UK healthcare procurement spend exceeds £30 billion a year across the NHS, integrated care boards, public health bodies, and the wider health sector. SMEs win across medical devices, clinical supplies, IT and digital, facilities, consultancy and more — but the certification bar is higher than any other sector. NHS data security is non-negotiable: Cyber Essentials Plus is minimum, DSP Toolkit is annual, ISO 27001 is increasingly expected.
The UK healthcare procurement landscape
NHS England and the wider health sector buy from SMEs across every major category: medical devices, clinical supplies, IT and digital, facilities and estates, consultancy and advisory, training, transport, catering, cleaning, and more. The NHS Long Term Plan and successive procurement strategies have increased SME-specific spend targets — meaning the buyer-side push to award smaller suppliers is genuine and increasing.
The NHS structure is complex. NHS England sets national strategy; Integrated Care Boards (ICBs) commission regionally; individual trusts buy locally; NHS Shared Business Services and NHS Supply Chain provide framework agreements; NHSX/NHS Digital handle digital procurement. Different routes for different contract types.
For SMEs, the most important rule: the NHS treats data security and patient safety as gating requirements. Capability without the certifications doesn't get past PQQ.
Certifications required for NHS contracts
- ISO 9001 — quality management. Virtually every NHS contract requires this.
- Cyber Essentials Plus — required for any contract handling patient data. The higher Plus tier is the NHS baseline.
- ISO 27001 — information security. Required where you process patient data at scale.
- ISO 13485 — medical devices quality management. Mandatory for medical device suppliers under the Medical Devices Regulations.
- DSP Toolkit — Data Security and Protection Toolkit. Annual NHS data security assurance; mandatory for connected suppliers.
- CQC registration — Care Quality Commission. Required if your contract delivers regulated activities (clinical care).
The procurement routes
NHS Shared Business Services (NHS SBS)
The largest NHS framework provider — covering hundreds of frameworks across clinical and non-clinical supply. NHS SBS frameworks span medical devices, pharmacy, clinical consumables, IT, estates and facilities, professional services, and more. Once on a framework, NHS trusts can call off directly without further competition.
NHS Supply Chain
Procures clinical supplies and medical devices at national scale. Stricter entry requirements than NHS SBS — typically requires ISO 13485 for medical devices, specific clinical quality evidence, and proven NHS track record. Lower-volume specialist suppliers often start with NHS SBS and graduate to NHS Supply Chain as they scale.
Crown Commercial Service health frameworks
CCS runs several health-relevant frameworks including PSR (Public Sector Resourcing — for clinical contractors and specialists), G-Cloud for NHS IT, and the Management Consultancy Framework for NHS advisory work.
Trust-level direct procurement
Below-threshold contracts (under £138K services / £215K supplies) can be procured directly by individual trusts without a framework. Many specialist SMEs build NHS practice through trust-level direct contracts before framework entry.
Innovation routes — NHS AI Lab, SBRI Healthcare, NIHR
For technology and innovation suppliers: NHS AI Lab funds AI tools for the NHS, Small Business Research Initiative (SBRI) Healthcare funds early-stage innovation, and National Institute for Health and Care Research (NIHR) funds health research. These routes are grant-led rather than tender-led — different mechanics, very SME-favourable.
Data security: the make-or-break requirement
NHS data security is non-negotiable. Cyber Essentials Plus is the minimum tier; ISO 27001 is increasingly expected. The DSP Toolkit (Data Security and Protection Toolkit) is the NHS's annual self-assessment of data security standards — any supplier that connects to NHS systems or processes patient data must complete it and achieve "Standards Met" status.
DSP Toolkit is annual, free to access via NHS Digital, but the work to achieve Standards Met typically takes 30–60 days for a first-time SME. Most of the effort is documenting your data security practices against the required assertions; little of it is implementing new controls if you already hold Cyber Essentials.
Social value in NHS contracts
NHS England's Net Zero strategy targets a net zero NHS by 2040 — making carbon reduction commitments specifically valuable in supplier evaluations. Local hiring, apprenticeship commitments, and supplier diversity also score well. For clinical contracts, evidence of staff wellbeing programmes scores higher than in other sectors — the NHS treats supplier staff wellbeing as a quality signal.
How ENKII helps healthcare SMEs
ENKII aggregates NHS SBS framework opportunities, individual trust tenders, ICB-level commissions, and CCS health-related framework call-offs. The readiness score factors NHS-specific certifications — DSP Toolkit, ISO 13485, Cyber Essentials Plus — that other sectors don't require.
For SMEs targeting innovation funding, ENKII surfaces SBRI Healthcare, NIHR, and NHS AI Lab opportunities alongside traditional procurement — useful for technology and clinical innovation suppliers who need both routes active.
Frequently asked questions
Do I need DSP Toolkit if I have Cyber Essentials Plus?
Yes — they cover overlapping but distinct ground. Cyber Essentials Plus is generic UK cybersecurity. DSP Toolkit is NHS-specific data protection assurance (patient data, GDPR clinical context, NHS connection requirements). Most NHS contracts require both. The work to achieve DSP Toolkit "Standards Met" is significantly faster if you already hold Cyber Essentials Plus.
Can I sub-contract to a major NHS supplier?
Yes — and for many SMEs this is the fastest path to NHS revenue. Tier-one NHS suppliers (Capita, Compass, Sodexo, ISS, etc.) increasingly publish supply-chain opportunities. Their pre-qualification is usually less onerous than direct NHS PQQ, with much shorter contract cycles.
What's the SBRI Healthcare route?
SBRI Healthcare funds UK SMEs developing innovative healthcare products / services. Phase 1 funding is typically £100K for feasibility (6 months). Phase 2 is up to £1M for development (12 months). Procurement-light, very SME-favourable — see GOV.UK for current competitions.
How do I find NHS trust-level tenders?
Each trust publishes its own procurement notices. ENKII aggregates these alongside NHS SBS frameworks, so a single search shows trust-level direct contracts alongside the larger frameworks — including below-threshold opportunities that don't appear on Find a Tender.