- Id
- engagement
- Type
- engagement
- Description
- The NHS Business Services Authority (NHSBSA) is an Arm’s Length Body of the Department of Health and Social Care, responsible for providing platforms and delivering services that support the priorities of the NHS, Government and local health economies. Over £100 billion of NHS spend flows through our systems annually.
Our purpose is to deliver business service excellence to the NHS to help people live longer, healthier lives. Our vision is to be the provider of national, at scale business services for the health and social care system, transforming and delivering these services to maximise efficiency and meet customer expectations.
As part of strengthening our governance capability, we are seeking to move beyond fragmented processes and manual reporting towards a dynamic, insight-driven Governance, Risk and Compliance (GRC) environment.
Our ambition is to implement tooling that:
• Provides near real-time visibility across organisational risk, audit, and compliance activities
• Enables clear traceability between risks, controls, compliance obligations, and audit activity
• Records a full history of changes to risks, controls, compliance items, and evidence, maintaining audit trails and version tracking for transparency and accountability
• Supports proactive risk management and assurance, rather than retrospective reporting
• Enables trend analysis and thematic insight across the organisation
• Reduces duplication of effort through control reuse and structured assurance mapping
• Improves accountability through clear ownership, workflow, and approval processes
We are particularly interested in solutions that:
• Treat GRC as an interconnected system rather than isolated processes
• Provide intuitive dashboards suitable for senior leadership and governance reporting
• Enable monitoring of control effectiveness and impact analysis across multiple domains
• Maintain a full historical record of changes to support governance, oversight, and assurance reporting
• Support scalable governance maturity over time
The ambition is not merely to digitise existing processes, but to strengthen decision-making, organisational oversight, and enterprise-wide transparency through structured, connected GRC tooling.
Use of Artificial Intelligence and Automation
We recognise that modern Governance, Risk and Compliance (GRC) platforms increasingly incorporate artificial intelligence (AI), machine learning, and intelligent automation capabilities.
As part of this market engagement, we are interested in understanding how AI-enabled functionality could enhance:
• Risk identification and trend detection
• Predictive risk analysis and early warning indicators
• Automated control monitoring and anomaly detection
• Intelligent workflow routing and prioritisation
• Evidence reviews and document classification
• Thematic analysis across audit findings, risks and compliance data
• Reduction of manual administrative burden
Any AI capability should:
• Be transparent and explainable in its outputs
• Support human oversight and governance decision-making
• Operate within appropriate data protection, security and ethical boundaries
• Clearly describe model training sources and data usage (where applicable)
We are seeking insight into both current AI functionality and planned roadmap developments.
Please download the documentation and send your response to this RFI via the Atamis portal ( https://atamis-1928.my.site.com/s/Welcome).
- Due
- 10 Apr 2026, 23:59
- Status
- scheduled