Written evidence submitted from Sammy Harris (PMA0085)

About the submitter

I am CEO and co-founder of Stealth Labs Ltd, an AI engineering consultancy delivering AI systems into UK central government, including HMRC, the National Crime Agency, and the Foreign, Commonwealth and Development Office. I previously served as Head of Cloud Platform at FCDO, managing £8 million programmes, and before that worked in Ministry of Defence cyber operations and at Microsoft as Azure AI Lead for Regulated Industries.

I write The Government AI Gap, a Substack newsletter on AI procurement in the UK public sector.

This submission is made in a personal capacity. It draws on direct, recent experience of selling and delivering AI into UK central government departments, and on previous experience as a government buyer of digital services.

Use of generative AI

Generative AI (Claude, by Anthropic) was used to assist in drafting this submission. I have reviewed every paragraph, the arguments are my own, and I take full responsibility for the contents.

Questions addressed

This submission focuses on Question 5 (systemic barriers to deployment), Question 8b (fragmentation and ownership), and briefly on Question 4b (risk of SMEs moving overseas). I have nothing useful to add on genomics, regulatory specifics of the MHRA, or the health economics of novel therapies, and defer to subject matter experts on those.

Summary and key recommendations

The core argument of this submission:

•        The NHS is about to repeat procurement mistakes that the rest of UK central government has already identified and is partway through fixing. The lessons exist. They are not being transferred.

•        Three specific mechanisms from cross-government digital procurement should be extended to NHS innovation: discovery-before-build separation (the Digital Outcomes and Specialists model), pre-cleared dynamic purchasing systems (the Crown Commercial Service AI DPS approach), and accredited direct-award routes for urgent innovation.

•        The single biggest barrier to SME-led innovation reaching the NHS at scale is not regulation, workforce, or IT infrastructure. It is framework architecture. Framework entry windows lock innovators out for 12 to 18 months at a time. A supplier approved to sell AI to HMRC today often cannot sell the same capability into an NHS trust tomorrow without starting from scratch.

•        Fragmentation between trusts, ICBs, and national bodies means the same supplier has to re-prove itself dozens of times. Cross-government frameworks solved a version of this in 2012. The NHS largely sits outside them.

•        The prime-contractor model dominant in health-tech procurement bakes in delay and cost. Innovators end up as subcontractors two or three layers down, which is where good work goes to die.

•        The failure mode is not new. Previous reforms did not fail because they were wrong. They failed because they were designed by people who did not have to live with their own procurement outcomes.

Policy recommendations in short:

•        Extend Crown Commercial Service frameworks, in particular the AI DPS and Digital Outcomes, to explicit use by NHS England and ICBs, with ring-fenced innovation budgets routed through them.

•        Treat cross-government procurement and supplier assurance as automatic qualification for NHS innovation procurement, subject to clinical-safety checks. Stop making accredited suppliers reprove themselves from scratch.

•        Fund and staff a small, genuinely empowered NHS innovation procurement capability, modelled on the Government Digital Service between 2011 and 2016. A delivery team with a budget and a mandate, not a policy team.

•        Publish a single ownership map for NHS innovation adoption. If it is too complicated to publish, that is itself the finding.

•        Give named Senior Responsible Owners of innovation pilots explicit air cover to fail on small things. Without this, no genuine innovation pilot will ever be signed off.

On Question 5: systemic barriers to deployment

1.              I have sold and delivered AI into HMRC, the National Crime Agency, and the FCDO inside the last twelve months. The pattern is the same every time. The NHS will recognise very little of it, because the NHS does not buy through the same routes as the rest of central government. That, in itself, is the problem.

2.              The single biggest barrier in my direct experience is not procurement as a concept. It is the framework cycle. UK central government buys most digital and AI work through frameworks such as G-Cloud, the Digital Outcomes and Specialists framework (DOS), and the newer Crown Commercial Service AI Dynamic Purchasing System (AI DPS). These open for new suppliers roughly every 12 to 18 months. Miss a window by a day and you are locked out for over a year.

3.              G-Cloud in 2012 was a genuine reform. It let SMEs sell into government without needing a decade of track record. Over the next ten years, the door gradually closed again. The current patchwork is still more accessible than what preceded it, but it now concentrates contracting power with suppliers who can afford a permanent bid team. That is not what it was designed to do.

4.              Health procurement is worse. Most NHS innovation buying still flows through long-cycle OJEU-style tenders, through trust- or ICB-level procurement, or through prime contractors bundling SME capability into wider systems-integration deals. An AI SME already delivering live into HMRC cannot easily sell the same capability into an NHS trust without finding a prime to carry it, or starting a brand-new procurement from cold. There is no good reason for this.

5.              The second major barrier is the gap between a pilot that works and a contract that buys it. I have written about this at length in The Government AI Gap. Successful pilots die because the budget cycle was missed by three weeks, because the SRO moved jobs, because security accreditation was never scoped, because nobody could write the business case in the language the finance team needed. None of these failures are about the technology. They are about the system the technology has to survive.

6.              The third barrier is risk aversion at the level of the individual buyer. A senior civil servant or NHS commissioner who picks a small, innovative supplier and fails is career-damaged. One who picks a known large supplier and fails is largely covered. Until that asymmetry is addressed, the default choice will always be the slow, safe option, even when the slow option is demonstrably worse for patients.

7.              Previous attempts to address these barriers have not wholly succeeded for a reason that is rarely written down. The reforms are designed by people who do not personally have to live with the procurement outcomes they produce. The buyer who drafts the framework rarely has to use it. The supplier who uses it has no real voice in how it is written. This is fixable, but only if the drafting is opened up to practitioners on both sides.

Recommendations against Question 5

8.              Extend Crown Commercial Service frameworks, in particular the AI DPS and the Digital Outcomes framework, to explicit use by NHS England, NHS trusts, and Integrated Care Boards, with ring-fenced innovation budgets routed through them. In my estimate this alone would collapse time-to-contract by months in a significant number of cases, at very low implementation cost.

9.              Fund and staff a small, genuinely empowered NHS innovation procurement capability modelled on the Government Digital Service as it was between 2011 and 2016. Not a policy team. Not a strategy unit. A delivery team with a budget, a mandate to buy, and the ability to say no to bad procurement.

10.              Protect the SRO. If a named senior official is accountable for an innovation pilot, give them explicit written air cover to fail on small things, signed off at permanent secretary level or equivalent. Without this, no genuine innovation pilot will ever be signed off in practice, regardless of what the policy documents say.

On Question 8b: fragmentation and ownership

11.              It is currently unclear, to the point of absurdity, who owns NHS innovation adoption. Genomics England has one remit. NIHR has another. NHS England operates as a fourth. Individual trusts buy at their own risk. ICBs overlay another set of priorities. The Cell and Gene Therapy Catapult sits alongside. DSIT has a view. DHSC has a view. MHRA and NICE gate separately. Each of these is necessary. The combination is not workable.

12.              From the supplier side, this looks like twenty doors, all slightly ajar, none of them leading to the same room. Rational innovators, especially those with international options, stop trying to find the right door and leave.

13.              The cross-government position is not perfect, but it is markedly clearer. A UK AI SME with a G-Cloud listing, an AI DPS accreditation, and the appropriate supplier assurance in place has a coherent route into HMRC, the Ministry of Defence, the Home Office, and beyond. The NHS should have something comparable. It does not.

14.              The specific recommendation is to treat cross-government procurement and supplier assurance as a basis for automatic NHS accreditation where standards align. An AI supplier already approved to work with one central government department should not need to reprove itself from scratch to process pseudonymised NHS data for an approved pilot. Clinical-safety checks are obviously additional and non-negotiable. But the general commercial and assurance due diligence can and should be reused.

15.              A further recommendation: publish a single ownership map. For each category of NHS innovation, meaning AI software as a medical device, diagnostics, personalised therapies, and data infrastructure, name the single accountable body, the primary procurement route, the regulatory path, and the expected timeline. If the map is too complicated to publish on one page, that is the finding. Fix the map before buying any more.

On Question 4b: risk of SMEs moving overseas

16.              This is adjacent to my core experience, so I offer it briefly. UK AI SMEs delivering into regulated sectors, including central government, talk constantly about whether it is worth staying. The procurement pain is real and sustained. The alternative, selling into US or EU customers, is often genuinely faster even when accounting for the additional complexity of operating abroad.

17.              The gap between the UK's life-sciences research strength and its commercial translation into NHS deployment is not primarily a research funding problem. It is a procurement and accreditation problem. Fix the routes to market and retention improves almost immediately. Leave them as they are and the pattern of research here, deploy elsewhere, will continue.

Conclusion

18.              The Committee will rightly hear detailed expert evidence on the science of personalised medicine, the regulatory position of the MHRA, and the health economics of novel therapies. I have no expertise to add on those.

19.              What I can offer is that the procurement and adoption problems the NHS is now grappling with have close analogues across the rest of UK central government, and that real, tested work already exists on those analogues. Before the Committee recommends new NHS-specific innovation mechanisms, I would urge it to ask why existing Cabinet Office, Crown Commercial Service, and Government Digital Service routes cannot be extended or adapted. In most cases the answer will be that nobody has yet asked the question.

20.              I would be glad to give oral evidence if it would be useful to the Committee, and I can provide further detail on any of the points above on request.