Scotland’s refreshed Digital Strategy, published this month, is more than a statement of intent. Alongside the vision sits a delivery plan for sustainable digital public services through to 2028. For Scotland’s technology businesses, it offers a useful view of where public-sector demand is heading.
The plan is jointly owned by the Scottish Government and local government, represented by COSLA and the Digital Office for Scottish Local Government. That matters. Many of the hardest public-service challenges do not sit neatly within one organisation, and neither do the best opportunities for reusable technology.
For GovTech suppliers, the message is clear: Scotland wants to move towards shared approaches, better use of data, stronger digital capability, responsible adoption of advanced technology and more resilient services. The opportunity is not simply to sell another standalone product. It is to help public bodies build services that can work together and improve over time.
A shift from isolated projects to common foundations
One of the strongest themes in the 2025–2028 delivery plan is reuse. Scotland’s public sector has many organisations serving the same people, often with similar needs around identity, payments, notifications, case management and data exchange. Rebuilding those capabilities separately adds cost and makes services harder to join up.
The Scottish Government is already developing common components. ScotAccount provides a reusable way for people to prove who they are when accessing participating public services. ScotPayments is intended to provide a common and consistent payments capability. The Government has also announced technical foundations for a new app, due to be piloted in 2026, which will initially provide weather and travel-disruption alerts before adding digital proof of age and further functions over time.
This creates opportunities around the core platform and at its edges: accessible service design, privacy-preserving credentials, secure APIs, consent, notifications, fraud prevention, integration and user research. Suppliers that can work with common standards and reusable components will be better placed than those offering closed systems that create a new silo.
Data must become usable, not merely available
The strategy also treats better use of data as essential to reform. Public bodies need to share information lawfully and safely, improve its quality and turn it into insight that supports earlier intervention.
That opens a broad market for Scottish companies. There is work to be done in data engineering, interoperability, information governance, privacy-enhancing technology, analytics and tools that help frontline teams make better decisions. The most valuable propositions will connect technology to a public outcome: fewer avoidable contacts, faster decisions, earlier support or a clearer view of demand.
Companies should also expect scrutiny. A technically impressive system will not be enough if its data is poorly understood, its decisions cannot be explained or its design excludes the people most likely to need the service. Evidence of accessibility, security and responsible data practice should be treated as part of the product rather than material added at tender stage.
AI moves from experimentation towards controlled use
The delivery plan commits Scotland’s public sector to building a more coordinated understanding of advanced technology and to identifying and piloting opportunities for AI in public-service operations by 2028. The emphasis is sensible: use technology to speed up repetitive work and release staff for tasks that need human judgement.
For Scottish AI businesses, the immediate opportunity is therefore likely to be practical and bounded. Think document triage, knowledge retrieval, administrative support, demand forecasting and quality assurance, all with clear human oversight and measurable benefits.
Public buyers will need more than a demonstration. Suppliers should be ready to explain what data a system uses, how outputs are checked, how performance is monitored and what happens when it fails. Products designed for auditability and safe deployment will travel more easily into other regulated markets too.
Cyber resilience becomes a baseline requirement
November also brought Scotland’s Cyber Resilient Scotland 2025–2030 framework. Read together, the two publications reinforce an important point: digital transformation and cyber resilience cannot be separate workstreams.
Opportunities exist for cyber firms offering secure-by-design development, assurance, identity, monitoring, incident readiness and help with legacy technology. But every GovTech supplier, not only security specialists, should expect to demonstrate how its service protects data, manages dependencies and supports recovery.
How Scottish companies can respond
The strategy is not a list of guaranteed contracts. It is a market signal. Businesses can use it to sharpen their offer now.
Start by mapping a product to one or more of the plan’s six themes: system leadership, common approaches, data, workforce and capability, advanced technology and innovation, and cyber-resilient services. Show how the product can integrate with existing components and how it avoids duplication. Build an evidence pack covering accessibility, security, data protection, interoperability and measurable outcomes. Finally, engage early through routes such as CivTech, Public Contracts Scotland and relevant supplier events, rather than waiting for a specification to appear.
Scotland’s refreshed strategy sets a direction towards public services that are joined up, inclusive and sustainable. The companies most likely to benefit will be those that help turn that direction into dependable, reusable delivery.
Need help navigating Scotland’s GovTech landscape or developing your public-sector proposition? Get in touch with the Scottish GovTech Cluster.