AI and Data Centre Bid Writing and Framework Support

A dynamic purchasing system rather than a closed framework, so it accepts applications on a rolling basis rather than through a single window. That makes it the usual first route for an AI supplier with no public sector track record. Confirm current lot dates with the GCA before you plan around them: the published lot and framework end dates have not been consistent.

Open continuously. Relevant to AI suppliers more often than they expect, because model security, assurance and testing work is frequently bought here rather than through an AI-specific route.

Preliminary market engagement is running now, with the invitation to tender expected in February 2027. Engagement at the PME stage is the cheapest influence any supplier ever buys, and almost nobody does it.

The accreditation route for population health management, analytics and system transformation suppliers selling to Integrated Care Boards. The natural home for health analytics and clinical decision support.

An open framework, which under the Procurement Act means it must reopen. Suppliers who miss the current round should be on a list for the next window rather than waiting to notice it.

Which UK government procurement schemes should an AI company be on?

For most AI and software suppliers the practical starting set is the Government Commercial Agency Artificial Intelligence DPS (RM6200), which accepts applications on a rolling basis, plus G-Cloud for hosted software and Digital Outcomes and Specialists for outcome-based delivery. Cyber Security Services 3 (RM3764.3) is worth checking, because assurance and model security work is often bought there. In health, the Health Systems Support Framework and NHS Shared Business Services healthcare AI arrangements are the routes that matter. Which of these is worth the effort depends entirely on what you sell and who buys it, and the wrong framework is worse than no framework because it consumes a quarter for nothing.

Is there a public tender pipeline for AI data centre construction?

Largely no, and this is the most common misconception in the market. UK data centre capital is overwhelmingly privately contracted by hyperscalers, colocation operators and their tier one contractors, so it does not publish on Find a Tender and is not awarded under the Procurement Act. The supply chain route in is approved vendor list entry and prequalification with those buyers, which is a different sales motion from bidding. The exception is where public sector estates, universities or NHS bodies procure their own compute or facilities, which does tender in the normal way.

What is PPN 025 and does it apply to AI procurements?

PPN 025 introduces national security considerations into procurement. It applies to artificial intelligence procurements above a defined threshold and to energy infrastructure, and it requires a national security narrative as part of the response. Suppliers bidding larger AI contracts should assume they will have to evidence supply chain provenance, data residency, personnel vetting and model and infrastructure control, and should prepare that content once centrally rather than improvising it per bid.

What compliance does an AI supplier need to sell into the NHS?

Expect the Data Security and Protection Toolkit as a baseline, clinical risk management under DCB0129 for manufacturers and DCB0160 for deploying organisations, and a named clinical safety officer. Software meeting the definition of a medical device may need UKCA marking and MHRA oversight depending on its intended purpose. Cyber Essentials Plus and ISO 27001 are routinely required rather than preferred, and evaluators assess interoperability against NHS data standards. These have long lead times, so they decide whether you can bid at all rather than how well you score.

We are an AI SME with no public sector track record. Can we win anything?

Yes, and the dynamic purchasing systems exist precisely for this. A DPS has no fixed closing window and lower barriers to entry than a closed framework, so it is the standard route for a supplier building a first public sector record. The realistic sequence is accreditation and certifications first, then DPS entry, then small call-offs that generate referenceable delivery, then the larger closed frameworks once you have case studies an evaluator can verify. Attempting the last step first is the usual reason a first application fails.

What should a data centre supply chain firm do first?

Get the prequalification pack in order before chasing any specific programme. That means the certifications the tier one contractors actually check, capability statements with verified figures, safety and quality evidence, financial standing and referenceable delivery at comparable scale and criticality. The same evidence base serves public framework applications, so it is not wasted if the private pipeline moves. Then approach the operators and tier ones for approved vendor list entry as a named category, rather than waiting for a tender that will not be published.