DDaT Enterprise GRC Tooling

{
  "id": "020446-2026",
  "tag": [
    "planning"
  ],
  "date": "2026-03-06T14:11:18Z",
  "ocid": "ocds-h6vhtk-066447",
  "buyer": {
    "id": "GB-PPON-PRLZ-1599-JGTT",
    "name": "NHS Business Services Authority"
  },
  "tender": {
    "id": "C429685",
    "lots": [
      {
        "id": "1",
        "status": "planning",
        "suitability": {
          "sme": true
        },
        "contractPeriod": {
          "endDate": "2028-09-30T23:59:59+01:00",
          "startDate": "2026-10-01T00:00:00+01:00"
        }
      }
    ],
    "items": [
      {
        "id": "1",
        "relatedLot": "1",
        "additionalClassifications": [
          {
            "id": "48517000",
            "scheme": "CPV",
            "description": "IT software package"
          },
          {
            "id": "72000000",
            "scheme": "CPV",
            "description": "IT services: consulting, software development, Internet and support"
          }
        ]
      }
    ],
    "title": "DDaT Enterprise GRC Tooling",
    "value": {
      "amount": 350000,
      "currency": "GBP",
      "amountGross": 420000
    },
    "status": "planning",
    "legalBasis": {
      "id": "2023/54",
      "uri": "https://www.legislation.gov.uk/ukpga/2023/54/contents",
      "scheme": "UKPGA"
    },
    "description": "The purpose of this Request for Information (RFI) is to conduct market research to identify Governance, Risk and Compliance (GRC) tooling that could support DDaT governance activities.\nWe are seeking information on platforms or tools that enable:\n1. Risk Management\n2. Audit Management\n3. Compliance Management",
    "aboveThreshold": true,
    "mainProcurementCategory": "services"
  },
  "parties": [
    {
      "id": "GB-PPON-PRLZ-1599-JGTT",
      "name": "NHS Business Services Authority",
      "roles": [
        "buyer"
      ],
      "address": {
        "region": "UKC22",
        "country": "GB",
        "locality": "Newcastle upon Tyne",
        "postalCode": "NE15 8NY",
        "countryName": "United Kingdom",
        "streetAddress": "Stella House, Goldcrest Way, Newburn Riverside"
      },
      "details": {
        "url": "https://www.nhsbsa.nhs.uk/",
        "classifications": [
          {
            "id": "publicAuthorityCentralGovernment",
            "scheme": "UK_CA_TYPE",
            "description": "Public authority - central government"
          }
        ]
      },
      "identifier": {
        "id": "PRLZ-1599-JGTT",
        "scheme": "GB-PPON"
      },
      "contactPoint": {
        "email": "nhsbsa.commercialservicesteam@nhsbsa.nhs.uk"
      }
    }
  ],
  "language": "en",
  "planning": {
    "documents": [
      {
        "id": "020446-2026",
        "url": "https://www.find-tender.service.gov.uk/Notice/020446-2026",
        "format": "text/html",
        "noticeType": "UK2",
        "description": "Preliminary market engagement notice on Find a Tender",
        "documentType": "marketEngagementNotice",
        "datePublished": "2026-03-06T14:11:18Z"
      }
    ],
    "milestones": [
      {
        "id": "engagement",
        "type": "engagement",
        "status": "scheduled",
        "dueDate": "2026-04-10T23:59:59+01:00",
        "description": "The NHS Business Services Authority (NHSBSA) is an Arm’s Length Body of the Department of Health and Social Care, responsible for providing platforms and delivering services that support the priorities of the NHS, Government and local health economies. Over £100 billion of NHS spend flows through our systems annually.\nOur purpose is to deliver business service excellence to the NHS to help people live longer, healthier lives. Our vision is to be the provider of national, at scale business services for the health and social care system, transforming and delivering these services to maximise efficiency and meet customer expectations.\nAs part of strengthening our governance capability, we are seeking to move beyond fragmented processes and manual reporting towards a dynamic, insight-driven Governance, Risk and Compliance (GRC) environment.\nOur ambition is to implement tooling that:\n• Provides near real-time visibility across organisational risk, audit, and compliance activities\n• Enables clear traceability between risks, controls, compliance obligations, and audit activity\n• Records a full history of changes to risks, controls, compliance items, and evidence, maintaining audit trails and version tracking for transparency and accountability\n• Supports proactive risk management and assurance, rather than retrospective reporting\n• Enables trend analysis and thematic insight across the organisation\n• Reduces duplication of effort through control reuse and structured assurance mapping\n• Improves accountability through clear ownership, workflow, and approval processes\nWe are particularly interested in solutions that:\n• Treat GRC as an interconnected system rather than isolated processes\n• Provide intuitive dashboards suitable for senior leadership and governance reporting\n• Enable monitoring of control effectiveness and impact analysis across multiple domains\n• Maintain a full historical record of changes to support governance, oversight, and assurance reporting\n• Support scalable governance maturity over time\nThe ambition is not merely to digitise existing processes, but to strengthen decision-making, organisational oversight, and enterprise-wide transparency through structured, connected GRC tooling.\nUse of Artificial Intelligence and Automation\nWe recognise that modern Governance, Risk and Compliance (GRC) platforms increasingly incorporate artificial intelligence (AI), machine learning, and intelligent automation capabilities.\nAs part of this market engagement, we are interested in understanding how AI-enabled functionality could enhance:\n• Risk identification and trend detection\n• Predictive risk analysis and early warning indicators\n• Automated control monitoring and anomaly detection\n• Intelligent workflow routing and prioritisation\n• Evidence reviews and document classification\n• Thematic analysis across audit findings, risks and compliance data\n• Reduction of manual administrative burden\nAny AI capability should:\n• Be transparent and explainable in its outputs\n• Support human oversight and governance decision-making\n• Operate within appropriate data protection, security and ethical boundaries\n• Clearly describe model training sources and data usage (where applicable)\nWe are seeking insight into both current AI functionality and planned roadmap developments.\nPlease download the documentation and send your response to this RFI via the Atamis portal ( https://atamis-1928.my.site.com/s/Welcome)."
      }
    ]
  },
  "initiationType": "tender"
}