Public‑sector leaders face two converging demands in 2026: deliver measurable efficiency against departmental savings targets, and do so without exposing essential services to avoidable technical or regulatory risk. Non‑AI automation — robotic process automation (RPA), workflow orchestration and structured integrations — offers the fastest, lowest‑risk route to capacity and cost reductions. But too often these programmes fail because they are tactical, poorly governed and unmeasured. This playbook gives boards and SROs a practical 90‑day plan, the operating‑model changes required to scale safely, and the procurement and assurance levers to convert pilot wins into repeatable savings.
Why non‑AI automation must be a leadership priority now
Departments have explicit efficiency commitments and named projects to expand automation across back‑office functions. The government’s departmental efficiency plans identify RPA and greater automation as a delivery mechanism for savings and service redesign.
Automation delivers measurable, immediate value when applied to high‑volume, rules‑based tasks: invoice matching, benefits validation, standard case triage, contact centre routing and routine data reconciliations. Local authorities and central departments cite early wins from RPA pilots that free staff time for higher‑value work and reduce error rates. Practical case studies are already in published Innovation Zone and departmental programmes.
But adoption is uneven. Industry analysis shows automation remains fragmented and often lacks an enterprise operating model, which reduces reuse, increases supplier spend and weakens benefit realisation. Treating automation as an island activity risks duplicated licences, fragile bots and shadow automation.
Common failure modes — what to avoid
Pilotitis: many organisations run dozens of one‑off automations with no plan to maintain or scale them. That creates technical debt and a brittle estate.
No benefits ledger: savings claims without baselines, agreed metrics and verification are invisible to auditors and Treasury reviewers.
Vendor dependence and licencing sprawl: buying multiple RPA tools across departments duplicates cost and complicates supplier management. Use of a single supplier without proper governance increases concentration risk.
Poor change and data controls: automations that manipulate personal data without clear DPIAs, access controls or audit trails expose the organisation to regulatory and cyber risk.
A pragmatic 90‑day plan for senior leaders
Day 0–14: Rapid discovery and governance. Appoint an accountable SRO for automation, create a small steering group (SRO, finance, IT, information governance, commercial) and run a two‑week discovery across priority functions to identify the top 10 repetitive processes by volume, cost and risk. Use a lightweight scoring template (volume × time per transaction × error rate × regulatory sensitivity).
Day 15–45: Prioritise and design. Select two quick wins (90% chance of completion and measurable benefit in 90 days). Build a minimum viable controls package for each: process map, data classification, DPIA decision, rollback plan and performance metric. Draft a one‑page commercial brief for each candidate to allow direct award via G‑Cloud or the appropriate framework.
Day 46–90: Deliver, validate and report. Execute the two pilots with a combined delivery team (product lead, delivery manager, security reviewer, vendor lead). Measure baseline vs post‑automation throughput, cycle time and error rate. Produce an SRO‑ready evidence pack: live demo, baseline data, SLA, supplier exit and reversibility actions, and a quantified 12‑month benefit forecast suitable for inclusion in a Green Book supplementary note where required.
Operating model: how to structure for scale
Create an Automation Centre of Excellence (CoE) with clear responsibilities: pipeline prioritisation, platform ownership, security and data governance, reusability standards, licensing and supplier management. The CoE should not be solely technical — it must include process, finance and business‑change capability.
Adopt a standard procurement pattern: identify an enterprise RPA/workflow platform (or a small set) on G‑Cloud/appropriate framework; procure platform licences centrally; call off delivery work locally via assured suppliers. Central licence negotiation reduces per‑user cost and simplifies support.
Fund pilots from an invest‑to‑save pool and require benefit verification before further roll‑out. Make suppliers price in support & maintenance and include a contractual exit for bot code, runbooks and data extracts to avoid lock‑in.
Delivery assurance and benefits realisation
Make benefits auditable. For each automation, require: (a) a baseline measurement; (b) target metrics; (c) an owner for ongoing performance; and (d) a validation date (30/60/90 days). Publish an automation ledger so Treasury, auditors and the board can reconcile claimed savings.
Link automation appraisal into routine programme governance. Small automations must still flow into the organisation’s IAAP or benefits register where they aggregate to material volumes. This is especially important where headcount reduction is proposed.
Use the Green Book’s appraisal principles when automation materially affects value for money or inter‑departmental transfers. Attach a short supplementary note to explain assumptions and sensitivity tests.
Practical controls: cyber, data protection and supplier assurance
Treat automation like any other supplier‑dependent capability. Require suppliers to demonstrate secure development practices, privileged access controls for bots, logging and forensic support, and a tested rollback plan.
Ensure every automation has a documented data lineage, DPIA decision and retention schedule. Where personal data is processed, require either an existing lawful basis and DPIA or an exemption documented and signed off by the SIRO.
Embed resilience tests into supplier contracts: runbook export, encrypted data extracts, and a vendor independence test (can we run processes without live vendor support?). These clauses reduce supplier lock‑in and support continuity.
Scale: the 12‑month roadmap
Months 3–6: Validate the CoE, standardise templates, and move 5–10 additional automations through the pipeline using the proven pattern (discover → design → deliver → validate).
Months 6–12: Consolidate platform licences, retire duplicate bots, and migrate mature automations to a supported schedule with clear runbooks and patch controls. Publish a single automation dashboard for the board showing realised savings, live SLAs and operational exceptions.
Beyond 12 months: consider controlled introduction of AI augmentation only where the CoE has mature governance, model inventories and verifiable performance baselines.
Automation succeeds where governance meets delivery: pick high‑volume, low‑risk processes, measure baseline performance, contract for reversibility, and make benefits auditable — anything else is a costly experiment.
Antares recommended actions
These are Antares's recommended first actions for organisations turning the issues in this article into practical governance and delivery.
- Appoint an SRO and stand up an Automation CoE with a published remit and budget within 14 days.
- Run a two‑week discovery across finance, HR and contact centre to identify the top 10 candidate processes and select two 90‑day pilots.
- Require a one‑page controls brief for every pilot (process map, DPIA decision, rollback plan, baseline metric, supplier exit clause).
- Centralise platform licences and procure via G‑Cloud where practical to reduce licence sprawl and simplify supplier assurance. ([webprod-cms.crowncommercial.gov.uk](https://www.webprod-cms.crowncommercial.gov.uk/agreements/RM1557.14?utm_source=openai))
- Create an automation ledger and include each project’s evidence pack in the department’s benefits register; tie sign‑off to verified metrics.
- Include specific contractual clauses for supplier reversibility: code/runbook export, data extracts in open formats, and tested supplier exit procedures.
- Embed cyber and data checks into the delivery pipeline: privileged access controls, logging, encrypted data handling and an annual resilience test.
- Report quarterly to the board with measured benefits, risk posture and a pipeline prioritised by value‑at‑stake and regulatory sensitivity.
