Deal anatomy: fourteen months, start to signature — Selling to the NHS: the practitioner's deep dive

A realistic mid-sized NHS software deal — an acute trust, roughly £150,000 a year over three years, patient data involved, framework call-off with a mini-competition. Timelines vary; the sequence does not.

Month 1 — First conversation. A clinical lead responds to a specific approach or referral. Artefacts: one-page problem framing, their service's published data. Meeting: thirty minutes, discovery only. Blocker: it becomes a demo and dies.

Month 2 — Champion forms; multi-threading starts. Ask who signs this off and whether they will introduce you; send the assurance dossier unprompted. Meetings: CCIO or CNIO, service manager. Blocker: a champion who cannot broker introductions. Qualify hard here, not in month nine.

Month 3 — Problem sized. You and the champion quantify it from the trust's own reported data. Artefact: a one-page problem statement with a number in it. Blocker: no measurable baseline exists — establishing one becomes the first project.

Month 4 — Technical and IG first pass. Artefacts: DTAC pack, DSPT status, data flow diagram, integration approach. Meetings: CIO or integration lead, IG lead. Blocker: the EPR roadmap claims to cover your function — handle factually, let the CCIO judge.

Month 5 — Money conversation. Artefacts: one-page commercial summary, indicative budget impact model. Meetings: finance business partner, directorate budget-holder. Output: a named budget, capital or revenue, this year or next. Blocker: "next year" — fine, if you aim at the autumn planning round.

Months 6–7 — Business case drafting and the pilot decision. If a pilot, negotiate the section 6 agreement with price at scale fixed and the conversion route named. Artefacts: pilot agreement, evaluation plan, draft DPIA content, hazard log, clinical safety case. Meetings: transformation team, CSO, DPO. Blockers: the free-pilot request; the paper deadline for the committee that must approve even a pilot.

Months 7–10 — Pilot runs. Baseline measured before go-live; monthly sponsor check-ins and reporting, with an interim report at the midpoint. Blockers: slow IG sign-off (budget six to twelve weeks); integration slipping for want of trust capacity; your champion changing job. Mitigation: at least three relationships, always.

Month 10 — Evaluation and decision meeting. The pre-agreed forum reviews results against pre-agreed criteria, using an evaluation report co-authored with the trust, and records a go/no-go. Blocker: ambiguous results — which is why you defined failure in advance.

Month 11 — Business case through governance. Artefacts: benefits section, evidence appendix, risk table, references — drafted by you, unbranded. Blockers: paper deadlines; a competing case for the same money; an unprepared-for question from a non-executive director.

Month 12 — Procurement route confirmed and run. Procurement selects framework and lot and decides direct award versus mini-competition; if the latter, two to four weeks to respond, then scoring. Blockers: a bid administration error; the framework not covering the requirement after all.

Month 13 — Award, standstill, contracting. Contract award notice, assessment summaries, standstill of at least eight working days; then contract, service levels, data processing agreement, exit terms and KPIs, with signed clinical safety case and completed DPIA. Blockers: the legal review queue; a liability cap you should have raised at clarification stage; the trust's own implementation resource.

Month 14 — Signature and purchase order. The last trap: a contract is not revenue until a purchase order exists and an invoice can be matched to it. Confirm PO number, invoicing address, payment terms and approver before telling anyone the deal is closed.

The pattern across all fourteen months: artefacts produced in advance shorten the deal; relationships you did not build lengthen it; and every governance forum has a paper deadline nobody mentions until you have missed it.

Field note
Track NHS deals by exit criteria, not by stage names. "Discovery complete" means nothing. "Named budget-holder identified, capital or revenue confirmed, in this year's plan or next" is a fact you either have or do not. Build your pipeline stages out of facts like that and your forecast stops being fiction — which matters more here than in almost any other market, because a fourteen-month cycle means an over-optimistic forecast is not corrected for a year.

How this shows up in interviews

"Walk me through how NHS money reaches a purchase order."

Trace the chain: Treasury sets DHSC's resource and capital limits; DHSC allocates, historically via NHS England and increasingly directly as NHS England is absorbed; ICBs receive weighted-capitation allocations in named envelopes; providers are paid under the NHS Payment Scheme, mostly through a fixed element plus variable activity payments. Then land the commercial point: because most provider income is largely fixed, the seller's real job is to identify whether the benefit is cash-releasing or capacity-releasing, whether the cost is capital or revenue, and whether the money exists this year or next. Finish with the multi-year planning framework — three-year allocations make three-year contracts easier to justify. Naming the RDEL/CDEL distinction unprompted is what marks you out.

"Who would you need on side to sell a clinical decision-support tool into a trust, and in what order?"

Give the sequence, not just the list: clinical lead first (the problem owner), then CCIO for workflow credibility, then service manager for the operational baseline, then in parallel CIO for integration and IG/DPO for the data question, then finance for the business case, with transformation for delivery capacity and the investment committee for approval. Add the political layer — clinical versus operational tension, digital enthusiasm without recurrent budget, and the fact that whoever owns the claimed benefit will eventually object, so bring them in early. That last point is the one generalist reps never make.

"What compliance artefacts would you bring to a first NHS meeting?"

Answer as a list, fast, then explain the principle. Regulatory status and intended use in a sentence; DTAC pack; current DSPT status; Cyber Essentials Plus or equivalent; a one-page data flow diagram; named Clinical Safety Officer; framework listings; two references. Then: everything else — full clinical safety case, DPIA support, security assurance, social value response — belongs before contract, not before the first meeting. The principle: compliance artefacts are sales assets, because each one removes a week from the buyer's timeline. Add the current-position caveat: DTAC was refreshed in February 2026, the DSPT is migrating to Cyber Assessment Framework alignment, and DCB0129/0160 are under national review — so you check the current form rather than quoting last year's.

"Talk me through how a framework call-off works."

Confirm framework and lot; decide direct award versus mini-competition on procurement's legal advice; if direct award, document the rationale and issue an order under pre-agreed call-off terms; if mini-competition, issue specification and criteria to capable suppliers on the lot, score and award; publish the required notices. Then the seller's insight, which is the real answer to the question: your commercial negotiating room under a framework is small, because the terms were set when the framework was let — so read the call-off terms before you sell, not after.

"How would you approach a tender you had no prior relationship on?"

First, decide whether to bid at all — a tender you did not shape is usually one someone else did. If you bid, read in order: evaluation methodology and weightings, then the draft contract, then pricing, then the specification. Raise contract problems as clarifications before the deadline. Write to the question's own structure, replace adjectives with specific evidence, use the word count, take social value seriously because it carries a minimum 10% weighting in NHS procurement. And name the disqualifying errors — late submission, missing mandatory documents, exceeding word limits, altering the pricing template, contacting evaluators outside the process — because knowing that bids die on administration is a practitioner's answer, not a textbook one.

"How do you design a pilot that converts?"

Diagnose the structural cause first: pilots are easy because they can be funded non-recurrently and dodge the investment committee. Then give the design — a written agreement with hard stop and pre-agreed decision date; a named executive sponsor and named decision forum; success criteria drawn from the trust's own reporting with a baseline measured before go-live and an agreed definition of failure; data, IP and exit terms explicit; the price at scale fixed during the pilot; a named conversion route. Then pricing: charge something, because a purchase order requires a budget-holder, which surfaces the funding question in month one instead of month eleven. Close with the free-extension answer: decline warmly, offer a paid extension with written conversion criteria, and be willing to qualify out.

"What evidence would you need, and how would you get it on a small budget?"

Map evidence to decision-maker: budget impact model for local finance, safety case for the CSO, workflow and adoption data for the CCIO, peer-reviewed outcomes and national routes for scale. Then the cheap-build method: design evaluation into the first deployments with a real baseline, use routinely collected data, partner with a Health Innovation Network or university for methodological credibility, pre-register criteria in the pilot agreement, publish service evaluations, and chase non-dilutive funding such as SBRI Healthcare. Name the common failure — expensive cost-per-QALY work that does not answer the finance director's question about next April's pay bill.

"What's changed in NHS structures recently, and how do you keep current?"

Be specific but properly hedged: NHS England is being absorbed into DHSC with a Health Bill introduced in May 2026 and completion targeted around April 2027; ICBs are merging, with the first phase in April 2026 reducing the number from 42; the 10 Year Health Plan set the national direction in July 2025; DTAC was refreshed in February 2026; the clinical safety standards are under review during 2026. Then the meta-answer that actually wins the question: you learn durable structure — commissioner versus provider, capital versus revenue, framework versus tender, manufacturer versus deploying organisation — and you verify volatile detail from primary sources the week you need it. Interviewers in this market are wary of candidates who recite last year's org chart with total confidence.

Cheat sheet

Money map: Treasury/Spending Review → DHSC (RDEL and CDEL, not interchangeable) → NHS England, being absorbed into DHSC (Health Bill introduced May 2026; completion targeted ~April 2027 — verify) → ICBs on weighted capitation in named envelopes (core, delegated specialised, primary care medical, running costs; count falling from 42 after April 2026 mergers — verify) → providers paid under the NHS Payment Scheme (aligned payment and incentive: fixed + variable). Multi-year allocations 2026/27–2028/29.

Four money traps: fixed provider income (cash-releasing vs capacity) · benefit/cost split across organisations (usually points to the ICB) · capital vs revenue · the CIP/efficiency requirement. National pots: Frontline Productivity Programme (technology capital and revenue, regional envelopes by weighted capita and digital maturity) · MedTech Funding Mandate (live, under review, no new products 2026/27) · SBRI Healthcare.

Find the pot: board papers · ICB board papers and joint forward plan · annual report and accounts · Find a Tender award history · pipeline notices · then ask "whose budget, capital or revenue, this year or next?"

Cast: clinical director · service manager · CCIO/CNIO · CIO · IG lead/DPO · Caldicott Guardian (8 principles; principle 7 = duty to share) · Clinical Safety Officer · procurement · finance business partner · transformation/PMO · investment committee · board. Fault lines: clinical vs operational · digital ambition vs recurrent budget · trust vs ICB · procurement vs requester · incumbent gravity · who owns the benefit.

Getting in: clinical champions found through published QI work, audits, networks, conference talks · Health Innovation Networks (15, renamed from AHSNs Oct 2023) · NHS Innovation Service · SBRI Healthcare · AI and Digital Regulations Service (NICE/MHRA/CQC/HRA) · preliminary market engagement notices · Rewired and NHS ConfedExpo · published trouble (CQC reports, missed targets) as a compelling event. Cold outreach: low yield, but buyer information is public, so personalise properly.

Compliance sequence: regulatory status/intended use → DTAC (refreshed Feb 2026, full transition 6 Apr 2026, ~25% fewer questions, scope narrowed to software-based DHTs) → DSPT (30 June deadline; migrating to CAF alignment) + Cyber Essentials/Plus under PPN 014 (in force 24 Feb 2025) + NHS cyber security charter → DCB0129 (manufacturer) / DCB0160 (deployer), under national review with consultation 29 June–11 Sept 2026 → DPIA support pack → interoperability and accessibility. Data (Use and Access) Act 2025 makes health information standards enforceable.

Procurement: Procurement Act 2023 in force 24 Feb 2025 · central digital platform = Find a Tender · open procedure and competitive flexible procedure · Most Advantageous Tender · notices across the lifecycle · standstill ≥8 working days from contract award notice, with assessment summaries · Provider Selection Regime = healthcare services only, never goods/software · thresholds from 1 Jan 2026: £135,018 central government/NHS, £207,720 sub-central, inclusive of VAT and extensions (verify). Frameworks: G-Cloud · NHS SBS · Health Systems Support Framework · NHS Supply Chain · regional hubs.

Bid craft: read evaluation methodology → contract → pricing → specification. Mirror the question, evidence over adjectives, one point per paragraph, use the word count. Killers: late · missing mandatory doc · over word limit · altered pricing template · unsigned form of tender · contacting evaluators. Social value: NHS minimum 10% since April 2022 (NHS Social Value Playbook, July 2025); central government PPN 002 model mandatory from 1 Oct 2025 (verify both).

Pilot conversion kit: written agreement · hard stop + pre-agreed decision date · named executive sponsor and forum · criteria from the trust's own reporting, baselined before go-live, with a defined failure · data/IP/exit terms explicit · price at scale fixed now · named conversion route · charge something · no free extensions.

Evidence ladder: mechanism → case studies/references → service evaluation (no ethics approval; research does need it) → budget impact model (local) and cost-effectiveness/QALY (national) → peer review → NICE HealthTech programme (early use / routine use / existing use; early-use methods replaced interim EVA; manual July 2025), Evidence Standards Framework, National HealthTech Access Programme (announced Feb 2026), MedTech Funding Mandate.

Deal anatomy (14 months): conversation → champion + multi-thread → problem sized → technical/IG first pass → money conversation → pilot agreement → pilot with pre-measured baseline → decision meeting → business case through committee → procurement route → award, standstill, contracting → signature and purchase order. Track by exit criteria, not stage names.

References & further reading

Digital Technology Assessment Criteria (DTAC) — NHS England. The baseline assessment NHS buyers apply to digital health technologies, refreshed in February 2026 with a shorter form, de-duplication against the DSPT, and scope narrowed to software-based technologies in alignment with NICE. Download the current form and read it section by section; the guidance for buyers and suppliers tells you what the reviewer on the other side of the table has been told to look for.
Data Security and Protection Toolkit — NHS England (dsptoolkit.nhs.uk). The annual self-assessment for organisations handling NHS patient data, with a 30 June deadline and a phased migration towards the NCSC Cyber Assessment Framework. The news section is the authoritative place to check which version and route applies to your organisation type this year.
National review of clinical risk management standards DCB0129 and DCB0160 — NHS England. The consultation and supporting information for the 2026 review of the manufacturer and deploying-organisation clinical safety standards, open from 29 June to 11 September 2026. Reading the consultation documents tells you where clinical safety assurance is heading before it arrives.
AI and Digital Regulations Service for health and social care — NICE, MHRA, CQC and HRA (digitalregulations.innovation.nhs.uk). A single official walkthrough of what developers must do and what adopters must check, including UK GDPR compliance steps and the eight Caldicott Principles. The best free orientation available for anyone selling regulated digital health.
Procurement Act 2023 guidance and short guides — GOV.UK, plus Find a Tender (find-tender.service.gov.uk). The primary source for the regime in force since 24 February 2025 and the live record of notices — pipelines, preliminary market engagement, tenders, awards, contract details. Reading real notices in your category is the cheapest market education in this module.
NHS Payment Scheme, Medium-term planning framework 2026/27 to 2028/29 and Capital guidance 2026/27 to 2029/30 — NHS England. Between them these set out how providers are paid, how ICBs are allocated money over three years, and how technology capital reaches trusts through the Frontline Productivity Programme. Dry, but this is where "who pays?" is actually answered.
NHS Social Value Playbook (July 2025) and Applying net zero and social value in the procurement of NHS goods and services — NHS England. The basis for the minimum 10% net zero and social value weighting in NHS procurement, with guidance on evaluation and KPIs. Read before writing a social value response, not after losing on one.
NICE HealthTech programme manual (July 2025) and the Evidence standards framework for digital health technologies — NICE. The current national evaluation architecture — early use, routine use and existing use — and the public statement of what evidence a technology at a given risk level should hold. Together they tell you what evidence buyers will eventually ask for.
Independent Investigation of the NHS in England — Lord Darzi (GOV.UK, September 2024), and the 10 Year Health Plan (DHSC, July 2025). The diagnosis and the prescription that frame every NHS technology conversation in this period — capital starvation, the foothills of digital transformation, and the three shifts. Quoting them accurately signals you read the source rather than the summary.