For contracting authorities managing parts of the UK’s £385 billion annual public spend, this legislation introduces a series of legally mandated, data-intensive reporting obligations. These new duties, enforced through a Government Central Digital Platform, create an unprecedented need for robust, auditable data throughout a contract’s lifecycle, rendering traditional, manual assurance methods obsolete and a source of significant compliance risk.
The Act’s requirements are particularly challenging for complex infrastructure projects. For any contract valued over £5 million, authorities must now publish annual performance reports against a minimum of three Key Performance Indicators (KPIs), including details of any supplier breaches (Section 71). Furthermore, they must publish biannual “Payments Compliance Notices” (Section 69), detailing their adherence to 30-day payment terms throughout the supply chain. Fulfilling these duties requires a continuous stream of objective, verifiable data. Manual, sample-based auditing is simply incapable of providing the comprehensive, real-time assurance needed to generate these legally binding public notices without exposing the authority to legal challenges and reputational damage. This challenge is amplified when using sophisticated contracts like the NEC4 suite, whose cost-reimbursable mechanisms are notoriously difficult to assure manually at scale.
To meet this new reality, contracting authorities require a specialised technological solution. Our Digital Cost Assurance emerges as a unique Software-as-a-Service (SaaS) offering in the market, purpose-built to address the specific compliance challenges of the Procurement Act, particularly for projects let under NEC4 contracts.
What distinguishes our platform from generic financial, or auditing software is its deep, native alignment with the commercial logic of the NEC4 contract. Developed in partnership with major UK infrastructure clients like National Highways, the system’s rules engine is designed to understand and automatically apply the specific terms of the contract. It automates the analysis of 100% of Defined Cost data against the contract’s definition, creating a “single source of truth” that is both consistent and fully auditable. This is a capability that traditional, human-led services, which rely on sampling, cannot replicate.
This unique, contract-aware automation provides a direct technical solution to the Act’s most demanding requirements. The platform’s ability to process millions of lines of cost data in hours, not weeks, and flag any discrepancies against the contract rules, generates the objective, unimpeachable evidence trail required to populate the new notices.
Our Digital Cost Assurance is not merely a data analysis tool; it is a comprehensive compliance framework delivered as a service. It ingests raw cost data directly from contractor systems, applies the specific rules of the NEC4 contract, and produces the clean, auditable outputs necessary for public reporting, making it a singular offering in the GovTech market.
While driven by the need for compliance, the adoption of our platform delivers significant strategic benefits. The ability to assure 100% of costs in real-time provides unprecedented financial control, de-risking major projects and enhancing budget certainty. Early testing on a major project identified that up to 19% of costs were potentially improper payments, highlighting the platform’s power to deliver substantial value for money. By creating an objective, data-driven basis for commercial management, the system reduces disputes and fosters more collaborative, trust-based relationships between clients and suppliers.
In the new era defined by the Procurement Act 2023, digital assurance is no longer a discretionary investment but an operational necessity. For public bodies managing high-value infrastructure projects under NEC4 contracts, our Digital Cost Assurance stands alone as a unique and indispensable SaaS solution, offering the most direct and effective path to not only ensure compliance but also to achieve a higher standard of commercial excellence and stewardship of public funds.
From NHS ransomware attacks to the Royal Mail being frozen out of global operations, cyber threats are no longer theoretical – they’re national disruptions. As attacks grow more targeted, stealthy, and sophisticated, the UK Government is taking a bold step to plug the legislative gaps and put resilience on the boardroom agenda.
It may come as a surprise, but most cyberattacks don’t happen at 10 am on a Tuesday.
More often, they happen when your teams are offline: when your SOC is running on minimal staffing, when an alert gets buried under hundreds of others.
AI adoption in IT is not uniform. The most advanced tools often require significant investment in licensing, infrastructure and integration. As a result, access to AI capabilities is often dictated by budget, not just technical readiness and expertise.
If your data is exposed on the dark web, but you don’t know about it – can you still be held accountable?
Like many industries and sectors, AI and automation are already changing the structure of IT teams. Routine operational work that used to be handled by junior engineers is increasingly carried out by intelligent systems. That work hasn’t disappeared, it’s just being done without human involvement.
The cyber threat landscape has shifted. Fast.
That means the traditional SOC, reliant on manual triage and static rule sets, is falling behind.
Enter the AI-powered SOC. Not just a nice-to-have, instead a necessary evolution in how we approach cyber defence.
Most organisations expect attacks to come from the outside: a malicious payload, a phishing email, a brute-force attempt at the firewall. But in many cases, the foundations of those attacks were laid weeks or months earlier – quietly, invisibly – through data already circulating on the dark web.
The pace of technological change in IT has never been faster, but it’s becoming a double-edged sword. With businesses racing to unlock the benefits of AI, automation and cloud-native architectures, the gap between the art of the possible and the skillsets on the ground is growing.
Discovering that your organisation’s data is on the dark web can feel like a worst-case scenario – but it’s becoming increasingly common. Here, Roc’s Head of Security Ade Taylor outlines the practical steps to take if you discover that your data, or data related to your organisation, is circulating on the dark web.