CPV 48-1 Software packages

About CPV 48-1

CPV 48-1 is the Common Procurement Vocabulary group covering software packages and information systems within division 48. It is the licensed product half of public sector technology: software bought rather than built.

The group covers business and line-of-business applications, enterprise resource planning and finance systems, human resources and payroll systems, customer relationship and case management platforms, document and records management, geographic information systems, specialist sector applications, and increasingly software as a service subscriptions.

The commercial model in this group has shifted almost entirely from perpetual licensing to subscription, which has changed procurement more than it might appear. A subscription is a recurring service commitment rather than a one-off purchase, so buyers now assess supplier viability, exit arrangements, and data portability far more carefully than when they owned a licence outright.

Active CPV 48-1 tenders

Legacy system replacement is the dominant driver. Public bodies are moving off ageing on-premise applications, often ones that have been in place for a decade or more, and the resulting procurements are among the most substantial technology purchases they make.

Specialist sector applications form a steady stream: housing management, revenues and benefits, social care case management, planning and land charges, education management, and clinical systems each have their own established supplier base and their own replacement cycles.

Active sub-category	Typical procurement route	Primary buyer pattern
Line-of-business applications	Open procedure or framework	Council, NHS body, agency
Cloud and SaaS subscriptions	G-Cloud call-off	Any public body
Enterprise finance and HR systems	Major competitive procedure	Large council or department
Case and document management	Framework or open procedure	Council, department, regulator
Specialist and clinical systems	Sector framework or bespoke	NHS body or specialist buyer

Top buyers procuring CPV 48-1

In our own corpus the University of Glasgow, Renfrewshire Council, NHS England, the University of Edinburgh, the University of Aberdeen, and the Ministry of Defence are among the more frequent publishers under this group.

The prominence of universities reflects a genuine pattern: higher education buys a wide range of specialist software, from research computing and library systems to student records and learning platforms, and procures it visibly. Local government buys line-of-business systems across a large number of service areas. NHS bodies buy clinical and administrative systems with additional safety and information governance requirements.

Typical contract values under CPV 48-1

The median notice sits around six hundred thousand pounds, and the upper decile reaches into the tens of millions. Values usually represent the full term including support and any extension options, so a headline figure covering seven years should be divided before comparing it with an annual budget.

Suppliers should note that software procurements frequently bundle licensing, implementation, integration, data migration, training, and support, and the licence is often the smaller part. That is why the same procurement may be coded here or under IT services depending on where the buyer thinks the balance lies, and why a supplier competing on licence price alone frequently misjudges what is being evaluated.

Compliance and certifications for CPV 48-1 bidders

Security certification is baseline: Cyber Essentials Plus for anything touching public data and ISO 27001 for platforms holding data at scale. Where the software is hosted, buyers assess the hosting arrangements, data location, and the security of the underlying infrastructure as part of the supplier assessment.

Accessibility conformance to the specified WCAG level is a legal requirement for public sector digital services, and buyers increasingly ask for a published accessibility statement and evidence of testing rather than a declaration. Health sector software requires the Data Security and Protection Toolkit, and clinical systems require compliance with clinical safety standards including a named clinical safety officer and a documented hazard log. Data protection obligations require clear processing terms, and buyers examine sub-processor arrangements and international transfer positions closely. Exit and data portability provisions have become a standard requirement, with buyers wanting contractual commitment to data extraction in a usable format at the end of the term.

Frequently asked questions

Is G-Cloud the right route for a software product?

For subscription software with published pricing, usually yes. G-Cloud lets buyers find and call off cloud software without running a full competition, and it refreshes frequently enough that a supplier is rarely far from the next opportunity to join. It suits products a buyer can evaluate from a clear service description and price. It suits complex line-of-business systems less well, because those involve implementation, integration, and data migration that a catalogue call-off does not capture, and buyers usually run a full competition for them regardless of whether the product is listed.

Why is the same product sometimes tendered under IT services instead?

Because the buyer judged the services element to outweigh the licence. A line-of-business system replacement involving substantial configuration, integration with other systems, and migration of years of data is as much a delivery project as a purchase, and many buyers code it accordingly under CPV 72. There is no reliable rule and practice varies within the same organisation. Any software supplier whose sales involve meaningful implementation should monitor both codes and both parent divisions.

How much do exit and data portability terms matter now?

Considerably more than a few years ago, and they are frequently scored. Buyers have experienced the cost and difficulty of leaving a supplier whose contract did not oblige them to hand back data usefully, and they now require clear commitments on format, timescale, assistance, and cost at exit. Suppliers who resist these terms or price exit assistance aggressively are penalised. Offering straightforward, contractually committed data portability has become a genuine competitive advantage rather than a concession.

Can a smaller software vendor compete against established sector suppliers?

It is difficult in the entrenched line-of-business markets, where a handful of suppliers hold most of the installed base and buyers are cautious about migration risk. It is considerably easier in newer categories, in point solutions that complement rather than replace core systems, and through G-Cloud where the barrier to being considered is low. The most effective route for a smaller vendor is usually to solve a specific problem well and integrate with the incumbent core system, rather than to compete for wholesale replacement where the buyer's main concern is the risk of migration failure.