Why UK SMEs struggle to deploy into the NHS, and what would help

In 2026 Gateway Global submitted written evidence (reference PMA0121) to the House of Lords Science and Technology Committee on why UK small businesses find it hard to deploy technology into the NHS. This article sets out, in plain terms, what we told the Committee and why.

Why did we deploy in private healthcare first?

We built Prime Assist, our AI voice infrastructure for healthcare, for private practices first. In our evidence we explained why. For a small supplier without large reference customers, the route into the NHS runs through several assurance regimes and many separate buying organisations, and we described a sales cycle of 18 to 24 months as the norm for suppliers in that position.

None of the assurance itself is the problem. Clinical safety under DCB0129 and DCB0160, the Data Security and Protection Toolkit (DSPT) and the Digital Technology Assessment Criteria (DTAC) exist for good reasons, and we work to them. The problem is how often the same work has to be done again.

What is repeated, and why does it matter?

We welcomed the revised DTAC form published by NHS England in February 2026, which reduced duplication with the DSPT. But a product that has passed DTAC is still evaluated again by each integrated care board, trust or primary care network that considers buying it.

That repetition costs a large company little, because it has compliance teams in place. For a small company, each round is a real cost before any revenue arrives. We pointed to one example: many small suppliers retain an external Clinical Safety Officer, a cost that falls on them before they have sold anything.

Why is access to clinical systems the hidden barrier?

A tool that works in primary care has to read from and write to the systems that hold the patient record: EMIS, SystmOne and Vision, and increasingly the NHS Spine and GP Connect. Access to those systems runs through partner programmes operated by the companies that supply them. The commercial terms, onboarding timelines and the scope of what a partner may connect to are agreed privately, supplier by supplier.

The NHS pays for those systems. We argued that a small UK supplier with an assured product should not have to negotiate its own terms to reach them.

What about regulation?

We described the MHRA’s AI Airlock as the right instrument, and said its constraint is throughput. It takes a small number of projects at a time, across every kind of AI in healthcare. Real-time conversational AI, which holds a spoken conversation and updates the clinical record, sits at the edge of existing categories, and the category it falls into decides how it can be deployed.

What did we recommend?

We made four recommendations, each addressed to the bodies that could act on it:

1. One recognised pathway. A single, nationally recognised deployment pathway for small suppliers: one DTAC and clinical safety review, recognised across NHS organisations, with a published commitment on how long decisions take.
2. Published access terms. Standardised, published terms, on a fair, reasonable and non-discriminatory basis, for any UK small supplier with a DTAC-assured product to connect to the NHS Spine, GP Connect, EMIS, SystmOne and Vision.
3. A permanent AI Airlock. A regular, published quarterly intake for the AI Airlock, open to real-time conversational AI and to predetermined change control plans for AI that is updated over time.
4. Recognition of the infrastructure layer. Recognition of UK voice AI infrastructure within the government’s Sovereign AI Unit, so that the layer underneath clinical applications is treated as a category in its own right.

How does this shape our work?

We build to the standards we asked the Committee to keep. Prime Assist has a clinical safety case under DCB0129, signed off by our Clinical Safety Officer, who works alongside our engineers rather than in a separate review queue. And we continue to open a route into the NHS, one assurance step at a time.

You can read our summary of the evidence, or the evidence itself as published by Parliament.