CPV 48 Software packages and information systems

About CPV 48

CPV 48 is the Common Procurement Vocabulary division that covers software packages and information systems. Anything that a UK public-sector buyer treats as productised software, whether installed on premises, hosted in a private cloud, or consumed as Software as a Service, sits inside this CPV division. CPV 48 sits next to CPV 72 (IT services), and many software-led procurements carry both codes: 48 as primary for the underlying product, 72 as secondary for the implementation and support services around it. The division splits into groups including 48-1 (software packages and information systems generally), 48-2 (network and Internet software), 48-3 (utility-style office and document software), 48-4 (project management software), 48-5 (communications software), 48-6 (database management), 48-7 (operating systems), 48-8 (industry-specific software), and 48-9 (assorted miscellaneous packages).

The buyers using CPV 48 sit across every tier of UK government. Departments procure ERP, HR and finance platforms, document and records management. NHS trusts and ICBs procure Electronic Patient Record systems, e-prescribing platforms, and clinical decision support. Local authorities procure social care case management, planning systems, revenues and benefits, and integrated council platforms. Universities procure student records, library management, and research administration systems. Police forces procure records management, intelligence platforms, and case file systems. Crown Commercial Service operates G-Cloud as the primary route for cloud-hosted software procurement, with bespoke open competitions still used for the largest enterprise applications.

Active CPV 48 tenders

The active pipeline under CPV 48 is substantial and ongoing. Electronic Patient Record competitions are running across NHS trust geographies under the national Frontline Digitisation funding programme. Local authority digital transformation programmes drive recurring software procurement, particularly for revenues, benefits, social care, and customer-relationship-management systems. The Department for Work and Pensions periodically refreshes its core service-delivery platforms. Police forces are refreshing core records and intelligence systems under the National Enabling Programmes. The Ministry of Justice procures case management and digital justice systems on a multi-year refresh cycle. SaaS procurements through G-Cloud are continuous, with call-off competitions appearing daily across the public sector.

Active sub-category	Typical procurement route	Common procedure
Cloud SaaS call-offs	G-Cloud framework	Further competition or direct award
Electronic Patient Records	Bespoke open competition	Competitive flexible procedure
Local authority core systems	Bespoke restricted	Restricted procedure with site visits
Police digital programmes	Joint procurement	National Enabling Programme route
Document and records	G-Cloud or bespoke	Mini-competition

Top buyers procuring CPV 48

The volume leaders under CPV 48 cover the digital-heavy parts of UK government. The Department for Work and Pensions runs the largest software-procurement programme by aggregate value, covering benefits delivery platforms, employer-facing services, and the operational platforms that handle 20 million ongoing payment relationships. NHS England and the largest NHS trusts procure EPR and clinical platforms at considerable scale. Local authorities, particularly large unitary councils and metropolitan boroughs, run continuous software procurement programmes. The Home Office procures border, immigration, and policing platforms. HM Revenue and Customs procures tax administration platforms. The Ministry of Defence procures specialist software ranging from logistics to mission-system applications. Universities collectively procure significant software volumes through Jisc collaborative agreements.

Typical contract values under CPV 48

CPV 48 contracts span four orders of magnitude in value. G-Cloud call-offs for individual SaaS subscriptions are commonly in the 5,000 to 250,000 pound annual range, with multi-year terms producing total contract values up to 1 million pounds before the typical four-year maximum framework call-off ceiling. Mid-range departmental software procurements (single application, single buyer) typically run 500,000 to 10 million pounds over a five-year term including implementation and support. Large enterprise application procurements, such as a full ERP refresh for a major government department or a multi-trust EPR programme, regularly exceed 50 million pounds in total contract value, with the largest reaching several hundred million pounds across the lifetime of the agreement.

Compliance and certifications for CPV 48 bidders

Software-procurement competitions carry distinct compliance requirements. Cyber Essentials Plus is the universal entry point: nearly every public-sector software competition requires CE+ as a Selection Questionnaire pass criterion. ISO 27001 (information security management) is requested on most mid-range and above competitions, with some sensitive buyers requiring full UKAS-accredited certification rather than self-attestation. Data Protection Impact Assessment readiness and full UK GDPR compliance are universal for any system processing personal data. Hosting accreditation matters: G-Cloud requires data residency declarations; sensitive workloads may require NHS-DSP-Toolkit compliance, Police Assurance Group compliance, or List X status for defence. Accessibility (WCAG 2.1 AA or 2.2 AA) compliance is required for any system with a public-facing or staff-facing user interface under the Public Sector Bodies Accessibility Regulations 2018.

Frequently asked questions

What is the difference between CPV 48 and CPV 72?

CPV 48 covers the software itself (the product, package, or hosted application). CPV 72 covers the IT services around the software (implementation, integration, support, hosting as a service, consultancy, development). Many procurements use both codes: 48 as the primary code for the underlying product and 72 as a secondary code for the services. A pure SaaS procurement on G-Cloud might use 48 alone if the buyer wants only the subscription. A bespoke development project would typically use 72 alone if no off-the-shelf product is involved. A managed-EPR procurement that bundles an EPR product with implementation, integration, and ongoing support would carry both codes.

How do I bid for public sector software contracts under CPV 48?

The primary route is to be approved on G-Cloud, which is the Crown Commercial Service framework covering cloud-hosted software. G-Cloud is open to applications across multiple lots (cloud hosting, cloud software, cloud support), and approval is a structured application process rather than a competitive tender. Once on G-Cloud, suppliers respond to individual call-off competitions and direct awards published by buyers. For larger enterprise software procurements outside G-Cloud, suppliers respond to bespoke notices on Find a Tender and Contracts Finder. Niche specialist software vendors should also consider sector-specific frameworks such as the NHS Shared Business Services digital lots.

What is the typical procurement timeline for a CPV 48 enterprise software contract?

G-Cloud call-offs can complete in as little as four to eight weeks for direct awards or focused mini-competitions. Bespoke restricted-procedure procurements for mid-range software typically run six to nine months from contract notice to contract award. Major enterprise software procurements using competitive dialogue or the new competitive flexible procedure under the Procurement Act 2023 typically run 12 to 18 months from notice to award, with the largest national programme procurements occasionally running over two years before contract signature. Implementation and go-live periods then sit on top of the procurement timeline.

Are open-source software solutions eligible under CPV 48?

Yes. CPV 48 procurements are technology-neutral on licence model. Buyers can specify open-source software preferences or restrictions in the requirement specification, but the CPV code itself does not exclude open-source or community-source applications. Several major public-sector platforms in the UK are built on open-source foundations or are themselves open-source projects. Suppliers offering open-source-based services should make clear in their tender response how they will provide commercial support, licensing assurance for any embedded third-party components, and an indemnity model that matches the buyer's risk appetite.