DEFONEOS is the UK-sovereign AI substrate that NHS trusts board-side, integrated-care boards ICB-side, and private-provider-side. EU AI Act + GDPR Art 9 (special category) + DPA 2018 + DTAC + UK Health + HIPAA-mapped. 94-98% cheaper than Epic/Cerner/Palantir.
NHS Trusts spend 6-18 months procuring AI through corporate frameworks (NHS SBS, HealthTrust Europe, NHS SCW). Each Trust then negotiates with Epic/Cerner/Palantir on 5-year master agreements at £2-£8M upfront. By the time it reaches pilot, you have £500K sunk into procurement, zero deployed value, and an EU AI Act deadline breathing on the Trust board.
DEFONEOS cuts this to 14 days: the substrate is MIT-licensed, UK-sovereign, signed, and Article 9 (special category) handling is built in by design. The substrate is auditable through NHS Digital's DTAC pathway. You get sovereign-by-construction AI without the vendor lock-in, and you get the audit packet a Trust board demands.
The problem. MRI scan triaging needs AI-assist to clear 14-day waitlists. Current procurement: 9-month tender, £200-400K capex. Current risk: special-category data (radiology images linkable to patient) requires explicit Art 9 justification + DPIA.
What DEFONEOS does. Sovereign radiology triage on UK M4 Mac + GCP UK. SIGIL-signed per-image with Art 9 consent trail. DPIA pre-baked from NHS template. Audit pack ready for board in 14 days.
The problem. ICBs need population-health analytics (predict readmission risk, optimise prescribing) for 1.5M patients. Current pipelines: vendor SaaS, opaque, foreign-sovereign, NHS Digital DTAC-blocking.
What DEFONEOS does. Cohort analytics with explicit Art 9 basis (research/healthcare provision), BFT 23/33 governance over model outputs, OSCAL attestor that publishes the model lineage. Auditable end-to-end.
The problem. Multi-site RCTs (Phase II/III) need AI-assisted adverse-event detection across 5-15 sites in 3+ countries. Each site has its own consent regime, IRB, GDPR/DPA 2018 enforcement. Trial AI must be auditable AND federated.
What DEFONEOS does. Multi-region sovereign deployment (UK + EU + AUKUS-Canada-Australia). Each site's data stays put; only model checkpoints cross borders (with SIGIL consent). AUKUS-compatible for trans-Pacific trials.
| Decision | Question | DEFONEOS answer | Evidence |
|---|---|---|---|
| DATA | Special-category handling? | GDPR Art 9 explicit basis (consent / research / healthcare provision); SIGIL-tracked per-record | /defoneos-data-governance · Art 9 + Recital 33 |
| DTAC | NHS Digital assessment ready? | DTAC-aligned evidence: clinical safety, data protection, security, interoperability | /defoneos-system-card · DTAC core requirements met |
| SAFETY | Risk management for clinical use? | Art 9 RMS, 7-step lifecycle, 42 hazards, ISO 14971-aligned | /defoneos-risk-management |
| RECORDS | Audit trail for board / CQC / ICO? | Ed25519 SIGIL chain, 6mo hot / 5yr cold / indefinite WORM | /defoneos-record-keeping · Art 12 |
| DPIA | Article 35 DPIA on standby? | Pre-baked NHS DPIA template + Art 9 basis matrix | /defoneos-fria · NHS Digital-aligned |
| SOVEREIGNTY | UK-only data residency? | UK M4 Mac + GCP UK only. No foreign cloud. Article 50(5) covered. | /defoneos-sovereignty |
Cross-walked in the substrate. Each framework has its own evidence page with citations to relevant articles, controls, and clauses.
Free 30-day sandbox for Trust pilots. Pre-baked NHS DPIA template. UK-sovereign compute. SIGIL-signed per-record. Reply within 24h.
procurement@csoai.org · +44 (0)20 7946 0958 · Try free at /defoneos-signup-hub