NHS SBS £900m AI framework: voice AI supplier guide

On 11 May 2026, NHS Shared Business Services (NHS SBS) published a £900m AI framework — the single largest UK public-sector AI procurement event of the decade and, for the next four years, the default contracting route for AI tools across NHS trusts, integrated care boards and a long list of wider public-sector bodies that piggyback on NHS SBS frameworks. Submissions close on 23 June 2026. Six weeks to file.

For enterprise voice AI vendors, two of the eight lots — ambient scribing and contact-centre voice — are the live commercial battleground. For NHS technology buyers, the framework is the procurement vehicle that finally lets them call off ambient voice technology (AVT) and contact-centre AI without running an OJEU-style competition every time. The mechanics matter: every winning supplier ends up on a published list that NHS trusts can buy from with a mini-competition or, in some cases, a direct award. Suppliers that miss the window will spend the rest of 2026, 2027, 2028 and 2029 trying to sell into trusts that are contractually pointed at a different list.

This guide is shipped by the team behind Dilr Voice — enterprise voice AI deployed against NHS-grade information governance, clinical-safety and DTAC requirements. Or see our DATS methodology, the five-stage system we use to place AI inside regulated estates.

This post is not a tender-bid handbook. It is the operating checklist we use when an NHS trust, an ICB, a foundation trust group or a voice AI vendor walks in and asks the same question: "What does it actually take to be defensible on this framework — as a buyer or as a supplier?" The answer sits across five gates: clinical safety, DTAC, information governance, the ambient voice supplier registry, and the operating-model evidence that proves the deployment will not melt under audit.

The £900m headline is the indicative ceiling across all eight lots over four years. Voice AI suppliers competing in Lot 1 (ambient scribing) and Lot 7 (contact-centre voice) should treat the framework as a procurement filter, not a sales channel. The lot you sit in determines which clinical-safety standard binds you, which trust budget code funds you, and which evaluation panel scores your bid. Bidding the wrong lot or splitting capability across two is the most common reason mid-market vendors are deemed non-compliant before evaluation begins.

The macro context strengthens the case for getting this right. McKinsey's State of AI 2025 reports 88% of organisations now use AI, but only 6% are AI-mature and capture material EBIT impact. NHS-grade procurement is the corrective: it forces suppliers to prove governance maturity, not feature parity — the same maturity gap we mapped in our piece on the AI tool inventory required for ICO, FCA and EU AI Act compliance, which sits adjacent to the NHS DSPT obligations described later in this post. Adjacent regulator pressure has already started — the recent NHS clampdown on unregistered ambient scribing tools, and the £600k AVT tender run by University Hospitals Birmingham with an 18 May 2026 deadline, both show trusts are no longer tolerating uncatalogued voice deployments. The framework codifies that posture for four years. The lot-selection and deployment-shape question is exactly what our deployment approach for regulated estates is designed to answer in the six weeks before bid submission.

The five qualifying gates for voice AI suppliers

Every voice AI supplier we have walked through this framework with has the same first reaction: "We have most of this." Most is not enough. The evaluation is binary by gate. Missing one gate disqualifies the entire bid, regardless of clinical traction, customer logos or demo strength. The same pattern shows up in our work on MHRA AI Airlock and NHS ambient voice procurement — the regulator-adjacent gates are now the deal-determining ones, not the model performance benchmarks.

Gate 1 — Clinical safety case (DCB0129 + DCB0160)

DCB0129 binds the manufacturer; DCB0160 binds the deploying NHS organisation. Voice AI suppliers — especially ambient scribing vendors — must produce a clinical safety case file authored by a registered Clinical Safety Officer (CSO). The CSO is not a job title you can assign internally on a Monday. They must hold an NHS-recognised certification and be named in the file. Suppliers without a CSO on payroll or under contract will not pass DCB0129 review. The accuracy thresholds the CSO will demand — beyond marketing-grade WER — are the ones we walk through in our voice AI accuracy evaluation framework.

Gate 2 — DTAC (Digital Technology Assessment Criteria)

DTAC is the NHS England assessment used by every trust to evaluate digital products before deployment. It covers clinical safety, data protection, technical security, interoperability and usability. The DTAC self-assessment is not aspirational — trusts request the completed pack as an attachment to the call-off, and many trusts now require independent attestation against the technical-security section. Suppliers should treat DTAC as a 60- to 90-day artefact, not a fortnight's box-ticking.

Gate 3 — ISO 27001 plus NHS Information Governance

ISO 27001 is the floor. The ceiling is alignment with the NHS Data Security and Protection Toolkit (DSPT), which is the operational standard every NHS organisation enforces against suppliers handling patient data. A voice AI supplier capturing call audio, transcripts, or PII inside the consultation room is in scope. The same data-residency, retention and key-management questions show up in every regulated voice deployment we run — see our note on enterprise voice AI data retention under GDPR for the underlying retention logic and how it maps to NHS DSPT clauses.

Gate 4 — Ambient voice supplier registry (Lot 1 only)

In late 2025, NHS England published an ambient scribing supplier registry — the official list of voice AI tools NHS organisations are permitted to deploy in clinical settings. Inclusion is not automatic. Suppliers must submit evidence against a published criteria set and be approved before a trust can lawfully procure them through the SBS framework. Bidders that are not on the registry by 23 June 2026 will be screened out of Lot 1 evaluation.

Gate 5 — Operating-model evidence

This is the gate most suppliers underestimate. The evaluation panel will ask for the operating model — who is responsible for incident triage, who escalates a hallucination, what the model-change governance looks like, how the supplier integrates with the trust's existing clinical governance committee. A demo and a security pack are not enough. The same operating-model logic underpins our AI operating model consulting work, where the deliverable is exactly the governance file a trust can drop into its DSPT audit pack.

What this means for NHS technology buyers

Trusts and ICBs commissioning voice AI through the framework face the mirror-image checklist. Buying through SBS does not transfer accountability — it constrains the supplier list, but the deploying organisation still owns DCB0160 clinical safety, DSPT compliance, and the model-change risk that lives inside the contract term. Buyers who treat the framework as a "pre-approved" shortcut typically discover, six months in, that their supplier's clinical safety case has lapsed, their data-processing agreement is silent on transcript retention, or the contact-centre voice agent is making outbound calls without a documented consent pattern. The patterns mirror what we see in financial services — see our analysis of FCA AI governance for voice AI in 2026 for how regulators interpret governance gaps in voice deployments.

The table below summarises the buyer-vs-supplier accountability split most trusts are still getting wrong. We use this when scoping NHS engagements via our AI placement diagnostic, which sits before any contract commitment.

For buyers commissioning contact-centre voice AI through Lot 7, the additional consideration is outbound calling pattern. NHS contact centres run a mix of inbound triage, outbound appointment reminders, and outbound recall campaigns — each pattern has a different consent and disclosure obligation under PECR and (for clinical recall) the NHS Constitution. We covered the inbound-versus-outbound split in our note on inbound versus outbound AI voice agents, which is the architecture lens most trusts skip when scoping a Lot 7 deployment.

The procurement timeline that wins is short. Six weeks. The teams filing clean bids on 23 June started in March. For suppliers starting today, the critical path is: clinical safety case in week 1–3, DTAC pack in week 2–4, ambient registry submission in week 1 (a separate NHS England pipeline), DSPT alignment in week 3–5, operating-model documentation in week 4–6, and bid assembly in the final fortnight. The same critical-path logic from our AI voice program design from pilot to scale note applies, compressed into six weeks. Suppliers at this stage typically book scoping calls via our contact page to triage the file first.

For NHS buyers, the parallel timeline is building the trust-side governance file now. Waiting for the autumn 2026 award and then scrambling to deploy by year-end is the failure pattern we see repeatedly in regulated estates. Our voice AI agents work in NHS-adjacent settings shows the gap between "supplier on framework" and "system in production" is eight to twelve weeks of joint governance work. The post-award deployment phase is where our AI execution office sits — joint delivery with the trust's CTO and clinical safety lead through go-live. The same architecture runs inside Dilr Voice for enterprise deployments.

If you are a voice AI supplier reading this with six weeks left, the fastest move is to triage your file. Try Dilr Voice as the deployment reference architecture, book an AI placement diagnostic to identify the gap, see our DATS methodology, or read about our approach to placing AI inside regulated public-sector estates.

For trusts, the headline is simpler. The framework is the procurement floor, not the ceiling. The compliance, clinical-safety and operating-model work still happens locally. Suppliers and buyers who treat the SBS award as the start of the conversation — not the end of it — are the ones who will still be live in 2029.

Written by the Dilr.ai engineering team — practitioners who ship enterprise AI in production. Follow us on LinkedIn for shipping notes, or subscribe via the RSS feed.