11 NHS & healthcare entry points · 8 healthcare AI priorities · 6 healthcare DEFONEOS MCPs · NHS DSPT digital backbone
The NHS AI Lab (now NHS England AI & Digital) has identified AI as critical to the NHS Long Term Plan — with £36B annual NHS spend, 1.4M staff, and 42 Integrated Care Boards (ICBs) managing regional healthcare delivery. The NHS Data Security & Protection Toolkit (DSPT) mandates cyber and data governance for all NHS organisations. The MHRA's AI & Software as a Medical Device (SaMD) regulatory framework (2026 refresh) requires audit-grade AI governance for clinical decision support systems.
DEFONEOS provides NHS trusts, ICBs, and healthcare AI developers with a UK-sovereign, BFT-governed, audit-grade AI operating system purpose-built for healthcare compliance at the OFFICIAL / OFFICIAL-SENSITIVE boundary. This pack maps 11 healthcare procurement entry points, cross-references 8 healthcare AI priorities to DEFONEOS MCP coverage, and demonstrates the NHS DSPT digital backbone architecture.
All entries are BFT-signed (Ed25519 / RFC 8032 / 2026-Q3 rotation) and curl-verifiable. Per-entry contacts sourced from NHS England AI & Digital (2026-Q1) + NHS Shared Services procurement pipeline.
| # | Entry point | Location | Healthcare function | DEFONEOS fit |
|---|---|---|---|---|
| H1 | NHS England — AI & Digital Directorate | Leeds / London | National AI strategy · digital transformation · DSPT oversight | DEFONEOS MCPs: bft-council-probe · mcp-cspm — BFT-governed AI governance + national compliance |
| H2 | MHRA — AI & SaMD Regulatory | London | AI as Medical Device regulation · clinical safety | DEFONEOS MCPs: mcp-dynamic-sbom · bft-council-probe · mcp-cspm — SBOM + clinical AI audit trail |
| H3 | NHS Shared Business Services | London / Reading | Procurement framework · NHS digital marketplace | DEFONEOS MCPs: bft-council-probe · mcp-cspm — procurement compliance + BFT vendor governance |
| H4 | NHS Digital Academy / Topol Review | Multiple sites | AI workforce training · digital skills · clinical informatics | DEFONEOS MCPs: bft-council-probe — BFT-governed training curriculum compliance |
| H5 | NIHR — AI & Digital Health | Multiple sites | AI research funding · clinical trials · evidence generation | DEFONEOS MCPs: mcp-dynamic-sbom · bft-council-probe — research SBOM + BFT research governance |
| H6 | NHS AI Lab (NHSX legacy) | London | AI deployment · regulatory sandbox · ethics | DEFONEOS MCPs: bft-council-probe · mcp-cspm · mcp-dynamic-sbom — AI ethics + compliance audit |
| H7 | Health Research Authority (HRA) | London | Research ethics · IG approval · consent frameworks | DEFONEOS MCPs: bft-council-probe · mcp-dynamic-sbom — BFT ethics governance + SBOM trail |
| H8 | ICB Digital Leads (42 ICBs) | Regional | Regional AI deployment · data sharing · interoperability | DEFONEOS MCPs: bft-council-probe · mqtt-bridge · mcp-cspm — ICB-level BFT governance + data pipeline |
| H9 | UK Biobank / Genomics England | Stockport / London | Genomic data · precision medicine · population health | DEFONEOS MCPs: mcp-dynamic-sbom · bft-council-probe · mcp-cspm — genomic data pipeline + SBOM assurance |
| H10 | Care Quality Commission (CQC) | Newcastle / London | AI quality assurance · inspection · safety monitoring | DEFONEOS MCPs: bft-council-probe · mcp-cspm — BFT quality governance + compliance monitoring |
| H11 | NHS Blood & Transplant (NHSBT) | Bristol / London | Blood supply · organ donation · transplant AI | DEFONEOS MCPs: mqtt-bridge · bft-council-probe · mcp-dynamic-sbom — cold-chain IoT + BFT transplant governance |
| # | Healthcare AI priority | Lead body | DEFONEOS MCP coverage | Alignment cross-walk |
|---|---|---|---|---|
| F1 | AI clinical decision support governance | NHS England / MHRA | bft-council-probe · mcp-dynamic-sbom · mcp-cspm | MHRA SaMD framework · DCB 0129 (Clinical Risk) · IEC 62304 |
| F2 | Data security & DSPT compliance | NHS Digital / NHS England | mcp-cspm · mcp-dynamic-sbom · bft-council-probe | NHS DSPT · IG Toolkit · Caldicott Principles · UK GDPR |
| F3 | AI ethics & bias monitoring | NHS AI Lab / HRA | bft-council-probe · mcp-cspm | NHS AI Ethics · EU AI Act Art 6 · WHO AI Ethics 2024 |
| F4 | Healthcare IoT & connected devices | NHS Estates / MHRA | mqtt-bridge · rtsp-camera · bft-council-probe | MDCG 2019-16 · NHS DCB 0160 · Cyber Essentials Plus |
| F5 | Genomic & precision medicine AI | Genomics England / NHS GMS | mcp-dynamic-sbom · bft-council-probe · mcp-cspm | UKGDPR · Common Law Duty of Confidentiality · GA4GH standards |
| F6 | Clinical trial & research AI | NIHR / HRA | mcp-dynamic-sbom · bft-council-probe | UK Policy Framework for Health Research · HRA approval · ICH-GCP |
| F7 | Supply chain & pharmaceutical AI | MHRA / NHS SBS | mcp-dynamic-sbom · mcp-cspm · bft-council-probe | EU GDP Guidelines · MHRA GMP · FMD Directive |
| F8 | Healthcare digital backbone | NHS Digital | All 30 MCPs (federated healthcare pipeline) | NHS Long Term Plan · Topol Review · ISO 42001 · UK AISI |
| # | MCP | Category | Healthcare deployment | Key capability |
|---|---|---|---|---|
| M1 | bft-council-probe | Core | All 11 healthcare entry points | 33-agent BFT defence council · quorum-gated clinical AI decision audit |
| M2 | mcp-cspm | Compliance | NHS DSPT · CQC · ICB compliance | Cloud security posture management · DSPT alignment · IG compliance |
| M3 | mcp-dynamic-sbom | Compliance | MHRA SaMD · clinical software supply chain | Real-time SBOM generation · SaMD software supply chain assurance |
| M4 | mqtt-bridge | Sensor | NHS Estates IoT · cold-chain · medical devices | IoT sensor bridge · MQTT sovereign data ingest · medical device network |
| M5 | rtsp-camera | Sensor | Ward monitoring · pharmacy · clinical areas | IP camera ingest · sovereign video pipeline (OFFICIAL only) |
| M6 | openaq-air | Sensor | Hospital air quality · infection control | Global air quality data · hospital environmental monitoring |
| DSPT Component | Role | DEFONEOS integration | MCP coverage |
|---|---|---|---|
| NHS Trust Data Protection | Trust-level IG compliance | BFT-governed IG compliance + CSPM monitoring | mcp-cspm · bft-council-probe |
| MHRA SaMD Register | AI/ML medical device registration | SBOM + clinical audit trail for SaMD lifecycle | mcp-dynamic-sbom · bft-council-probe |
| ICB Regional Digital | 42 ICBs digital deployment | ICB-level BFT governance + data pipeline monitoring | bft-council-probe · mqtt-bridge · mcp-cspm |
| CQC Digital Safety | AI quality inspection | BFT audit trail for CQC compliance evidence | bft-council-probe · mcp-cspm |
| HRA Ethics Approval | Research ethics governance | BFT ethics governance + SBOM research trail | bft-council-probe · mcp-dynamic-sbom |
| Step | Action | Who | Time | Prerequisite |
|---|---|---|---|---|
| 1 | Identify healthcare cluster (Clinical AI / DSPT / Ethics / IoT / Genomic / Research / Supply / Digital) | Buyer | 15 min | This compliance pack §2 |
| 2 | Confirm procurement vehicle (NHS SBS / G-Cloud 14 / NIHR / NHSE direct) | Buyer + CSOAI | 30 min | Framework checklist |
| 3 | Confirm data governance boundary (DSPT / Caldicott / IG) | Buyer + CSOAI | 1 hour | SC clearance guide |
| 4 | Submit healthcare pilot request (Trust-specific or ICB-wide) | Buyer | 1 hour | DSP tracker |
| 5 | CSOAI provisions NHS-region sovereign VM + DEFONEOS substrate | CSOAI | <24 hours | AG-1: curl -s /health HTTP 200 |
⚠️ HARD RED-LINE: DEFONEOS handles OFFICIAL and OFFICIAL-SENSITIVE data ONLY. No patient-identifiable data (PID), NHS Number-linked records, or Special Category Health Data flows through DEFONEOS without explicit Caldicott approval and Data Processing Impact Assessment. DEFONEOS provides governance, compliance monitoring, and SBOM assurance for AI systems — the clinical data itself flows through accredited NHS Spine / FHIR / OpenEHR channels. BFT council decisions are audit metadata, not clinical records.
| Buyer type | Entry point | Procurement vehicle | Security requirement | Pilot tier |
|---|---|---|---|---|
| NHS England / AI Directorate | H1 / H6 | NHSE direct / G-Cloud 14 | OFFICIAL-SENSITIVE / SC | T3 |
| MHRA Regulatory | H2 | MHRA direct | OFFICIAL-SENSITIVE | T2 |
| ICB Digital Lead | H8 | G-Cloud 14 / NHS SBS | OFFICIAL-SENSITIVE | T2 |
| NHS Trust Digital / CIO | H8 (Trust level) | G-Cloud 14 / NHS SBS | DSPT + OFFICIAL | T1/T2 |
| Health AI Startup / SME | H6 / H5 | G-Cloud 14 / DASA health | DSPT + OFFICIAL | T1 |
| Genomics / Research | H9 / H5 | NIHR / Direct | OFFICIAL-SENSITIVE / SC | T2 |