priorities of the NHS, Government and local health economies. Over £100 billion of NHS spend flows through our systems annually.
Our purpose is to deliver business service excellence to the NHS to help people live longer, healthier lives. Our vision is to be the provider of national, at scale business services for the health and social care system, transforming and delivering these services to maximise efficiency and meet customer expectations.
As part of strengthening our governance capability, we are seeking to move beyond fragmented processes and manual reporting towards a dynamic, insight-driven Governance, Risk and Compliance (GRC) environment.
Our ambition is to implement tooling that:
- Provides near real-time visibility across organisational risk, audit, and compliance activities
- Enables clear traceability between risks, controls, compliance obligations, and audit activity
- Records a full history of changes to risks, controls, compliance items, and evidence, maintaining audit trails and version tracking for transparency and accountability
- Supports proactive risk management and assurance, rather than retrospective reporting
- Enables trend analysis and thematic insight across the organisation
- Reduces duplication of effort through control reuse and structured assurance mapping
- Improves accountability through clear ownership, workflow, and approval processes
We are particularly interested in solutions that:
- Treat GRC as an interconnected system rather than isolated processes
- Provide intuitive dashboards suitable for senior leadership and governance reporting
- Enable monitoring of control effectiveness and impact analysis across multiple domains
- Maintain a full historical record of changes to support governance, oversight, and assurance reporting
- Support scalable governance maturity over time
The ambition is not merely to digitise existing processes, but to strengthen decision-making, organisational oversight, and enterprise-wide transparency through structured, connected GRC tooling.
Use of Artificial Intelligence and Automation
We recognise that modern Governance, Risk and Compliance (GRC) platforms increasingly incorporate artificial intelligence (AI), machine learning, and intelligent automation capabilities.
As part of this market engagement, we are interested in understanding how AI-enabled functionality could enhance:
- Risk identification and trend detection
- Predictive risk analysis and early warning indicators
- Automated control monitoring and anomaly detection
- Intelligent workflow routing and prioritisation
- Evidence reviews and document classification
- Thematic analysis across audit findings, risks and compliance data
- Reduction of manual administrative burden
Any AI capability should:
- Be transparent and explainable in its outputs
- Support human oversight and governance decision-making
- Operate within appropriate data protection, security and ethical boundaries
- Clearly describe model training sources and data usage (where applicable)
We are seeking insight into both current AI functionality and planned roadmap developments.
Please download the documentation and send your response to this RFI via the Atamis portal ( atamis-1928.my.site.com/s/Welcome ↗).
- Contract starts20 days ago1 Oct 2026, 00:00 BST
Notice history
1 event · 1 release on Find a Tender- Preliminary market engagement notice published6 Mar 2026, 14:11 GMTUK2
Commercial outcome & contract awards
Pipeline notice- Awards (0)
- No award published
- Contracts (0)
- No contract published
- Bid statistics
- No aggregate bid statistics published
Contracting authority & participating public bodies
Official documents & specifications (1)
Official links; attachments are not copiedNotices published for this procedure
- Preliminary market engagement notice Preliminary market engagement notice on Find a Tender