Contract Health Check: Is Your Contract Fit For Purpose?

Introduction

The digital health landscape has evolved significantly in recent months, with new regulatory guidance, cyber security requirements and emerging technologies transforming the obligations that should be reflected in your contracts. This checklist identifies key areas where your existing supplier contracts may need updating to ensure compliance with current standards and protect your organisation.

Data Security and Protection Toolkit (DSPT)

Why it matters: NHS England recently published guidance emphasising the importance of the DSPT¹. The guidance asks for boards and executives to assure themselves that cyber security risks are being managed effectively. It confirms that the DSPT is the standard that all frontline NHS organisations are expected to comply with and is aligned to the National Cyber Security Centre’s Cyber Assessment Framework (CAF). From September 2026, NHS England will produce a series of new and updated cyber security policies to be included in the next DSPT.

Check whether your contract:

• Requires the supplier to maintain a current, published DSPT submission on an ongoing basis.
• Obliges the supplier to notify you promptly of any change to their DSPT status.
• Provides you with audit or inspection rights to verify the supplier’s DSPT assertions.

NHS cyber security charter

Why it matters: NHS England and the Department of Health and Social Care have set out a plan to promote cyber resilience across the health and care sectors by 2030, protecting both services and patients. In light of this, they are offering current and potential suppliers the opportunity to publicly affirm their commitment to keeping these sectors safe by signing up to the NHS Cyber Security Charter. Suppliers that sign up to the NHS Cyber Security Charter are only making a statement of intent rather than a commercial or contractual commitment. However, as the NHS Cyber Security Charter sets out important baseline commitments that suppliers to the NHS should meet, it is helpful for these commitments to be flowed down into individual customer contracts to support and reinforce the cyber security standards expected across the health and care sectors².

Check whether your contract:

• Requires the supplier to sign up to and comply with the Cyber Security Charter.
• Incorporates the Cyber Security Charter’s requirements as ongoing contractual obligations.
• Requires the supplier to evidence compliance on an ongoing basis.

Digital Technology Assessment Criteria (DTAC)

Why it matters: DTAC is a baseline standard used by the NHS to approve digital health tools before they are bought or used. It is often used alongside other checks, such as the DSPT. Following a review process, NHS England recently refreshed the DTAC form and published updated guidance on DTAC’s purpose, scope and how assessments should be completed³. Organisations should review the updated DTAC form and guidance and ensure DTAC is used both during procurements and as part of ongoing supplier management.

Check whether your contract:

• Requires the supplier to meet and maintain compliance with DTAC criteria in accordance with current guidance.
• Requires ongoing evidence of DTAC compliance (not just at the point of initial procurement).
• Obliges the supplier to notify you any material change that would affect their DTAC assessment.
• Addresses what happens if the supplier fails to maintain DTAC compliance.

Sub-processors and international data transfers

Why it matters: UK data protection legislation contains rules about the transfer of personal data to organisations located outside of the UK. Cloud-hosted systems and AI products may store, process, access or transfer data across multiple jurisdictions, often involving a range of third-party providers and sub-processors. It is therefore important for organisations to understand a supplier’s data processing model, including who has access to personal data, where it may be stored or processed and whether any international data transfers take place.

Check whether your contract:

• Identifies all locations where personal data is stored, processed or accessed.
• Provides a list of all the supplier’s sub-processors processing personal data and the purposes for which it is processed.
• Confirms whether any restricted transfers take place and, if so, the safeguards relied upon (e.g. adequacy decision, IDTA, BCRs etc).
• Prohibits international transfers without your prior written approval.

Ambient Voice Technology (AVT) and medical device classification

Why it matters: NHS England recently published guidance on the use of ambient scribing products that feature AI (also known as AVT) in health and care settings⁴. The guidance contains specific references to provisions that should be included in contracts, including clear and comprehensive contracting arrangements to appropriately delineate responsibility and liability. The guidance emphasises that processes involving AI-enabled products should be designed with transparency and traceability in mind to aid in establishing accountability and liability when required. It is also important to check whether the AVT product has been correctly considered under medical device regulation.

When procuring AVT products, you should consider whether the AVT supplier is included on the Self-Certified Supplier Registry, which is a national capability to support safe and effective scaling and adoption of AVT across the health and care system⁵.

Check whether your contract:

• Includes a monitoring obligation on the supplier to assess the evolving functionality of AVT products to determine whether any part of them constitute a medical device under medical device laws.
• Obliges the supplier to obtain and maintain appropriate certification where the product qualifies as a medical device.
• Requires compliance with MHRA’s guidance on qualification and classification of AVT-enabled products.
• Aligns with the IG guidance on the use of AI-enabled scribing products – Using AI-enabled ambient scribing products in health and care settings – NHS England Digital.

AI governance

Why it matters: AI is now embedded in many NHS IT systems. Suppliers are rapidly introducing AI features into existing products, often without explicit customer consent. Without dedicated AI governance provisions, customers have no contractual visibility or control over how AI is being used with their data and within their services.

Check whether your contract:

• Requires the supplier to obtain your prior written consent before using any AI system in the delivery of services or enabling access to AI functionality to users and establishes a formal approval process for new AI tools to ensure their initial and ongoing compliance with evolving best practice and law.
• Prohibits the use of your data (including prompts, logs, and metadata) for AI model training without explicit agreement and ensures human oversight of AI outputs before critical decisions.
• Addresses AI-specific exit and transition obligations ensuring the supplier cannot retain your data in AI systems post-termination of the contract.

ISO Certifications

Why it matters: From 31 October 2025, ISO 27001:2013 certificates are no longer recognised as valid and organisations wishing to maintain ISO 27001 certification must be certified against ISO 27001:2022. The 2022 edition reflects current information security risks and practices, including cloud services, threat intelligence, secure coding, data masking, data leakage prevention, and ICT readiness for business continuity.

Check whether your contract:

• Requires the supplier to be certified against ISO 27001:2022 – earlier contracts may include transition provisions which permitted compliance against ISO 27001:2013 up to 31 October 2025.
• If your contract does include transition provisions, ensure it requires the supplier to provide evidence of compliance against the 2022 standard.

Current best practice security requirements

Why it matters: Technology used to deliver services can be enhanced and modernised during the contract term, and the associated security requirements, particularly in older contracts, may not reflect current best practice and/or be appropriate for more modern technologies.

Check whether your contract:

• Includes appropriate governance and allows for periodical review of security requirements to ensure that they continue to represent best practice and reflect current guidance.
• Aligns with current best practice, including in respect of:
  • Multi-factor authentication and access controls;
  • Protective monitoring;
  • Backup and security recovery controls;
  • Security specific audit rights;
  • Incident and breach of security management;
  • Controls on offshoring, including support and third-party tools;
  • Physical security measures and considerations for remote working; and
  • Escalation routes for non-compliance.

Next steps

If your current contracts do not adequately address the areas identified above, you may wish to consider:

1. Contract gap analysis – a structured review of existing terms against this checklist.
2. Prioritisation – identifying which gaps pose the greatest regulatory or patient safety risk.
3. Contract variation – negotiating amendments with your suppliers to address identified gaps.
4. Ongoing reviews – establishing a process for periodic contract reviews as guidance, law and best practice continues to evolve.

Footnotes

1. NHS England » Board and executive assurance: cyber security risk

2. Cyber security charter for suppliers to the NHS – NHS England Digital

3. Updated NHS England Digital Technology Assessment Criteria (DTAC) form and guidance – Innovation Service

4. Ambient Voice Technology Self-Certified Supplier Registry – NHS England Digita