A briefing on policy, reform and practical opportunities for commissioners to support digitally mature and resilient adult social care.
Published August 2026
Executive summary
The policy landscape for adult social care commissioning in England is changing quickly. Digital systems, data use, technology-enabled care (TEC) and cyber resilience can help commissioners meet duties on prevention, safe care, information sharing and market sustainability, but they are not statutory duties in their own right. This briefing explains how current legislation, national policy and emerging practice can be turned into practical commissioning expectations for councils and care providers. The move towards neighbourhood health services makes this more important: commissioners will need to think about how care providers, councils, NHS partners and wider local services share information safely, use data well and coordinate support closer to home.
The legal and regulatory context includes the Care Act 2014, CQC assurance, the Health and Care Act 2022, the Procurement Act 2023 and data legislation. Alongside this, commissioners need to draw on policy, guidance and sector frameworks that support implementation. These include Digital working in adult social care: What Good Looks Like, LGA and ADASS support through Partners in Care and Health, Digitising Social Care resources, ADASS and TSA work on preventative TEC, and reforms linked to the Casey Commission and neighbourhood health.
Good-quality data and TEC are important because they can make care more person-centred, evidence-based and responsive. Technology and data systems need to be embedded in everyday practice: resilient, secure and used appropriately. Commissioners can support this by setting clear expectations on data use, access, interoperability and security; building provider capability; and asking how digital tools improve care.
How to use this briefing
Sections 1 to 8 summarise the main policy and assurance issues for digital, data, TEC, cyber resilience and AI. Each section ends with commissioning questions that can be used in market engagement, specifications, contract monitoring or improvement conversations. Sections 9 and 10 then turn those questions into practical actions for providers and commissioners.
-
Care Act baseline
The Care Act 2014 remains the main legal framework for adult social care in England. Its duties on wellbeing, prevention, integration, information and advice, market shaping, cooperation, assessment and meeting eligible needs all matter for digital commissioning. GOV.UK says the care and support statutory guidance is under review because the Health and Care Act 2022 changed parts of the Care Act. Commissioners therefore need to use the Care Act alongside newer policy and assurance guidance.
Digital records, TEC, information sharing tools, data standards and provider support can help councils support independence, prevent crises, improve safety, maintain continuity and coordinate care with health services.
Commissioning questions
- When specifying services, how will commissioners test whether digital records, TEC and information sharing support wellbeing, prevention, independence and continuity?
- How will commissioners use the What Good Looks Like framework for local authorities and care providers to shape market engagement, specifications and contract review?
- How will commissioners check whether technology improves safe care without creating digital access barriers?
- What requirements will ensure choice, control, equality and accessible digital information are built into commissioned services?
-
Assurance
CQC’s local authority assurance framework looks at how well councils perform adult social care duties under Part 1 of the Care Act 2014. It uses nine quality statements across four themes: working with people, providing support, ensuring safety within the system, and leadership. Digital records and data can help evidence needs, outcomes, care provision, partnership working, risk and learning.
CQC does not assess “digital maturity” as a standalone category. However, digital records, data quality, safe information sharing, cyber resilience and TEC can support evidence on integration, continuity, safe systems, governance and improvement.
Assurance also happens through contract monitoring. Provider monitoring, quality checks, contract reviews and improvement conversations can help commissioners understand whether digital records, data sharing, TEC, cyber resilience and AI-enabled tools are being used safely and effectively. DSPT status, including Standards Met, can support that discussion, but the important test is whether safe data and cyber practices are embedded in everyday care.
Commissioning questions
- What digital, data or TEC evidence will commissioners ask providers to share through contract monitoring?
- How will commissioners use DSPT status, including Standards Met, to support proportionate assurance and everyday good practice?
- How will digital incidents, cyber issues, audits, complaints or contract-monitoring findings feed into service improvement and future commissioning?
-
Digital policy
Digital working in adult social care: What Good Looks Like sets out what good digital working looks like for local authorities and care providers with responsibility for adult social care in England. It is an aspirational framework for councils and providers of all sizes, including CQC-registered and non-registered services. Its seven success measures — well led, smart foundations, safe practice, support workforce, improve care, empower people and healthy populations — can inform commissioning, market shaping, specifications, self-assessment and contract review.
There are also practical support routes linked to the framework. Partners in Care and Health, the partnership between the Local Government Association and ADASS, provides support for councils, including a What Good Looks Like self-assessment tool and support offer for digital improvement. The Digitising Social Care provider self-assessment tool remains useful for care providers, but it should not be treated as the whole of What Good Looks Like.
The ambition for all care providers to become fully digitised by the end of this Parliament, currently June 2029, is part of government policy announced alongside wider adult social care reform. Digitising Social Care gives a more operational steer: its provider FAQs define a fully digitised care provider as one that uses an assured digital social care record (DSCR) and meets the Data Security and Protection Toolkit (DSPT) at Standards Met level. For commissioners, DSPT Standards Met is a useful marker, but it needs to sit alongside evidence that safe data and cyber practices are being used day to day.
Commissioning questions
- How will specifications and market engagement align digital expectations with What Good Looks Like for local authorities and care providers?
- What support or timescales will commissioners use to help providers move towards DSCR, DSPT Standards Met and interoperability expectations?
- How will commissioners use Partners in Care and Health support to strengthen digital improvement planning with councils and local partners?
- How will commissioners look beyond DSPT completion to whether safe data and cyber practices are embedded in daily work?
-
Data use and access
The Data (Use and Access) Act 2025 is now a core reference point for commissioning. It changes the environment for data use, sharing and access across health and adult social care, including mandatory information standards for health and adult social care IT. For commissioners, the question is how commissioned systems and services collect, maintain, access and share information so that care is safer, more coordinated and better evidenced.
Commissioning of social care and TEC may need to cover data quality, interoperability, supplier assurance, access to relevant records, information governance, role-based access, lawful sharing and how data supports prevention and system learning. This is broader than cyber security: it is about whether the right people can use the right information, safely and at the right time.
Commissioning questions
- When commissioning services or TEC, what data will commissioners expect providers or suppliers to collect, use and share, and for what purpose?
- How will commissioners test whether systems can support interoperability and mandatory information standards?
- What requirements will cover lawful sharing, role-based access and information governance?
- How will contract reviews use data to support prevention, coordination and learning?
-
Cyber security and resilience
Cyber security needs separate attention because commissioned care services depend on digital systems being available, reliable and protected. Commissioners may need to consider how providers prevent cyber incidents, respond when systems fail, maintain access to care records, protect devices and accounts, manage outsourced IT, report breaches and keep services running during disruption.
For TEC, the risks are practical as well as technical. If monitoring devices, sensors, call systems, apps or response platforms fail, people may lose support at the point they need it most. Specifications and contract reviews can therefore cover business continuity, backup arrangements, incident escalation, supplier support, staff training, cyber basics, DSPT status and learning from near misses or incidents.
Commissioning questions
- What business continuity and escalation requirements will commissioners include for loss of records, TEC platforms or communication systems?
- How will specifications cover breach reporting, incident response and recovery?
- How will commissioners test whether suppliers, outsourced IT and connected devices are covered by cyber arrangements?
- How will DSPT status be used to support improvement rather than only compliance?
-
AI and automated tools
AI or other automated tools add a further layer of risk and opportunity. In social care and TEC, they may sit behind predictive analytics, triage, rostering, care planning support, summarisation tools or automated alerts. The commissioning question is not simply whether AI is present, but whether any tool that informs care, prioritisation or decision-making is transparent, explainable, lawful, proportionate and properly governed.
ADASS’s Guide on technology and AI reinforces the leadership point: technology needs to align with Care Act values, support independence and dignity, and improve outcomes rather than simply drive efficiency. It also highlights the need to manage bias, transparency, consent and governance; keep decisions human-led; and involve commissioners, data analysts and partners in understanding both the opportunities and risks.
NHS England’s AI information governance guidance adds practical safeguards. It says information governance (IG) leads, Data Protection Officers (DPOs) and Caldicott Guardians should be involved when AI is implemented or data is shared for AI. Concerns about false or inconsistent outputs should be raised; final care decisions should remain with professionals in consultation with the person; and privacy notices should explain how information is used and shared.
The AI in Care Alliance, developed from the Oxford Project on the responsible use of generative AI in social care, is also relevant to the wider good practice landscape. Its work encourages responsible, ethical and co-produced use of AI in care, with a focus on human rights, independence, choice and control, dignity, equality and wellbeing. Commissioners and providers are encouraged to take part in AI in Care Alliance activity, especially where they are developing, procuring, testing or using AI tools in care. Specifications and reviews need to ask where AI or other automated tools are used, what data they rely on, how outputs are checked, how people are informed, what happens if a tool is wrong, and who remains accountable.
Commissioning questions
- How will commissioners identify whether AI or automated tools are used in commissioned services or TEC?
- What assurance will commissioners seek on the data used, bias monitoring and limitations of the tool?
- What contract requirements will make human oversight and accountability clear?
- How will commissioners monitor false, missed or unexpected outputs after implementation?
- How will commissioners and providers use AI in Care Alliance resources or activities to support ethical, co-produced and accountable AI adoption?
-
Tech-enabled care (TEC)
TEC commissioning is moving away from equipment-led procurement. ADASS Everyday TEC argues that people talk about what helps them live well, stay independent, keep connected and feel safer, not about devices. The TSA / ADASS blueprint and Digital Care Hub’s Lancashire case study support technology-agnostic, outcomes-focused commissioning that avoids lock-in.
TEC also needs to pass the “so what?” test. If alerts, sensors or analytics identify a risk, there needs to be a clear response and a meaningful action for the person. This links TEC to prevention, discharge, admission avoidance, unpaid carer support and neighbourhood health.
Commissioning questions
- What outcome will commissioners specify for TEC, and how will that outcome be measured?
- What response pathway will be required for alerts, including who responds and how quickly?
- How will procurement avoid locking services into a single device or supplier where flexibility is needed?
- How will commissioners review TEC’s impact on prevention, carer support and escalation avoidance?
-
Future direction
Policy is moving towards more integrated, preventative and neighbourhood-based health and care. The Casey Commission terms of reference point to a National Care Service, greater use of data, stronger accountability, fewer avoidable admissions and delayed discharges, and neighbourhood health services.
Commissioners are likely to see growing interest in shared care information, population health insight, neighbourhood teams, preventative analytics, access to relevant records and evidence of impact.
For commissioning, neighbourhood health strengthens the case for treating adult social care as part of a wider digital and data-sharing system. Commissioners will need to consider how care providers contribute to prevention, coordinated support, discharge and admission avoidance, and how digital records, TEC, cyber resilience and safe information sharing make that possible.
Commissioning questions
- How will commissioning plans show how digital systems support neighbourhood health and shared care information?
- How will commissioners include smaller providers in digital infrastructure, data-sharing and cyber resilience planning?
- What digital or data evidence will commissioners use to assess impact on prevention, discharge and coordination?
-
For providers
Providers can use digital maturity as part of their quality and improvement story. Commissioners will want to know how digital records, TEC and secure information sharing improve care. Providers will need to explain their DSPT status, including whether they have reached Standards Met, but also how safe data and cyber practices are used day to day. This sits alongside DSCR use, staff training, cyber arrangements, business continuity, data quality, AI use and TEC response pathways.
- Prepare a short digital maturity statement before contract reviews or market engagement, including any AI or automated tools in use, current DSPT status and how any AI use supports ethical, person-led care.
- Use What Good Looks Like and the provider self-assessment tool to identify strengths, risks, support needs and readiness for shared records or neighbourhood infrastructure.
- Share evidence of impact, such as safer medication, faster record access, avoided escalation or more responsive TEC.
- Ask for clear expectations on interoperability, information sharing, funding, supplier assurance, timescales, AI governance and support.
- Consider taking part in AI in Care Alliance activity or using its resources where AI tools are being explored, tested or used.
- For TEC or AI-enabled tools, explain the intended outcome, the risk being managed, the response pathway, human oversight, information governance input, learning arrangements and the link to wider local priorities.
- For commissioners
Commissioners are increasingly expected to treat digital maturity, data use and cyber resilience as part of commissioning, market shaping and quality assurance. Requirements need to be proportionate, outcome-focused and realistic about providers’ starting points. This will often involve integrated care boards (ICBs), NHS partners and local authority teams working together.
- Build digital maturity into analysis, planning, procurement, implementation and review.
- Use Care Act duties, What Good Looks Like for local authorities and care providers, DUAA and LGA cyber guidance to set proportionate expectations for data quality, secure sharing, DSPT Standards Met and everyday safe practice.
- Include DSPT, DSCR assurance, information governance, cyber basics, business continuity, supplier checks, staff training, TEC response pathways, AI safeguards and routes for IG, DPO or Caldicott input.
- Encourage responsible AI adoption by drawing on AI in Care Alliance resources and involving people who draw on care, families, carers, care workers and providers in discussions about AI use.
- Use market engagement and quality monitoring to understand provider readiness, information gaps, AI use and support needs.
- Use Partners in Care and Health support, including its What Good Looks Like self-assessment and improvement offer, where councils need help to baseline digital maturity or plan improvement.
- Work with ICBs and neighbourhood partners on shared records, GP Connect, interoperability and smaller provider inclusion.
- Move TEC towards scalable preventative services with evidence, financial models, benefits tracking and clear governance for automated alerts or predictions.
-
Conclusion
Commissioning has a central role in making digitally mature and resilient care possible. Legislation, policy and emerging practice all point in the same direction: technology and data need to support good care, not sit beside it. Commissioners can make that real by shaping markets where providers have clear expectations, practical support and resilient infrastructure. Commissioning conversations, specifications and reviews can ask how data, digital records and TEC help people live well, stay safe, retain choice and receive coordinated support. Done well, commissioning can make digital practice safer and more useful, while preparing local systems for neighbourhood health, shared care information and future reform.
References
ADASS. (n.d.). Everyday TEC: changing the way we talk about Technology Enabled Care.
ADASS. (2025, 25 November). The DASS Guide: Technology and AI.
AI in Care Alliance. (2026). AI in Care Alliance.
Care Quality Commission. (2026, 21 May). Artificial intelligence in health and social care: CQC’s role, expectations and plans.
Care Quality Commission. (2026, 8 April). Assessment framework for local authority assurance.
Care Quality Commission. (2026, 7 August). How we assess local authorities.
Care Quality Commission. (2026, 7 August). Local authority assessment reports.
Department of Health and Social Care. (2016, 10 March; updated 2025, 22 July). Care and support statutory guidance.
Department of Health and Social Care. (2016, 10 March; updated 2025, 22 July). Care Act 2014: supporting implementation.
Department of Health and Social Care. (2025, 2 May; updated 2025, 11 July). Independent Commission into Adult Social Care: terms of reference.
Department of Health and Social Care and NHS England. (2026, 17 March). Neighbourhood health framework.
Digital Care Hub. (2026). Data (Use and Access) Act 2025: briefing for adult social care providers.
Digital Care Hub. (n.d.). Oxford Project: The Responsible Use of Generative AI in Social Care.
NHS England. (2026, 11 May). Artificial intelligence.
Digitising Social Care. (n.d.). Assured solutions for digital social care records.
Digital Care Hub. (n.d.). Data Security and Protection Toolkit.
Digitising Social Care. (2025, 5 December). Fully digitised: FAQs for care providers.
Department of Health and Social Care. (2023, 17 May). Digital working in adult social care: What Good Looks Like for local authorities and care providers.
Local Government Association. (n.d.). Partners in Care and Health.
Digitising Social Care. (n.d.). What next for the digital transformation of adult social care?.
Digitising Social Care. (n.d.). What Good Looks Like self-assessment tool.
Digital Care Hub. (n.d.). Commissioning TEC for choice, prevention and better outcomes.
Digital Care Hub. (2026, 13 August). Commissioning for digital maturity and cyber resilience in social care: slides.
Digital Care Hub. (2026, 13 August). Commissioning for digital maturity and cyber resilience in social care: transcript.
Digital Care Hub. (n.d.). Digital Care in Focus.
