Blog

Beyond the Plug: The Real Economics of EV Charging Networks Europe’s EV charging sector is entering a more demanding phase of its development. The urgency that once defined the market deploy infrastructure quickly, establish coverage, enable early adoption is giving way to a more complex mandate: ensure that this infrastructure is economically viable, operationally efficient, and capable of scaling sustainably. Yet much of the industry continues to operate on a simplifying assumption that the EV driver is the primary, if not sole, customer. That assumption no longer holds. The charging networks that are beginning to distinguish themselves across Europe are not simply improving the driver experience. They are redefining the system itself. What they recognise, and increasingly act upon, is that EV charging is not a single-user service. It is a multi-stakeholder platform, where value is created through coordination across a network of participants whose needs are distinct, but deeply interdependent. This shift is subtle in framing, but profound in consequence. At a surface level, EV charging appears straightforward: a driver arrives, connects to a charger, and completes a transaction. Beneath that interaction, however, sits a system that operates across two tightly coupled layers. The first is physical hardware reliability, grid connectivity, site accessibility. The second is digital pricing structures, data flows, interfaces, and integrations. Neither layer functions in isolation. A failure in one inevitably compromises the other. What complicates matters further is that no single stakeholder controls both layers. Instead, each is shaped by a different set of actors, each with their own priorities and definitions of value. To view this system solely through the lens of the driver is to overlook where its true constraints and opportunities reside. Consider first the role of site hosts. Every charging point exists because a property owner, municipality, or housing association chose to allocate space and resources to it. These decisions are not incidental; they are the foundation of network expansion. And yet, in many cases, the relationship between charging operators and site hosts remains underdeveloped characterised by limited transparency, manual processes, and fragmented communication. Where this relationship is treated with greater strategic intent, the results are markedly different. Providing site hosts with real-time visibility into utilisation, revenue generation, and operational performance transforms their role. They move from passive participants to active partners, capable of making informed decisions about expanding infrastructure across additional locations.“Visibility is not simply a feature it is a mechanism for growth.”If site hosts determine where infrastructure is deployed, fleet operators determine how intensively it is used. Fleet electrification is rapidly emerging as one of the most significant drivers of demand within the EV ecosystem. But fleets do not engage with charging networks in the same way as individual drivers. Their requirements are operational, not transactional. They need to understand energy consumption across vehicles, manage charging behaviour at depots, optimise costs, and integrate charging data into existing fleet management systems. In this context, charging is not an isolated activity it is part of a broader operational workflow. Operators that recognise this have begun to build dedicated environments tailored to fleet needs. These systems integrate charging data with vehicle telematics, enabling a unified view of performance across an entire fleet. The model adopted by Flexis reflects this approach. Charging becomes embedded within operations, rather than sitting alongside them. For charging networks, the implications are significant. Fleet relationships tend to be longer-term, higher-volume, and more predictable characteristics that materially improve the economics of the business. Less visible, but no less important, are the internal operations teams responsible for running these networks. In many organisations, operational inefficiencies are quietly absorbed. Teams rely on spreadsheets to reconcile data, switch between systems to manage workflows, and manually address issues that should be automated. Over time, these workarounds become normalised, even as they erode efficiency and increase costs. Operators that take a more disciplined approach treat their internal teams as primary users of their platforms. They invest in system integration, streamline processes, and eliminate unnecessary manual work. The effect is cumulative. Reduced operational friction translates directly into improved margins an outcome that is particularly important in capital-intensive infrastructure businesses. &nbsp; As networks expand, they also become part of a broader commercial ecosystem. Dealerships, energy providers, leasing companies, and mobility platforms all play a role in shaping how charging services are delivered and consumed. These relationships have the potential to accelerate growth, but only if they are supported by the right infrastructure. Without integration capabilities and self-service tools, partnerships quickly become operational bottlenecks. Forward-looking operators are addressing this by creating dedicated partner environments interfaces that allow external stakeholders to interact with the network directly, manage their own processes, and scale their involvement without constant intervention. In doing so, they transform partnerships from static agreements into dynamic growth channels. &nbsp; None of this diminishes the importance of the driver experience. Reliability, clarity, and ease of use remain fundamental. But it is increasingly evident that the driver experience is not an independent variable. It is the outcome of a system that is either well-coordinated or not. Where site hosts are engaged, fleets are integrated, partners are enabled, and operations are efficient, the driver experience improves naturally. Where these elements are misaligned, even the most polished interface cannot compensate. &nbsp; For investors and policymakers, this reframing has clear implications. From an investment perspective, it provides a more accurate lens through which to evaluate charging networks. The most promising operators are not necessarily those with the largest footprint, but those with the strongest ability to coordinate stakeholders, drive utilisation, and maintain operational discipline. From a policy standpoint, it suggests that the next phase of EV infrastructure development must extend beyond deployment targets. Ensuring interoperability, supporting fleet electrification, and promoting data transparency are increasingly central to achieving both economic and environmental objectives. The EV charging sector is no longer defined solely by how quickly infrastructure can be built. It is defined by how effectively it can be used. What is emerging is not simply a network of chargers, but a system of relationships each of which contributes to, or detracts from, the overall performance of the network. Those who understand this and design accordingly will not only scale more effectively, but build more resilient and valuable businesses in the process. &nbsp; Final Thought EV charging is often framed as an infrastructure challenge. In practice, it is both an infrastructure and a coordination challenge two dimensions that are inseparable in determining long-term success. Infrastructure remains essential and so does grid. Without sufficient, reliable physical assets, the system cannot function. But infrastructure alone does not guarantee utilisation, efficiency, or economic return. It is coordination across site hosts, fleet operators, partners, and internal teams that ultimately determines how effectively that infrastructure performs. Unlike infrastructure deployment, which is capital-intensive and often constrained, coordination is a lever that stakeholders can actively shape. It is also where alignment is most achievable, and where the greatest incremental value can be unlocked. The next phase of the EV charging market will not be defined by those who build the most, but by those who enable the system to work together most effectively.

Beyond the Plug: The Real Economics of EV Charging Networks

Agentic AI Is Here. Leadership Now Means Controlling What You Can’t Fully See. There is a growing misconception in boardrooms and policy circles that the defining question around artificial intelligence is adoption. It is not. The defining question is control. Artificial intelligence is moving beyond assistance and into action. Systems are beginning to operate independently, make decisions, and execute tasks at scale. This shift fundamentally changes the role of leadership. Once systems begin to act autonomously, leaders are no longer managing tools they are governing outcomes that they may not fully see or directly control in real time. Many organisations believe they are making strong progress. Pilots are running, use cases are expanding, and investment is increasing. Yet most initiatives are not scaling in a meaningful way. This is not because the technology is failing, but because the institution is not ready. There is a widening gap between what AI can do and what organisations are structured to manage. Closing that gap is now a leadership responsibility. The move from generative to agentic AI pushes systems into the core of operations. These systems can execute workflows, make decisions across multiple platforms, and operate without constant human input. This creates efficiency, but it also introduces exposure. For governments, this raises systemic risks in public services, regulation, and citizen trust. For investors, it introduces operational and reputational risks that are not yet fully priced into the market. The most significant risk is not failure in the traditional sense. It is drift. AI systems can optimise the wrong objectives, rely on incomplete context, or produce outputs that are slightly misaligned but consistently so. Nothing breaks, and performance may even appear to improve in the short term. But over time, outcomes begin to diverge from intent. At scale, this becomes a strategic and financial issue. Much of the current focus remains on data quality, but that alone is no longer sufficient. Agentic systems require context an understanding of what data represents, how it should be interpreted, and when it should be acted upon. Without this, even high-quality data can lead to poor decisions. Investing in data without investing in context creates a false sense of readiness. his shift also demands a rethink of governance. Traditional models focus on managing data and applying controls after decisions are made. Agentic AI requires governance to move upstream toward defining decision rights, setting risk thresholds, and ensuring real-time accountability. This is not an incremental adjustment. It is a structural change that cannot be left to technology teams alone. As systems become more autonomous, accountability becomes more complex. Multiple actors are involved developers, platforms, and data providers but responsibility does not disappear. It concentrates. For governments, this means accelerating clarity on liability and oversight. For investors, it means reassessing how risk is understood, priced, and governed. Trust will depend not on what AI can do, but on who stands behind it when it acts. Agentic AI introduces a new operational reality: decisions can now be made faster than they can be reviewed. This requires a shift in leadership mindset. Leaders must define what AI is allowed to decide, establish clear boundaries before deployment, and build systems that can detect misalignment early. This is not about slowing innovation, but about ensuring that speed does not outpace control. For governments, the priority is to create frameworks that enable innovation while maintaining accountability and public trust. For investors, the focus must move beyond adoption toward understanding how AI systems are governed and where risks may be hidden. Agentic AI is already reshaping how organisations operate. The organisations that succeed will not be those that move fastest, but those that align technology with real-world complexity, build governance before scale, and treat trust as a strategic asset. Leadership, in this context, is no longer about enabling AI. It is about ensuring that what AI does at speed and at scale remains aligned with what the organisation intends. Because once AI begins to act, the cost of misalignment is no longer theoretical. It is operational.

Agentic AI Is Here. Leadership Now Means Controlling What You Can’t Fully See.

The UK’s new Procurement Act is often presented as a structural reset of public sector buying. In reality, the shift is more subtle and arguably more significant. The Act is not fundamentally changing what government buys. Demand remains anchored in the same core priorities: digital transformation, infrastructure, defence, and public service delivery. What is changing is how procurement happens and critically, where competition now takes place. The implication for suppliers is clear. Success is no longer determined primarily at the point of tender. It is determined much earlier.<h3> The shift upstream: if you wait for the tender, you are too late </h3>One of the clearest changes is the growing importance of early market engagement. Pipeline notices, preliminary market engagement, supplier days, and pre-procurement workshops are becoming standard practice. These are no longer optional or informational exercises. They are increasingly where requirements are shaped and supplier credibility is assessed. In practical terms, this shifts competition into the pre-procurement phase. Suppliers that engage early, understand buyer priorities, and position themselves around policy objectives gain a structural advantage. Those that rely solely on responding to published tenders are entering the process too late when buyer preferences and expectations are already formed. This reinforces a core principle: public sector growth is driven by positioning before procurement, not performance during it.<h3> More flexibility, but not less complexity </h3>The introduction of the competitive flexible procedure is often highlighted as a major reform. It is now used in a significant proportion of above-threshold procurements, particularly in complex areas such as AI, digital transformation, and technology services. However, flexibility should not be mistaken for simplicity. Traditional routes such as open procedures and direct awards remain dominant. The system is evolving rather than being replaced. Buyers have more discretion, but this increases the importance of judgement, interpretation, and supplier trust. For suppliers, this creates a dual requirement: the ability to operate within formal procurement structures, and the ability to navigate less structured, relationship-driven processes. Winning strategies must now combine compliance with credibility. <h3>Relationships and credibility are now decisive </h3>Perhaps the most important shift is the growing weight placed on relationships and delivery confidence. Framework access alone is no longer a differentiator. Buyers have more discretion and are placing greater emphasis on proven delivery, familiarity with suppliers, and confidence in execution. This reflects a broader move away from purely compliance-driven procurement towards outcome-driven decision making. For suppliers, this means visibility matters. Engagement matters. Reputation matters. Companies that are known to buyers before procurement begins are better positioned than those that appear only at bid stage.<h3> The real battleground: pre-procurement awareness </h3>The Act is formalising something that has long existed informally: the importance of influence before procurement starts. Supplier days, industry events, and early engagement sessions are increasingly used by buyers to test ideas, understand market capability, and shape requirements. This effectively moves competition into a less visible, but more decisive phase. For suppliers, this creates both opportunity and risk. Opportunity, because requirements are not yet fixed. Risk, because absence at this stage can exclude suppliers before formal competition begins. This reinforces the need for structured engagement strategies rather than reactive bidding approaches.<h3> Visibility is improving, but the market remains fragmented </h3>Pipeline notices and forward planning data are improving transparency, particularly at central government level. However, the market remains highly fragmented, especially across local government. Central government opportunities tend to be fewer but significantly higher in value. Local government offers volume and diversity but requires more targeted and localised engagement. This creates a need for differentiated go-to-market strategies. A single national approach is no longer sufficient. Suppliers must decide where to focus and how to engage across different parts of the public sector.<h3> Policy signals versus commercial reality </h3>Themes such as social value, SME participation, and innovation are increasingly visible in procurement frameworks and policy discussions. However, in practice, commercial outcomes are still largely driven by delivery confidence, alignment with priorities, and perceived risk. Policy signals matter however they do not override execution credibility. Suppliers that treat policy themes as positioning tools, rather than standalone differentiators, are more likely to succeed.<h3> What this means for suppliers: a structural shift in strategy </h3>The overall direction is clear. Public procurement is moving away from a compliance-led and tender-focused model towards a relationship and positioning-driven environment. This has several implications: - Market entry is no longer defined by framework access alone - Competitive advantage is built before procurement begins - Relationships and visibility are central to success - Procurement is increasingly a continuation of prior engagement, rather than a starting point For international suppliers, this represents both a challenge and an opportunity. Those unfamiliar with the UK system may underestimate the importance of early engagement. Those that adapt quickly can gain disproportionate advantage.<h3> Procurement has not changed what it buys, but it has changed how you win </h3>The Procurement Act does not redefine demand. Government still buys broadly the same categories of goods and services. What it changes is the mechanics of competition. Winning is no longer about responding better. It is about being known earlier, understood better, and positioned more effectively. This reinforces a central thesis: The real work happens before procurement begins. In this environment, companies that invest in positioning, engagement, and strategic visibility will consistently outperform those that rely solely on bidding capability.

The Procurement Act: Who is Winning

<h3>Strengthening the UK’s Cyber Defences: What the Cyber Security and Resilience Bill Could Mean for Industry</h3> The proposed Cyber Security and Resilience (Network and Information Systems) Bill aims to modernise the UK’s cyber regulatory framework by expanding its scope to managed service providers and critical suppliers. While many of the implementation concepts are still under development and not yet agreed government policy, the proposals signal how the UK’s approach to cyber resilience could evolve in the coming years.<h3> Introduction </h3>As cyber threats continue to evolve and digital systems become increasingly interconnected, governments are reassessing how best to regulate cyber risk across critical infrastructure and supply chains. The UK’s proposed Cyber Security and Resilience (Network and Information Systems) Bill represents a significant step in this direction, aiming to expand the scope of existing cyber regulations and strengthen the resilience of services that underpin the economy and society. While many of the implementation concepts currently being explored are not yet finalised government policy, they provide an indication of how the UK’s cyber regulatory framework could develop in the coming years.<h3> Strengthening the UK’s Cyber Resilience Framework </h3>The Cyber Security and Resilience Bill builds on the Network and Information Systems (NIS) Regulations 2018, which currently regulate operators of essential services and certain digital service providers. The new legislation proposes to expand the scope of the regulatory framework to include additional organisations whose services play a critical role in supporting the UK’s digital infrastructure and economic activity. The proposed reforms aim to: - broaden the range of organisations subject to cyber regulation - strengthen regulators’ ability to respond to cyber incidents - improve information sharing between government, regulators and industry - enhance cyber resilience across supply chains supporting essential services. “The Cyber Security and Resilience Bill represents a significant expansion of the UK’s cyber regulatory framework, reflecting the growing importance of digital infrastructure to the economy.” Taken together, these changes are intended to ensure the UK’s cyber regulatory framework reflects the increasing complexity and interdependence of modern digital systems.<h3> Implementation Will Be Phased </h3>Although the Bill has been introduced to Parliament, its provisions will not come into force immediately once it receives Royal Assent. Instead, implementation is expected to take place in stages. The Government has indicated that further consultation, secondary legislation, and guidance will be required to operationalise the framework. Current indicative timelines suggest that consultations on implementation could take place in late summer or early autumn 2026, with implementing regulations expected to follow once the legislative process is completed. Businesses are also expected to be given a proportionate adjustment period to allow organisations time to prepare for the new regulatory requirements.<h3> Bringing Managed Service Providers into Scope </h3>One of the most significant proposed changes is the inclusion of Relevant Managed Service Providers (RMSPs) within the scope of cyber regulation. Managed service providers have become increasingly important to the operation of modern digital infrastructure, providing services such as monitoring, maintenance, and administration of IT systems for organisations across both the public and private sectors. Under the proposed framework, medium and large managed service providers operating in the UK could fall within scope of the regulatory regime, with oversight expected to sit with the Information Commission. Managed services are expected to be defined as services delivered under contract for the ongoing management of a customer’s information technology systems, typically involving activities such as system monitoring, support, and active administration. To qualify as a managed service, the service must involve connection to or access to the customer’s network and information systems. This distinction is intended to exclude services that simply use IT but do not involve ongoing management of systems. Certain services such as data centre provision and public electronic communications networks are not expected to fall within this definition.<h3> Proposed Obligations for Managed Service Providers </h3>Organisations that fall within the RMSP category may face a number of regulatory obligations under the proposed framework. These could include requirements to: - register with the Information Commission - provide organisational and service information during registration - report significant cyber incidents to both the Information Commission and the National Cyber Security Centre - notify customers when incidents affect service delivery - implement appropriate and proportionate security measures to manage cyber risks associated with their services. Further technical requirements including the thresholds for incident reporting and the detailed security expectations are expected to be defined through secondary legislation.<h3> Risk-Based Registration and Oversight </h3>To support effective oversight, regulators may require additional information from organisations during the registration process. Examples of potential information requirements include: - company size, including headcount and revenue - high-level descriptions of services provided - the approximate number of UK customers served - whether services are supplied to critical national infrastructure sectors - general information on existing cybersecurity measures. These measures are intended to help regulators understand the risk profile of organisations within the sector, enabling them to apply a proportionate and risk-based regulatory approach.<h3> Addressing Supply Chain Risks </h3>Alongside the inclusion of managed service providers, the Bill proposes a new mechanism for designating Critical Suppliers. This reflects growing recognition that cyber vulnerabilities increasingly arise from complex digital supply chains. Essential services often depend on a network of technology providers, and disruption to a key supplier can create cascading impacts across multiple sectors. The proposed Designated Critical Supplier (DCS) mechanism would allow regulators to designate a small number of suppliers whose disruption could have a significant impact on the economy or the day-to-day functioning of society. Suppliers designated under this framework could be required to meet enhanced security and resilience requirements proportionate to their systemic importance.<h3> A Targeted and Proportionate Approach </h3>The proposed supplier designation framework is intended to be highly targeted. Rather than applying regulation broadly across all suppliers, the mechanism would focus only on suppliers whose disruption could create systemic risks across sectors or services. The framework emphasises that designation decisions must be evidence-based and follow defined statutory processes, including consultation and opportunities for suppliers to challenge decisions. This approach is intended to strengthen cyber resilience while avoiding unnecessary regulatory burdens on the wider technology sector.<h3> Looking Ahead </h3>The Cyber Security and Resilience Bill signals a significant evolution of the UK’s cyber regulatory landscape. By expanding regulation to include managed service providers and introducing mechanisms to address systemic supply-chain risks, the proposals reflect the growing importance of digital infrastructure to the UK’s economy and society. However, much of the framework remains under development. Many of the concepts currently being explored are not yet finalised government policy, and further consultation will shape how the regime is ultimately implemented. For organisations operating within the UK’s digital ecosystem, engaging with this process will be essential to ensure that the emerging framework delivers both strong cyber resilience and practical, proportionate regulation.

Strengthening the UK’s Cyber Defences: What the Cyber Security and Resilience Bill Could Mean for Industry

Fraud Now Makes Up Nearly Half of UK Crime. Here’s Why That Changes Everything.&nbsp;Fraud has quietly become the UK’s most dominant form of crime. Not violent crime, not theft but fraud. According to the Government’s latest strategy, around 45% of all crime recorded in the Crime Survey for England and Wales is now fraud or cyber-related. That single figure changes the conversation entirely. Fraud is no longer a niche issue for banks or a specialist concern for law enforcement. It is now one of the defining public safety and economic challenges facing the UK. And the Government’s response reflects that shift.<h3> A System Built for Yesterday’s Problem </h3>For years, fraud prevention has been reactive and fragmented. A bank might work with law enforcement. A technology platform might tackle abuse within its own ecosystem. Telecom providers might address scam calls in isolation. Each effort has value but together, they fall short. Fraud does not respect organisational boundaries. Criminals move seamlessly between platforms, services, and jurisdictions. Meanwhile, the systems designed to stop them have remained largely siloed. The result is predictable: fraud scales faster than the response to it.<h3> Enter the Online Crime Centre </h3>At the heart of the UK’s new Fraud Strategy (2026–2029) is a new concept: the Online Crime Centre (OCC). Its ambition is simple, but significant to bring together government, law enforcement, and industry into a single, coordinated effort to tackle fraud and cybercrime at scale. This is not just another enforcement body. It is intended to solve a coordination problem that has existed for years: how to move from isolated, bilateral relationships to structured, multi-sector collaboration. In practice, that means: - Prioritising the most important fraud threats collectively - Sharing intelligence more effectively - Acting earlier before harm spreads<h3> Designing Out Fraud, Not Just Responding to It </h3>One of the most striking ideas in the strategy is the shift toward “designing out” fraud. Rather than chasing criminals after the fact, the focus is on identifying the weak points that enable fraud in the first place and removing them. Sometimes, small changes can have outsized impact. For example, adjustments to how users authenticate when enrolling in digital wallets have already led to material reductions in fraud for some banks. Similarly, tackling issues like malicious online advertising known as malvertising could disrupt entire fraud pathways. The lesson is clear: If you remove the enabler, you reduce the crime.<h3> The Power of Shared Signals </h3>Another key shift is how information is used. Today, organisations often hold valuable pieces of the puzzle an email address here, a suspicious phone number there but lack the ability to connect those dots quickly enough. The OCC aims to change that through large-scale signal sharing. These “signals” might include: - Email addresses - URLs - Phone numbers - IP addresses On their own, they may seem insignificant. But when combined across organisations, they can reveal much larger networks of criminal activity. In one example discussed, a small set of signals from law enforcement, when combined with a platform’s internal data, helped identify and shut down a far broader network of fraudulent accounts. This is where scale matters. The more connected the system, the more powerful each piece of data becomes. <h3> The Hidden Problem: Underreporting </h3>Despite fraud’s scale, much of it still goes unreported. People don’t report fraud for many reasons low confidence in outcomes, reimbursement from banks, embarrassment, or simply not knowing where to go. But this creates a critical blind spot. Reporting is not just about solving individual cases. It feeds the intelligence needed to detect patterns, identify enablers, and prevent future attacks. Without it, the system is always one step behind. Closing this gap will be essential if the OCC is to succeed.<h3> A New Expectation for Business </h3>Perhaps the most important shift is what this means for industry. The direction is clear: Businesses will increasingly be expected to play an active role in tackling fraud not just within their own walls, but as part of a wider ecosystem. This includes: - Sharing data in secure, usable ways - Contributing to coordinated interventions - Collaborating across sectors For organisations in financial services, telecoms, and technology, this is not a distant possibility. It is the emerging operating model. And while it brings new demands, it also creates opportunity for those able to enable faster decisions, better collaboration, and measurable outcomes.<h3> Technology Will Shape the Next Phase </h3>The strategy also points toward a more technology-driven future. The OCC is expected to explore: - Automation of manual fraud analysis - AI-assisted investigations - Faster identification of emerging threats At the same time, the threat landscape is becoming more sophisticated. Deepfakes, digital identity manipulation, and increasingly convincing impersonation attacks are already changing the nature of fraud. The response will need to be just as adaptive.<h3> A Fundamental Reset </h3>What emerges from the UK’s new Fraud Strategy is not just a set of initiatives, but a fundamental reset. Fraud is now too large, too fast-moving, and too interconnected to be tackled in isolation. The future lies in coordination, prevention, and scale. The creation of the Online Crime Centre is an early step toward that future but its success will depend on something broader: whether public and private sectors can truly work together in a more open, operational, and data-driven way. Because when nearly half of all crime is fraud, the cost of standing still is simply too high.<h3> Where Does Business Fit in a Coordinated Anti-Fraud Ecosystem </h3>The shift outlined in the UK’s Fraud Strategy creates a clear and immediate opportunity for businesses to move beyond internal fraud controls and position themselves as active contributors to a wider, coordinated ecosystem. As the Online Crime Centre (OCC) drives greater collaboration between government, law enforcement and industry, there will be growing demand for capabilities that can translate shared intelligence into rapid, actionable outcomes. This includes solutions that enable real-time signal sharing (such as suspicious accounts, devices or identifiers), orchestrate cross-sector workflows, and support the testing and scaling of interventions that “design out” fraud at its source. At the same time, organisations that can facilitate secure, governed data sharing at scale, while demonstrating measurable impact, such as reduced fraud volumes or faster response times will be particularly well placed. In this environment, the opportunity is not just to protect individual firms, but to enable system-wide fraud reduction, aligning commercial value with national priorities.

Fraud Now Makes Up Nearly Half of UK Crime. Here’s Why That Changes Everything

<h3>DTAC Reform: Simplifying Digital Assurance in the NHS</h3>The NHS’s Digital Technology Assessment Criteria (DTAC) framework has been updated following a multi-year review led by NHS England and the Department of Health and Social Care (DHSC). The revised framework introduces an updated assessment form and accompanying guidance designed to simplify digital assurance processes while maintaining strong standards for patient safety, data protection and interoperability. While the latest changes focus on improving the usability of the current framework, they also signal the beginning of a broader reform programme aimed at modernising how digital health technologies are assessed and adopted across the NHS.<h3>A Framework for Safe Digital Innovation.</h3>DTAC- the Digital Technology Assessment Criteria- provides the NHS’s national baseline for assessing whether digital health technologies meet the requirements necessary for deployment within health and care settings. The framework brings together a range of mandatory standards covering areas such as clinical safety, cybersecurity, data protection, interoperability and usability. By consolidating these requirements, DTAC aims to create a clearer and more consistent process for evaluating digital health technologies. As Sam Tallents from NHS England’s Transformation Directorate explained: “DTAC is the Digital Technology Assessment Criteria. It's an assessment framework that brings together all of the mandatory standards and policy requirements that the NHS has for using digital health technologies in the NHS.” While responsibility for adopting technologies and managing associated risks ultimately sits with local NHS organisations, DTAC provides a common structure that helps ensure those assessments are carried out consistently across the health system. The framework also provides suppliers with greater clarity about what is required to bring digital products into NHS environments.<h3> Responding to Industry and NHS Feedback.</h3>The latest DTAC update follows several years of engagement with industry and health system stakeholders. Feedback highlighted that although the framework played an important role in digital assurance, aspects of the process had become difficult to navigate. Suppliers in particular pointed to overlapping requirements across multiple regulatory and assurance processes, which could create confusion and increase administrative burden. Rebecca, who co-led the DTAC review alongside colleagues from NHS England and DHSC, explained that the latest update focuses on simplifying the framework while maintaining its core safeguards. “We’ve produced an update on DTAC a couple of weeks ago. So that is both an updated form and updated guidance to accompany the form.” The revised documentation introduces a streamlined assessment form and clearer guidance intended to make the process easier for both suppliers and NHS organisations.<h3> Making the Framework Easier to Use</h3>The immediate reforms focus on improving the usability of DTAC within the existing assurance model. Key changes include: - Simplifying and updating the DTAC assessment form - Removing duplicated or outdated requirements - Clarifying how specific standards apply to different types of digital &nbsp; &nbsp; technologies - Improving links to supporting guidance and relevant standards Tallents described these changes as initial improvements designed to streamline the current process. “These are some initial changes just to streamline the existing process, make things a little bit easier to navigate and remove and update some of the requirements.” While these updates are relatively targeted, they address several practical challenges identified by suppliers and NHS organisations using the framework.<h3> A Longer-Term Vision for Digital Assurance</h3>Alongside these interim improvements, policymakers are also considering more fundamental changes to how digital health technologies are assured in the NHS. One option currently being explored is a move towards a certification-based approach to digital assurance. Such a model could provide suppliers with a clearer national route for demonstrating compliance with NHS requirements. Tallents noted that this concept remains under development as part of the broader reform programme. “Longer term, we’re looking at some more substantive reforms… we’ll be looking to move to more of a certification-based approach.” A certification model could potentially reduce duplication across local procurement processes and create a more scalable approach as the volume of digital health technologies continues to grow.<h3> Navigating Regulatory Complexity</h3>The discussion around DTAC reform also highlighted the complexity that can arise when multiple regulatory frameworks apply to the same technology. Digital health products may be subject to medical device regulation while also needing to comply with clinical safety standards and NHS digital assurance requirements. Participants noted that interpreting how these frameworks interact can sometimes be challenging, particularly where technologies fall into regulatory grey areas. Tallents acknowledged that applying these rules in practice can quickly become complicated. “The application rules get very complicated very quickly… which is probably not an ideal situation to be in.” Where a product is fully covered by medical device regulation, the regulatory process is intended to provide assurance around patient safety. However, officials recognised that determining when this applies can require careful judgement.<h3> Clarifying the Scope of DTAC</h3>One important clarification from the discussion concerned the relationship between DTAC and medical device regulation. Technologies regulated as medical devices do not automatically fall outside the scope of DTAC. Instead, applicability depends on how the product is intended to be used and how it interacts with NHS systems. Rebecca emphasised that DTAC continues to apply in many cases because it addresses broader requirements beyond clinical safety. “It isn’t the case that if products have medical device regulation, then they automatically fall out of the scope of DTAC.” This ensures that digital technologies used in the NHS meet system-wide expectations around cybersecurity, interoperability and data governance.<h3> Improving Guidance and Transparency.</h3>To help suppliers navigate these complexities, the updated DTAC documentation includes clearer links to supporting guidance and related standards. In particular, the guidance now provides more direct access to step-by-step information on applying clinical safety standards, which had previously been less visible. Tallents noted that the documentation will continue to evolve alongside changes to relevant standards. “There is also step-by-step guidance on the application of the DCB standards, and we've linked to that more clearly in the document that we hadn't done previously.” By improving access to guidance and clarifying how standards apply, the updated framework aims to reduce uncertainty for suppliers entering the NHS market.<h3> Supporting the Next Phase of NHS Digital Transformation.</h3>Digital technologies are playing an increasingly central role in healthcare delivery, from remote monitoring tools to AI-enabled diagnostics and digital therapeutics. Ensuring that these technologies are safe, secure and interoperable is essential to building trust in digital health innovation. The latest DTAC updates represent an effort to strike the right balance between maintaining robust assurance standards and enabling innovation to move more quickly through the health system. While further reforms are expected as the programme develops, the current changes signal a clear intention to make digital assurance processes more transparent, consistent and easier to navigate for both suppliers and the NHS. As digital transformation continues to accelerate, frameworks like DTAC will remain critical to ensuring that innovation is introduced safely and effectively across the health service.

DTAC Reform: Simplifying Digital Assurance in the NHS

Larkspur International

Where Government Meets Business Growth
Larkspur International operates at the intersection of business and government where decisions are shaped, risks emerge, and opportunities are realised.

Larkspur International is a business consultancy with a growth mindset working alongside clients to navigate government systems, eliminate barriers, and deliver measurable commercial outcomes.

INSIGHTS

Beyond the Plug: The Real Economics of EV Charging Networks

Agentic AI Is Here. Leadership Now Means Controlling What...

The Procurement Act: Who is Winning

Strengthening the UK’s Cyber Defences: What the Cyber Sec...

Fraud Now Makes Up Nearly Half of UK Crime. Here’s Why Th...

DTAC Reform: Simplifying Digital Assurance in the NHS