12 UK transport entry points · 8 transport AI priorities · 6 transport DEFONEOS MCPs · DfT digital backbone
The Department for Transport (DfT) oversees £32B annual spend across Network Rail (£21B), National Highways (£4.8B), DVLA, DVSA, the Maritime & Coastguard Agency, and the Driver & Vehicle Standards Agency. The UK Critical National Infrastructure (CNI) designation covers transport (Sector 6) — meaning AI systems in rail signalling, traffic management, port operations, and aviation are subject to the highest governance standards. The DfE's Transport AI Strategy (2025-2027) mandates audit-grade AI governance for autonomous vehicles, predictive maintenance, and logistics optimisation.
DEFONEOS provides DfT agencies, Network Rail, National Highways, port authorities, and transport tech developers with a UK-sovereign, BFT-governed, audit-grade AI operating system purpose-built for transport resilience at the OFFICIAL / OFFICIAL-SENSITIVE boundary. This pack maps 12 transport procurement entry points, cross-references 8 transport AI priorities to DEFONEOS MCP coverage, and demonstrates the DfT digital backbone architecture.
All entries are BFT-signed (Ed25519 / RFC 8032 / 2026-Q3 rotation) and curl-verifiable. Per-entry contacts sourced from DfT Digital & Technology (2026-Q1) + CCS transport procurement pipeline.
| # | Entry point | Location | Transport function | DEFONEOS fit |
|---|---|---|---|---|
| T1 | DfT — Digital & Technology | London | National transport AI strategy · digital transformation · CNI oversight | DEFONEOS MCPs: bft-council-probe · mcp-cspm — BFT-governed AI policy compliance + national transport data governance |
| T2 | Network Rail — Digital Railway | London / Regional | Rail signalling AI · predictive maintenance · ETCS digital signalling | DEFONEOS MCPs: bft-council-probe · mqtt-bridge · mcp-dynamic-sbom — BFT rail AI audit + track IoT + signalling SBOM |
| T3 | National Highways — Operations | Birmingham / Regional | Motorway AI · traffic management · incident detection · smart motorways | DEFONEOS MCPs: bft-council-probe · mqtt-bridge · rtsp-camera — BFT traffic AI audit + roadside IoT + CCTV pipeline |
| T4 | DVLA — Digital Services | Swansea | Vehicle registration AI · licence processing · fraud detection | DEFONEOS MCPs: bft-council-probe · mcp-cspm — BFT DVLA AI governance + identity data compliance |
| T5 | DVSA — Testing & Enforcement | Swansea / Regional | MOT AI · driving test scheduling · vehicle compliance AI | DEFONEOS MCPs: bft-council-probe · mcp-dynamic-sbom — BFT testing AI audit + vehicle inspection SBOM |
| T6 | Maritime & Coastguard Agency (MCA) | Southampton | Vessel tracking · SAR coordination · port state control | DEFONEOS MCPs: aisstream-maritime · bft-council-probe · mqtt-bridge — Maritime AIS + BFT maritime AI governance |
| T7 | Civil Aviation Authority (CAA) | London / Gatwick | Aviation safety AI · airspace management · drone regulation | DEFONEOS MCPs: bft-council-probe · mcp-cspm · mcp-dynamic-sbom — BFT aviation AI governance + airspace SBOM |
| T8 | Transport for London (TfL) | London | London transport AI · Underground / bus optimisation · congestion AI | DEFONEOS MCPs: bft-council-probe · mqtt-bridge · mcp-cspm — BFT TfL AI audit + London IoT pipeline |
| T9 | Major Port Operators (ABP / Peel / Forth Ports) | Regional | Port logistics AI · container management · autonomous vehicles | DEFONEOS MCPs: aisstream-maritime · mqtt-bridge · bft-council-probe — Port AIS + dock IoT + BFT port AI governance |
| T10 | Rail Delivery Group / Train Operators | London / Regional | Timetable AI · passenger flow · demand prediction | DEFONEOS MCPs: bft-council-probe · mqtt-bridge · mcp-cspm — BFT rail operator AI audit + station IoT |
| T11 | Connected & Autonomous Mobility (CAM) Hub | Coventry / London | Autonomous vehicle testing · V2X communication · CAV certification | DEFONEOS MCPs: bft-council-probe · mcp-dynamic-sbom · mqtt-bridge — BFT CAV AI governance + V2X SBOM + vehicle IoT |
| T12 | DfT Science & Technology (S&T) | London | Transport research · resilience planning · multi-modal AI | DEFONEOS MCPs: bft-council-probe · mcp-cspm · mcp-dynamic-sbom — BFT research AI governance + transport data compliance |
| # | Transport AI priority | Lead body | DEFONEOS MCP coverage | Alignment cross-walk |
|---|---|---|---|---|
| F1 | Rail signalling & predictive maintenance AI | Network Rail / RSSB | bft-council-probe · mqtt-bridge · mcp-dynamic-sbom | Railway Safety Regulations · RSSB Standards · EN 50126/50128/50129 (RAMS) |
| F2 | Traffic management & smart motorway AI | National Highways / DfT | bft-council-probe · mqtt-bridge · rtsp-camera | Road Traffic Act · Traffic Signs Regulations · DfT Traffic Management Act |
| F3 | Maritime safety & autonomous shipping AI | MCA / IMO / DfT | aisstream-maritime · bft-council-probe · mqtt-bridge | SOLAS Convention · MCA M-Notice · IMO MSC Circulars · UK Maritime 2050 |
| F4 | Aviation safety & airspace AI | CAA / NATS / DfT | bft-council-probe · mcp-cspm · mcp-dynamic-sbom | CAA CAP 722 (UAS) · EASA AI Roadmap · UK Air Navigation Order |
| F5 | Connected & autonomous vehicle AI | Zenzic / CCAV / DfT | mcp-dynamic-sbom · bft-council-probe · mqtt-bridge | Automated Vehicles Act 2024 · UNECE WP.29 · BSI PAS 1880/1881 |
| F6 | Port & logistics optimisation AI | ABP / Peel / MCA | aisstream-maritime · mqtt-bridge · bft-council-probe | Port Marine Safety Code · UK Port Strategy · ISPS Code |
| F7 | Passenger experience & accessibility AI | TfL / RDG / DfT | bft-council-probe · mcp-cspm | Equality Act 2010 · DfT Inclusive Transport · Accessible Information Regulations |
| F8 | Transport digital backbone & CNI resilience | DfT Digital / NCSC | All 30 MCPs (federated transport pipeline) | DfT Digital Strategy · NCSC CNI Cyber · NIS Regulations 2018 · ISO 42001 |
| # | MCP | Category | Transport deployment | Key capability |
|---|---|---|---|---|
| M1 | bft-council-probe | Core | All 12 transport entry points | 33-agent BFT defence council · quorum-gated transport AI decision audit |
| M2 | mcp-cspm | Compliance | DfT · CAA · DVLA compliance | Cloud security posture management · DfT data governance · CNI compliance |
| M3 | mcp-dynamic-sbom | Compliance | Rail signalling · aviation · CAV supply chain | Real-time SBOM generation · safety-critical software supply chain assurance |
| M4 | mqtt-bridge | Sensor | Track-side IoT · roadside sensors · port sensors · V2X | IoT sensor bridge · MQTT sovereign data ingest · transport infrastructure network |
| M5 | aisstream-maritime | Sensor | Maritime vessel tracking · port operations · SAR | Global AIS vessel tracking · sovereign maritime domain awareness |
| M6 | rtsp-camera | Sensor | Road CCTV · station platforms · port quayside | IP camera ingest · sovereign video pipeline (OFFICIAL-SENSITIVE with authority) |
| DfT Component | Role | DEFONEOS integration | MCP coverage |
|---|---|---|---|
| DfT Digital & Technology | National transport AI policy | BFT-governed AI policy compliance + CSPM monitoring | mcp-cspm · bft-council-probe |
| Network Rail Digital Railway | ETCS digital signalling | SBOM + BFT audit trail for safety-critical rail systems | mcp-dynamic-sbom · bft-council-probe · mqtt-bridge |
| National Highways IOC | Motorway operations centre | Roadside IoT BFT governance + CCTV pipeline | bft-council-probe · mqtt-bridge · rtsp-camera |
| NCSC Transport CNI | CNI cyber resilience | CNI BFT governance + transport sector cyber monitoring | bft-council-probe · mcp-cspm |
| DfT Science & Technology | Transport research | BFT research governance + multi-modal data compliance | bft-council-probe · mcp-dynamic-sbom · mcp-cspm |
| Step | Action | Who | Time | Prerequisite |
|---|---|---|---|---|
| 1 | Identify transport cluster (Rail / Highways / Maritime / Aviation / CAV / Port / Passenger / CNI) | Buyer | 15 min | This compliance pack §2 |
| 2 | Confirm procurement vehicle (DfT direct / G-Cloud 14 / CCS / Network Rail) | Buyer + CSOAI | 30 min | Framework checklist |
| 3 | Confirm data governance boundary (UK GDPR / NIS Regs / Rail Safety / Aviation Security) | Buyer + CSOAI | 1 hour | SC clearance guide |
| 4 | Submit transport pilot request (Rail-specific / highway-wide / port / aviation) | Buyer | 1 hour | DSP tracker |
| 5 | CSOAI provisions transport-region sovereign VM + DEFONEOS substrate | CSOAI | <24 hours | AG-1: curl -s /health HTTP 200 |
⚠️ HARD RED-LINE: DEFONEOS handles OFFICIAL and OFFICIAL-SENSITIVE data ONLY. DEFONEOS does NOT provide safety-critical operational control (SIL4 rail signalling, live traffic signal control, vessel collision avoidance, or aircraft flight control). DEFONEOS provides governance, compliance monitoring, and SBOM assurance for transport AI systems — the operational control data flows through accredited NIS-compliant CNI channels. BFT council decisions are audit metadata, not operational commands. Any DEFONEOS deployment touching CNI must be independently assessed by the relevant sector regulator (ORR / CAA / MCA) before operational use.
| Buyer type | Entry point | Procurement vehicle | Security requirement | Pilot tier |
|---|---|---|---|---|
| DfT Digital & Technology | T1 | DfT direct / G-Cloud 14 | OFFICIAL-SENSITIVE / SC | T3 |
| Network Rail Route | T2 | NR Framework / G-Cloud 14 | OFFICIAL-SENSITIVE / SC / ORR | T2/T3 |
| National Highways Regional | T3 | G-Cloud 14 / CCS | OFFICIAL-SENSITIVE | T2 |
| Port Authority | T9 | G-Cloud 14 / direct | OFFICIAL / ISPS | T1/T2 |
| Train Operating Company | T10 | G-Cloud 14 / RDG | OFFICIAL-SENSITIVE | T2 |
| CAV / Autonomous Vehicle SME | T11 | G-Cloud 14 / Zenzic | OFFICIAL | T1 |
| Aviation Operator / Airline | T7 | G-Cloud 14 / CAA | OFFICIAL-SENSITIVE / SC | T2 |