How to Work Effectively with the NHS as an SME

A practical guide for technology and healthcare suppliers navigating NHS procurement

The NHS is one of the largest procurement organisations in the world. It works with over 80,000 suppliers, and the vast majority of them are SMEs. If you're a small or medium-sized business in health technology, digital health, or medical devices, the NHS represents an enormous opportunity.

But as anyone who has tried to navigate it will tell you: opportunity and accessibility are not the same thing.

At Periculo, we work with SMEs every day who are either preparing to sell to the NHS or who have been trying to break in for longer than they'd like. The barriers are real, but they're not insurmountable. Here's what we think every NHS supplier needs to know before they start.

The NHS is Changing How It Buys

The NHS is undergoing significant structural reform as part of the 10 Year Health Plan for England. The direction of travel is clear: more local decision-making, more community-based care, and greater emphasis on integrated care systems (ICSs) and integrated care boards (ICBs) as the commissioning layer.

What this means for SMEs is that there's no single front door. Procurement happens at multiple levels: nationally through NHS Supply Chain and central framework agreements; regionally via procurement hubs and collaboratives; and locally, directly with NHS trusts and ICBs.

Know the Rules Before You Bid

NHS procurement is governed by public sector law, and the landscape shifted significantly in February 2025 when the Procurement Act 2023 replaced the older Public Contracts Regulations. The 2023 Act is intended to simplify the process and make it easier for SMEs to compete, with a greater focus on value and outcomes rather than simply the lowest cost. That's good news for smaller suppliers with strong propositions.

The NHS Provider Selection Regime (PSR), in place since April 2024, is also worth understanding if you're targeting health and social care contracts. It allows the NHS to continue working with trusted suppliers without full re-tendering, in certain circumstances, a genuine opportunity if you've already established a foothold and a track record.

On procurement portals: Find a Tender (the Central Digital Platform) is now the primary access point for NHS contracts above threshold, and Contracts Finder will be retired from April 2026. If you're not already registered, do it now.

Get your Compliance Baseline Right

This is where we see SMEs come unstuck most often. Having a great product isn't enough. The NHS now wants to know that you can handle their data securely, meet their regulatory requirements, and operate within their governance frameworks. These aren't nice-to-haves, they're prerequisites.

There are three areas we'd encourage every NHS supplier to address early.

Cyber Essentials

The NHS requires Cyber Essentials — or Cyber Essentials Plus for higher-risk engagements — as a baseline for any supplier handling NHS data or connecting to NHS systems. We've seen otherwise strong bids delayed or lost because this wasn't in place. As an accredited certification body, we help NHS suppliers achieve and maintain Cyber Essentials certification. If you're planning to bid and don't yet hold it, this is your first step.

The NHS Data Security and Protection Toolkit (DSPT)

If your product or service involves access to patient data, you'll almost certainly need to engage with the DSPT, the NHS's self-assessment framework for data security. It's a contractual requirement across a wide range of supplier relationships, and completing it accurately takes more time and expertise than many SMEs expect.

We support suppliers through DSPT compliance and provide independent DSPT audits. An independent audit gives both you and your NHS customer greater confidence in your submission — and increasingly, NHS buyers are looking for that additional layer of assurance when evaluating suppliers.

Digital Technology Assessment Criteria (DTAC)

If you're selling a digital health solution, an app, a platform, or a clinical decision support tool, DTAC is the framework the NHS uses to assess clinical safety, data protection, technical security, and usability. Demonstrating DTAC alignment is increasingly expected as part of procurement processes, and getting ahead of it early will save you time later.

Advice from NHS England SME Advisory Group

The NHS England SME Advisory Group works directly with SMEs navigating the NHS marketplace. Here's what they say consistently makes the difference.

1. Understand who actually makes the decision

Procurement decisions in the NHS are rarely made by one person. Clinicians, procurement teams, finance leads, and operational managers all play a role, and that mix varies by trust and by product type. Find out who influences, who pays, and who signs. Talking to the wrong person is one of the most common mistakes SMEs make.

2. Be specific about the value you deliver

The NHS is under enormous pressure, and vague claims about innovation or efficiency won't cut through. Articulate a specific, measurable problem your product solves, with evidence to back it up. Cost savings, clinical outcomes, reduced pathway time — the more concrete you can be, the better.

3. Find a product champion

A respected NHS clinician or manager who has used your product and advocates for it internally is worth more than almost any other sales asset. They lend clinical credibility, understand the internal buying process, and can open doors that external suppliers simply can't. Building these relationships takes time, but it's an investment worth making early.

4. Don't over-rely on pilots

A pilot without a clear post-evaluation plan is frequently just a free trial at the supplier's expense. Before agreeing to any evaluation, make sure there's a defined scope and timeline, agreed feedback mechanisms, and critically, a confirmed procurement route and budget in place if the evaluation is successful. If those things aren't confirmed upfront, it's worth pausing before you commit.

5. Expect the process to take longer than you think

The Advisory Group advises you to expect it to take 3 times more time, effort, and money than your initial estimate. For medical devices, scaling an innovation can take four to six years. Plan for that from the start, and manage your cash accordingly.

Supplier Assurance

As the NHS drives more spend through frameworks and collaborative procurement vehicles, buyers are doing more due diligence on the full supply chain, not just the lead supplier, but subcontractors and technology partners too.

This matters particularly for cybersecurity. Following a series of high-profile supply chain incidents affecting NHS organisations, procurement teams are asking much harder questions about how suppliers manage third-party risk.

We help NHS suppliers build robust supplier assurance programmes, both to satisfy the requirements of their NHS customers and to ensure their own supply chain isn't an unmanaged liability.

Where to Start

If you're new to selling to the NHS, or you've been at it for a while without the traction you were hoping for, here's where we'd suggest focusing: register on the Find a Tender Central Digital Platform and set up alerts for relevant contract notices; identify which framework agreements apply to your product and whether any are open for new suppliers; get your compliance baseline in order Cyber Essentials, DSPT, and DTAC where relevant; map who makes decisions at your target trusts or ICBs before you approach anyone; and build relationships before you bid NHS events, trade associations, and clinical networks are all worth your time.

The NHS needs innovation from businesses like yours. But it rewards those who take the time to understand the system before they try to work within it. If you'd like to talk through where you are and what you need, we're happy to help.

How Periculo can help

We work with NHS suppliers to get the compliance and assurance foundations right.

Our services include Cyber Essentials and Cyber Essentials Plus certification, DSPT compliance support and independent DSPT audits, DTAC readiness assessments, and supplier assurance programmes.

If you're preparing for an NHS bid or want to understand what applies to your product, get in touch with the team.

_{NHS England and Department of Health and Social Care, How SMEs can work effectively with the NHS}