Bearings BetaFunding & opportunities · North West UKGet email alerts

Guides › Public contracts

Who buys, what they need from a supplier, and the compliance to get good at

Councils, the NHS, central government, universities, housing, police, transport, utilities and schools: what each buys, what it insists on, and the compliance stack with costs.

SMEsFoundersCharities and social enterprises22 min readChecked 18 October 2026
On this page
  1. The reality
  2. Who buys, and what each needs
    1. Councils and combined authorities
    2. The NHS
    3. Central government and arm's-length bodies
    4. Universities and colleges
    5. Housing
    6. Police and fire
    7. Transport and utilities
    8. Schools and academy trusts
  3. The compliance stack
    1. The Carbon Reduction Plan, done properly
    2. Cyber Essentials: what you are certifying
    3. What you can push back on
    4. Exclusion, debarment and your CDP record
  4. Get good at it: a plan for a 5 to 20 person firm
  5. Examples, and why they cleared the gates
  6. Pitfalls
  7. Checklist
  8. Questions
    1. What insurance do I need to bid for a council contract?
    2. Do I need Cyber Essentials to win public sector contracts?
    3. Does a small business need a Carbon Reduction Plan?
    4. Does my small business need a modern slavery statement?
    5. Is ISO 9001 required for public sector tenders?
    6. How do I become an NHS supplier?
    7. Can a council restrict a tender to local suppliers?
    8. How much does it cost to get tender-ready?
  9. Sources

Every public buyer in England now works to the same law, but each asks a supplier to prove different things before it will read a word of your bid. This guide takes the buyers one at a time: what they buy from small firms, how they buy, what they insist on and how they pay. Then it lays out the compliance stack with published costs, and a plan to build it in a year for a firm of 5 to 20 people.

  • The buyer sets the pre-work. Councils need little beyond portal registration and insurance; the NHS needs a documented compliance programme; utilities and rail need a paid pre-qualification scheme first12254.
  • Hold it, do not promise it. NHS Supply Chain: "Committing to obtain certification is not sufficient"22.
  • The Act protects small bidders: no audited accounts from firms not required to have them, no contract insurance demanded before award, and equivalents to any named qualification must be accepted62.
  • A Carbon Reduction Plan has been required in every new NHS procurement since April 2024. It costs nothing but time2135.
  • The core paid stack for a services firm under 10 staff is about £472 a year in published fees before VAT and insurance: ICO fee, Cyber Essentials, Living Wage accreditation726578.

The reality

  • 34% of local government spend went to SMEs in 2025, against 21% across the public sector15
  • £419 a year: the cheapest CHAS health and safety tier, plus a joining fee68
  • £320 + VAT: the starting price of Cyber Essentials, renewed every 12 months6534
  • 90,860 suppliers registered with an SSIP health and safety scheme, January 202667
  • £60,000: the maximum civil penalty per illegal worker82
  • 10.2% of GMCA spend was with suppliers holding a carbon plan, against 53.9% with Real Living Wage payers (late 2022)8

Where SMEs win, by share of direct spend in England in 2025 (the Tussell and BCC tracker gives the NHS and central government as 16% and 10% but assigns them inconsistently)15:

SME share of public spend by buyer, England 2025
Local government34%£29.1bn, rising every year since 2020
All public sector21%£45.2bn, a record
NHS or central government16%the higher of the two
NHS or central government10%the lower of the two

Gates first, marks second

In Liverpool City Council's October 2026 parking-systems award, most of the 60 technical questions were pass/fail or for information only, and every bidder cleared them. The contract was won on the handful of weighted questions, social value and price12. Compliance does not win contracts. Missing it loses them before scoring starts.

Who buys, and what each needs

Councils and combined authorities

Question Answer
Buy from SMEs The most of any buyer: 34% of local government spend in 2025, driven by health and social care, with local SMEs well ahead of non-local ones15
How they buy Quotation bands below the threshold (£207,720 including VAT for goods and services)5. Wirral: no quote under £2,000; one quote from £2,000 to £25,000, with a manager's sign-off above £5,000; at least five sought through the portal from £25,000 to the threshold1. Cheshire East: three quotes advisable under £10,000, required from £10,0004
Insist on Wirral's typical levels: £10m public liability, £5m employers' liability, £2m professional indemnity, each and every claim, reducible for low-risk work with the finance officer's written consent. Financial profile reports from £100k. Social value at least 10% from £100k1
How they pay Wirral: 30 days, but "Local SMEs: 10 working days from invoice date"; "No Purchase Order, No Pay"2. An optional early-payment scheme trades a rebate for faster payment3
Watch for Since 4 February 2026 an English council may reserve a below-threshold contract to suppliers "based in the local area" or the UK, if the notice says so before tenders are invited. "Based" means where you have "substantive business operations", whoever owns you6

Wirral's Contract Procedure Rules (February 2025) set the bands a small firm climbs, goods and services, by value1:

Wirral Council: how much competition each value needs
  1. 5Above the thresholda full Procurement Act procedure, on Find a Tender
  2. 4£25,000 to the thresholdat least five sought, through the tendering portal
  3. 3Above £5,000 on a single quotea departmental manager must agree
  4. 2£2,000 to £25,000one quotation, departmental decision
  5. 1Under £2,000no quotation required

Wirral's rules add one useful constraint: an officer picking a supplier between £2,000 and £25,000 must record why and cannot reuse that supplier in the same financial year without competition1. Below £25,000, being known to several service managers and quoting fast matters more than any tender technique.

Greater Manchester's pass/fail gates

GMCA's standard selection questions make three things pass/fail: the Real Living Wage for all UK direct employees aged 18 and over (or a commitment to pay it within 12 months of contract start, with key subcontractors following); Greater Manchester Good Employment Charter member or supporter status, or supporter within 3 months ("Registration as a Supporter is zero cost"); and a published Carbon Reduction Plan, pass/fail above £5m and scored below7. Weightings for every North West council are in Social value that scores.

Coming up: children's services across 24 councils

GMCA is lead authority for "GMCA 2201, North West Regional Children's Services", a light-touch procurement for 24 North West councils. Provider workshops run 9 to 23 November 2026, engagement closes 24 November and the tender is indicated for March 2027. Existing providers "will need to apply to join". Safeguarding evidence "may include regulatory information, professional qualifications, staffing arrangements and evidence of effective management" (reported by a bid consultancy citing Find a Tender notice 096132-2026)10.

The NHS

Question Answer
Buy from SMEs 16% or 10% of NHS spend in 2025 (the Tracker assigns the NHS and central government figures inconsistently)15
How they buy Clinical services under the Provider Selection Regime (PSR) since 1 January 2024; goods and non-clinical services under the Procurement Act16. NHS England runs Atamis, "our single eCommercial system"18; each Atamis buyer portal needs its own registration19. NHS trusts advertise from £12,000 including VAT20
Insist on A Carbon Reduction Plan in every new procurement; at least 10% of the score on net zero and social value21. For NHS Supply Chain: an in-date UKAS-accredited ISO 9001 or ISO 13485, MHRA registration for devices, the Modern Slavery Assessment Tool, and Cyber Essentials Plus where PPN 014 applies22
Digital and devices DSPT for anyone with access to NHS patient data; DCB0129 (makers) and DCB0160 (deployers) clinical safety, "mandatory under the Health and Social care Act 2012"; DTAC for software-based digital health technologies232425
How they win you The five PSR criteria: quality and innovation; value; integration, collaboration and service sustainability; improving access, reducing health inequalities and facilitating choice; social value17

The NHS Net Zero Supplier Roadmap tightens every year or two, from NHS England's supplier page21:

NHS Net Zero Supplier Roadmap
  1. 10% weightingnet zero and social value in every procurement
  2. Carbon Reduction Plannew contracts above £5m a year
  3. Carbon Reduction Planall new procurements
  4. Public reportingtargets, emissions, a plan covering global Scope 1, 2 and 3
  5. Product footprintscarbon footprint for each product supplied
  6. Progress to qualifyonly suppliers with published progress reports

Three dates for device and digital firms. The 2026-27 DSPT (version 9) was published on 2 October 2026, and "IT Suppliers" must complete a DSPT audit to the mandatory scope23. DTAC's new form has 25% fewer questions and the old one should not be used from 6 April 202625. CE-marked devices stay accepted in Great Britain until 30 June 2028 (MDD and AIMDD) or 30 June 2030 (IVDD, EU MDR and IVDR), or earlier certificate expiry26.

The MedTech Funding Mandate stays live, but "no new products will be added for 2026/27"27. The way in for a product is evidence and a Health Innovation Network; the detail is in Selling innovation to the public sector.

The two North West Health Innovation Networks

Health Innovation Manchester offers Innovator Support and its Greater Data real-world data service28. Health Innovation North West Coast covers Cheshire, Merseyside, Lancashire and South Cumbria, with the Digital North and Momentum accelerators and a Business Connect enquiry form29. Start with whichever covers your patch.

Central government and arm's-length bodies

Question Answer
Buy from SMEs 10% or 16% of spend (see the NHS row)15. Departments must set three-year direct SME spend targets for the year ending March 2028 and VCSE targets from April 2026; no percentages are prescribed, and NHS trusts are excluded30
How they buy The Government Commercial Agency (GCA), which Crown Commercial Service became on 1 April 2026, through frameworks, dynamic markets and the Digital Marketplace31. G-Cloud 15, an open framework from 6 August 2026, reopens after 18 and 36 months; G-Cloud 14 ends on 28 October 20263233
Insist on Suppliers "are expected to submit MI returns and create a carbon reduction plan"31. Cyber Essentials under PPN 014 where a contract touches personal data or OFFICIAL systems34. Above £5m a year: a Carbon Reduction Plan (PPN 006) and the payment test (PPN 018)3537
How they pay 30 days, passed down the supply chain: section 73 implies 30-day terms into public subcontracts, and from 1 October 2025 contracts above £5m a year carry spot checks on primes' payments to subcontractors at least every six months (PPN 021)4038
Security BPSS is "not a clearance": identity, right to work, employment history, unspent convictions. SC adds credit, records and Security Service checks for long-term access to SECRET assets; the sponsoring department decides who needs it4243

PPN 018 is the one that surprises small primes. To bid for a contract above £5m a year you must show you pay at least 95% of invoices within 60 days (90% to 94.9% with an action plan) and all invoices within an average of 45 days, in at least one of the two previous six-month periods. It applies "regardless of size"; firms trading under 12 months can pass37.

Universities and colleges

Question Answer
How they buy Consortium frameworks and their own portals. NWUPC, the not-for-profit consortium at Salford, advertises on Find a Tender and runs tenders on Mercell, free to join44. The University of Manchester uses In-Tend and scores social and environmental factors, tracked on the Social Value Portal45
Insist on Winning a full tender: "Registering does not make you a supplier", and you "cannot be added to an agreement mid-term"44
After award Quarterly spend and KPI management information to NWUPC44
Timing NWUPC starts tendering six to twelve months before a framework expires. Watch expiry dates, not just notices44

Housing

Question Answer
How they buy Consortium frameworks and dynamic purchasing systems (DPSs). Fusion21, a charity, renews frameworks every four years and opens applications about nine months before; its latest repairs and voids framework is worth £350m over four years46. Procure Plus, Old Trafford, runs 12 frameworks and 5 DPSs open at any time48. EN:Procure lists all tenders free on Proactis, with seven DPSs49
Insist on CDP registration to tender (Procure Plus)48. For works and maintenance, an SSIP-recognised health and safety assessment such as CHAS or Constructionline (see the stack below)67
Safeguarding Where staff work with children or vulnerable adults, check the DBS level each role is eligible for before you bid (fees below)70
Fastest way in A DPS. Fusion21's cleaning and washroom DPS can be joined "instantly"47. Framework timing and call-offs: How to get on a framework

Police and fire

Question Answer
How they buy BlueLight Commercial, set up by the Home Office in 2020 as policing's "single voice to market", on the free Atamis National E-Commercial Portal50
Insist on Whatever the tender sets; the Police Industry Charter is voluntary and "not a prerequisite"51
Help A free Social Value Action Planning Tool, and a partnership with Go4Growth, the free SME programme ("Helping 27,000 businesses")5152

Transport and utilities

Question Answer
Network Rail Spends about £7bn a year and has committed at least 33% to SMEs, direct and indirect. Register on the CDP and BravoNR; if your goods or services are on the Railway Industry Classification List, RISQS audited status is required, even down the supply chain53
Utilities Achilles UVDB, used by United Utilities, Cadent, Peel Ports and others: Silver from £145 for firms with under 10 staff and £1m turnover, Silver+ from £80054. Electricity North West registers suppliers on GoSupply and publishes "Tender Tips" (February 2026)55
Airports Manchester Airports Group: SAP Ariba, notices on the CDP, an EcoVadis assessment once awarded56
Transport for Greater Manchester ProContract, free alerts, pipeline notices for tenders above £2m57

Rail dates

Department for Transport SME and VCSE supplier events are scheduled for 28 October and 11 November 2026, and Network Rail names a regional SME champion for North, West and Central53.

Schools and academy trusts

Question Answer
How they buy Often through DfE's free Get Help Buying for Schools, which "can run procurements on a school's behalf", or DfE-approved options whose suppliers are "pre-checked by the option's provider"5859
Your move Find out who runs the approved options in your category and get pre-checked by them; that is where the schools look59
How they pay Contracts awarded by schools are excluded from the Act's implied 30-day payment term, from payment compliance notices and from PPN 021 spot checks. Agree payment terms in the contract4041

The compliance stack

"Condition" means a condition of participation: fail it and you are out. "Scored" means it earns marks. Fees are as published in October 2026.

Item When it is required Cost and lead time Source
CDP registration Condition everywhere; a buyer cannot publish a below-threshold award without your identifier Free 60
Companies House identity verification The law, since 18 November 2025, for directors, people with significant control and LLP members; existing officers verify by their due dates within a 12-month transition. Not verifying is an offence and blocks filings One Login or an accountant or other authorised agent 61
Accounts and financial standing Condition, proportionate only. Audited accounts cannot be demanded from firms not required to audit. Wirral runs financial profile reports from £100k; Liverpool used Creditsafe Young firms: management accounts, bank evidence, a credit rating, a guarantee or a consortium partner 62112
Employers' liability The law, from your first employee: £5m minimum Fine £2,500 a day without it 63
Public liability, professional indemnity Condition at contract start, not before award; a broker's letter plus commitment is enough at bid PI from £8.50 a month (Hiscox); about £400 for £250k cover, £600 for £1m 6264
Cyber Essentials Condition before award where PPN 014 applies: citizens' or staff personal data, OFFICIAL systems, day-to-day government business. "Not all contracts need certification" From £320 + VAT, tiered by size; annual; free cyber insurance under £20m turnover 3465
Cyber Essentials Plus Higher-risk contracts; NHS Supply Chain where PPN 014 applies Quoted on network size; independent testing 3422
ISO 27001 Scored or named. "ISO 27001 does not automatically meet Cyber Essentials" No published price 34
ISO 9001 or ISO 13485 Condition for NHS Supply Chain, UKAS-accredited; elsewhere usually scored, and any named standard must accept equivalents Three-year certificate, annual surveillance; no published price 226662
ISO 14001, ISO 45001 No source read makes them mandatory; buyers check environmental and health and safety management, and SSIP covers safety for works No published price 11
SSIP health and safety (CHAS, Constructionline, SafeContractor) Condition for works, maintenance and facilities management in practice CHAS from £419 a year plus joining fee, review in 20 working days (2 on Express or Premier at £499 and £549); Constructionline by turnover band, not published 6869
DBS checks Roles with children or vulnerable adults Basic £20, standard £20, enhanced £41 (after the October 2026 change); Update Service £15 a year, join within 30 days of issue 7071
Data protection The law: ICO fee; a written processor contract with the Article 28 terms whenever you handle a buyer's personal data £52 (micro) or £78 a year 7273
Modern slavery Statement only at £36m turnover. Below it: the Modern Slavery Assessment Tool for NHS Supply Chain, and supply-chain detail on high-risk contracts MSAT is a free Cabinet Office tool 742275
Carbon Reduction Plan Condition: all new NHS procurements; central government above £5m a year; GMCA pass/fail above £5m No fee; free calculators from the SME Climate Hub 2135776
Real Living Wage GMCA pass/fail; elsewhere social value £14.10, London £15.45 (announced 15 October 2026, by 1 May 2027 for accredited employers); accreditation from £100 a year under 10 staff 77778
Anti-bribery Mandatory exclusion ground on conviction; "adequate procedures" are the defence Six principles: proportionality, top-level commitment, risk assessment, due diligence, communication, monitoring and review 7980
Right to work The law, before anyone starts Up to £60,000 per illegal worker 8182
TUPE Service contracts that change hands; "The size of the business does not matter" Price in transferring staff 83
E-invoicing Every public contract: buyers must accept an invoice in BS EN 16931-1:2017 Name, description, sum and a unique number make a valid invoice 40
KPIs Contracts over £5m: at least three, published at least yearly Poor performance can support future exclusion 84
Payment record Above £5m a year: 95% in 60 days, 45-day average Track your own payment days now 37

What holds suppliers back at prequalification

A bid consultancy's September 2026 guide lists what buyers check: financial standing and insurance; health and safety, quality and environmental management; accreditations; experience; delivery capacity; policies and information security; social value. The gaps it names: "missing or pending accreditations", "policies that still need writing", "weak reporting processes", "incomplete documentation" and "social value commitments without a practical delivery plan"11. Every one of those is fixable before a tender appears, and almost none after.

The Carbon Reduction Plan, done properly

The plan is the cheapest gate on the list and the one most small firms lack: in late 2022 only 10.2% of GMCA's spend was with suppliers holding a carbon plan8. The PPN 006 technical standard sets out what it must contain36:

No audit is needed, only "a reasonable level of assurance"36. GMCA's test for smaller contracts is lighter: a plan signed off by "the controlling minds of the organisation", with at least annual measurement and reduction targets and an action plan; the Carbon Trust SME calculator "or comparable scheme" counts as evidence9. Write to the PPN 006 standard once and it passes both.

Cyber Essentials: what you are certifying

Five controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials is a self-assessment that is independently checked; Plus adds independent technical testing65. Certify the whole organisation, not one office: that is the condition for the free cyber insurance below £20m turnover65. Under PPN 014 the evidence is needed before award and "no later than when data is passed to the supplier"34.

What you can push back on

Three requests break the Act's conditions of participation guidance: audited accounts from a firm exempt from audit, insurance certificates before award, and a named accreditation without "or equivalent". It also bars a requirement for experience with one particular authority62. Raise these at clarification, politely, quoting the guidance. How a large buyer actually rates finances, NHS Supply Chain's 12-point matrix with guarantees for firms under 12 months old, is set out in How public procurement works now14.

Exclusion, debarment and your CDP record

Your CDP record holds four categories: basic information, economic and financial standing "based on the supplier's most recent financial accounts", connected persons, and exclusion grounds85. Mandatory grounds include fraud, bribery and modern slavery convictions; discretionary ones include insolvency, poor performance and labour or environmental misconduct, and nothing older than five years counts80.

The debarment list, effective 17 November 2025, is blank "until a ministerial decision is made"86. The risk for a small firm is what it declares. If something applies, show self-cleaning: action already taken outweighs promises, and time passing is not enough80.

Get good at it: a plan for a 5 to 20 person firm

The build-up in three stages, with the published fees: ICO £52 or £78, Cyber Essentials from £320 plus VAT, Living Wage accreditation from £100 under 10 staff, CHAS from £419 plus a joining fee72657868:

Compliance build-up for a 5 to 20 person firm
  1. Free and legal basicsCDP, portals, Companies House ID, ICO fee, employers' liability, policies
  2. The common gatesCyber Essentials, Carbon Reduction Plan, Real Living Wage, Charter supporter, MSAT
  3. Sector schemes, only if neededCHAS, UVDB or RISQS, ISO 9001 or 13485, NHS digital standards
When Do Published cost Opens
This month CDP registration; The Chest or ProContract, plus each target buyer's portal (Finding tenders) Free604 Every buyer
This month Companies House identity verification for every director and PSC No fee stated Keeps you filing
This month ICO fee; employers' liability; right-to-work process; written anti-bribery, modern slavery and data protection policies £52 or £7872 Every buyer's declarations
This month Broker quotes at £10m public liability, £2m professional indemnity Quotes are free Council conditions at contract start
This quarter Cyber Essentials, whole organisation From £320 + VAT65 Central government and NHS contracts with personal data
This quarter Carbon Reduction Plan on the PPN 006 template, director-signed, on your homepage No fee36 Every NHS tender; GCA; GMCA
This quarter Real Living Wage; Good Employment Charter supporter; Living Wage accreditation £0 for the Charter; from £100778 Greater Manchester public bodies
This quarter MSAT completed; DBS for roles that need it MSAT free; £20 to £41 a check, £15 a year to update7570 NHS Supply Chain; schools, care, children's services
This year One SSIP scheme, only for works or facilities management CHAS from £419 plus joining fee68 Housing consortia, construction
This year Achilles UVDB or RISQS, only for utilities or rail UVDB from £14554 United Utilities, Network Rail
This year ISO 9001 or 13485 only if a target buyer makes it a condition; DSPT, DCB0129 and DTAC for health digital Not published66 NHS Supply Chain; NHS digital

The arithmetic for a services firm under 10 staff: ICO £52 + Cyber Essentials £320 + Living Wage accreditation £100 = £472 a year, before VAT on Cyber Essentials and before insurance. Add £419 plus a joining fee if you need CHAS, and £41 + £15 for each enhanced DBS check kept on the Update Service. Living Wage fees rise above 10 staff on a sliding scale the Foundation does not publish.

Do this today

Put a renewal calendar in one spreadsheet: Cyber Essentials, CHAS and insurance every 12 months, the Carbon Reduction Plan within six months of each year end, DBS Update Service within 30 days of each certificate34683671. A lapsed Cyber Essentials certificate makes you "uncertified"34.

Hypothetical: a 12-person Wigan facilities firm

Month one: CDP, The Chest, ICO, policies. Quarter one: Cyber Essentials and a Carbon Reduction Plan, then Charter supporter status, so GMCA's gates are cleared. Quarter two: CHAS Standard for the housing consortia. It skips ISO 9001 until a target buyer makes it a condition.

Examples, and why they cleared the gates

Real example: Liverpool City Council parking systems, £806,815, October 2026

A further competition under an ESPO framework, five bidders. Most of the 60 technical questions were pass/fail or for information only; "no bidders did not meet the minimum requirements" (the double negative is the council's). The winner "passed the financial checks conducted by PCS who conducted a check on Creditsafe" and then won on weighted technical answers and a 10/10 social value score12. Why it matters: the gates were table stakes for all five. Keep your credit file clean, because it is checked.

Real example: Kinto UK, Liverpool vehicle fleet, £318,023, July 2026

A three-year lease of 27 vehicles, called off a GCA framework on cost, quality and social value. The winning social value offer in full: "Continued implementation of its carbon reduction plan" and requiring subcontractors "to operate low or zero emission vehicles"13. No scores were published, so the weight of those lines is not known. What it shows: a published plan you already hold can be your social value answer as well as your gate.

Real example: a Real Living Wage gate that was withdrawn, Greater Manchester, 2023

GMCA reported that a complaint from a bidder unable to meet the Real Living Wage requirement led one contracting authority to restart a procurement with the requirement removed, and that Greater Manchester Police saw some bidders withdraw while competition "remained healthy"8. Gates are not always fixed. If one is disproportionate for the contract, say so at clarification.

Pitfalls

Pitfall Why it costs you Fix
Promising certification "Committing to obtain certification is not sufficient"; only a certification body's letter counts while it is in progress22 Certify before the tender, or get the certifier's letter
Buying insurance to bid "Contract-related insurance cannot be required in place before award"62 Bid with a broker's letter and a commitment; buy at award
ISO 27001 for Cyber Essentials Not automatically equivalent; most holders need Cyber Essentials too34 Certify both, or evidence equivalent controls
Modern slavery boilerplate A policy does not complete an MSAT or name a high-risk supply chain7539 Fill in the MSAT now; map your suppliers in risk sectors
No Carbon Reduction Plan A condition in every new NHS procurement and GMCA's above £5m217 Write it on the PPN 006 template; publish it on your homepage36
Lapsed certificate A lapsed Cyber Essentials certificate makes you uncertified34 The renewal calendar above
No purchase order "No Purchase Order, No Pay"2 Get the PO number before you start work

Checklist

Questions

What insurance do I need to bid for a council contract?

Check the tender. Wirral's typical levels are £10m public liability, £5m employers' liability and £2m professional indemnity, reducible for low-risk work1. Under the Procurement Act contract insurance cannot be required before award, so a broker's letter is enough to bid; employers' liability is a legal requirement anyway6263.

Do I need Cyber Essentials to win public sector contracts?

For central government and NHS contracts that handle citizens' or staff personal data or OFFICIAL systems, yes, before award and renewed every 12 months. PPN 014 says "not all contracts need certification", and equivalents must be accepted34. It costs from £320 plus VAT65.

Does a small business need a Carbon Reduction Plan?

For NHS work, yes: every new NHS procurement has required one since April 202421. Central government requires one above £5m a year, and GMCA asks for one on over-threshold contracts357. There is no fee; use the PPN 006 template36.

Does my small business need a modern slavery statement?

Only at £36m turnover or more74. Smaller firms are still asked: NHS Supply Chain requires the Modern Slavery Assessment Tool, and high-risk contracts ask for supply-chain detail2239.

Is ISO 9001 required for public sector tenders?

Rarely as a condition. NHS Supply Chain requires an in-date UKAS-accredited ISO 9001 or ISO 1348522. Elsewhere it is usually scored, and under the Act a named qualification must accept equivalents62.

How do I become an NHS supplier?

Register on the Atamis portal of each NHS buyer you target, and on Jaggaer for NHS Supply Chain1922. Publish a Carbon Reduction Plan first21. For a product, start with a Health Innovation Network27.

Can a council restrict a tender to local suppliers?

Yes, below the threshold. Since 4 February 2026 an English council may limit a contract to suppliers based in its local area or the UK, if it says so in the notice before inviting tenders6.

How much does it cost to get tender-ready?

For a services firm under 10 staff, about £472 a year in published fees: ICO £52, Cyber Essentials £320 and Living Wage accreditation £100, before VAT and insurance726578. Works firms add CHAS from £419 a year68.

Sources

  1. Wirral Council, Contract Procedure Rules, February 2025 (PDF): quotation bands, financial profile reports from £100k, insurance levels, social value from £100k. https://www.wirral.gov.uk/files/contract-procedure-rules.pdf-0 ↩↩↩↩↩↩↩↩

  2. Wirral Council, "Payments to suppliers". https://www.wirral.gov.uk/business/tenders-and-contracts/payments-suppliers ↩↩

  3. Wirral Council, "Supplier Incentive Programme". https://www.wirral.gov.uk/business/tenders-and-contracts/supplier-incentive-programme-sip ↩

  4. Cheshire East Council, "Doing business with the council", reviewed 26 August 2025. https://www.cheshireeast.gov.uk/business/procurement/doing_business/doing_business.aspx ↩↩

  5. Osborne Clarke, "Regulatory Outlook, February 2026: regulated procurement": 2026 thresholds under PPN 023. https://www.osborneclarke.com/insights/regulatory-outlook-february-2026-regulated-procurement ↩

  6. The Local Government (Exclusion of Non-commercial Considerations) (England) Order 2026, SI 2026/94, in force 4 February 2026. https://www.legislation.gov.uk/uksi/2026/94/made ↩↩

  7. GMCA, "Procurement Standard Questionnaire: Social Value Questions", Appendix 1 to the report of 24 March 2023. https://democracy.greatermanchester-ca.gov.uk/documents/s25481/Appendix%201%20GMCA%20Procurement%20Standard%20Questionnaire%20Social%20Value%20Questions.pdf ↩↩↩↩↩↩↩

  8. GMCA, "Driving Social Value in Greater Manchester Public Procurement: Good Employment", 24 March 2023: Q3 2022/23 baseline and market reaction. https://democracy.greatermanchester-ca.gov.uk/documents/s25480/15%20GMCA%20Report%20Driving%20Social%20Value%20Update.pdf ↩↩↩

  9. GMCA, "Driving Social Value", report of 25 March 2022: definition of a credible carbon plan. https://democracy.greatermanchester-ca.gov.uk/documents/s20070/16%20Driving%20Social%20Value.pdf ↩

  10. Thornton & Lowe, "GMCA children's services framework", 16 October 2026, citing Find a Tender notice 096132-2026. https://thorntonandlowe.com/gmca-childrens-services-framework/ ↩

  11. Thornton & Lowe, "Supplier sourcing and prequalification for major contracts", 25 September 2026. https://thorntonandlowe.com/supplier-sourcing-prequalification-major-contracts/ ↩↩

  12. Liverpool City Council, Cabinet 13 October 2026, "Penalty Charge Notice and Permit Management System", Appendix 1: evaluation outcome. https://councillors.liverpool.gov.uk/documents/s329288/Appendix%201%20Evaluation%20Outcome%20and%20Award%20Recommendation%20-%20not%20exempt.pdf ↩↩↩

  13. Liverpool City Council, Delegated Authority Report NH99.26, "Award a Contract: Highways Operations Vehicle Fleet", decided 9 July 2026. https://councillors.liverpool.gov.uk/documents/s329970/Award%20a%20Contract%20-%20Highways%20Operations%20Vehicle%20Fleet.pdf ↩

  14. NHS Supply Chain, "Economic and Financial Standing Supplier Guide", 3 July 2025 (PDF). https://media-nhssc.azureedge.net/datashare/Economic-and-Financial-Standing-Supplier-Guide-3-July-2025.pdf ↩

  15. Tussell and British Chambers of Commerce, "SME Procurement Tracker 2026": England, calendar 2025, direct spend. The Tracker gives the NHS and central government as 16% and 10% but assigns them differently on different pages. https://www.kentinvictachamber.co.uk/wp-content/uploads/2026/05/Tussell__BCC_SME_Procurement_Tracker_2026_FINAL_-_pdf.pdf ↩↩↩↩↩

  16. NHS England, "Provider Selection Regime". https://www.england.nhs.uk/commissioning/how-commissioning-is-changing/provider-selection-regime/ ↩

  17. NHS England, "The Provider Selection Regime: statutory guidance", page last updated 7 November 2025. https://www.england.nhs.uk/long-read/the-provider-selection-regime-statutory-guidance/ ↩

  18. NHS England, "Commercial". https://www.england.nhs.uk/commercial/ ↩

  19. Atamis supplier support, "Registering with a supplier portal". https://suppliersupport.atamis.co.uk/hc/en-gb/articles/4613254620319-Registering-with-a-Supplier-Portal ↩↩

  20. GOV.UK, Procurement Act 2023 guidance: below-threshold contracts, updated 13 July 2026. https://www.gov.uk/government/publications/procurement-act-2023-guidance-documents-define-phase/guidance-below-threshold-contracts-html ↩

  21. NHS England, "Greener NHS: suppliers" (Net Zero Supplier Roadmap). https://www.england.nhs.uk/greenernhs/get-involved/suppliers/ ↩↩↩↩↩↩↩

  22. NHS Supply Chain, "Contract and tender process". https://www.supplychain.nhs.uk/suppliers/contract-and-tender-process/ ↩↩↩↩↩↩↩↩↩↩

  23. Data Security and Protection Toolkit, "News": 2026-27 toolkit published 2 October 2026. https://www.dsptoolkit.nhs.uk/News ↩↩

  24. NHS England Digital, "Clinical risk management standards", edited 11 October 2024. https://digital.nhs.uk/services/clinical-safety/clinical-risk-management-standards ↩

  25. NHS England Digital, "Digital Technology Assessment Criteria (DTAC)". https://digital.nhs.uk/services/digital-technology-assessment-criteria-dtac ↩↩

  26. GOV.UK, "Regulating medical devices in the UK", updated 20 February 2026. https://www.gov.uk/guidance/regulating-medical-devices-in-the-uk ↩

  27. NHS England, "The MedTech Funding Mandate". https://www.england.nhs.uk/aac/what-we-do/how-can-the-aac-help-me/the-medtech-funding-mandate/ ↩↩

  28. Health Innovation Manchester. https://healthinnovationmanchester.com/ ↩

  29. Health Innovation North West Coast. https://www.healthinnovationnwc.nhs.uk/ ↩

  30. GOV.UK, PPN 001: SME and VCSE procurement spend targets. https://www.gov.uk/government/publications/ppn-001-sme-and-vcse-procurement-spend-targets/procurement-policy-note-001-sme-and-vcse-procurement-spend-targets-html ↩

  31. Government Commercial Agency, "Suppliers". https://www.gca.gov.uk/suppliers ↩↩

  32. Government Commercial Agency, G-Cloud 15 (RM1557.15). https://www.gca.gov.uk/agreements/RM1557.15 ↩

  33. Government Commercial Agency, G-Cloud 14 (RM1557.14). https://www.gca.gov.uk/agreements/RM1557.14 ↩

  34. GOV.UK, PPN 014: Cyber Essentials scheme, 17 February 2025. https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-html ↩↩↩↩↩↩↩↩↩↩↩↩

  35. GOV.UK, PPN 006: taking account of Carbon Reduction Plans in the procurement of major government contracts. https://www.gov.uk/government/publications/ppn-006-taking-account-of-carbon-reduction-plans-in-the-procurement-of-major-government-contracts/ppn-006-taking-account-of-carbon-reduction-plans-html ↩↩↩↩↩

  36. GOV.UK, PPN 006 technical standard for completing Carbon Reduction Plans. https://www.gov.uk/government/publications/ppn-006-taking-account-of-carbon-reduction-plans-in-the-procurement-of-major-government-contracts/ppn-006-technical-standard-for-completion-of-carbon-reduction-plans-html ↩↩↩↩↩↩↩

  37. GOV.UK, PPN 018: how to take account of a supplier's approach to payment in the procurement of major contracts, applying from 1 October 2025. https://www.gov.uk/government/publications/ppn-018-how-to-take-account-of-a-suppliers-approach-to-payment-in-the-procurement-of-major-contracts/ppn-018-how-to-take-account-of-a-suppliers-approach-to-payment-in-the-procurement-of-major-contracts-guidance-html ↩↩↩↩

  38. GOV.UK, PPN 021: payment spot checks in public sub-contracts. https://www.gov.uk/government/publications/ppn-021-payment-spot-checks-in-public-sub-contracts/ppn-021-payment-spot-checks-in-public-sub-contracts-html ↩

  39. GOV.UK, PPN 009: tackling modern slavery in government supply chains, scope extended to NHS bodies 15 April 2025. https://www.gov.uk/government/publications/ppn-009-tackling-modern-slavery-in-government-supply-chains/ppn-009-tackling-modern-slavery-in-government-supply-chains-html ↩↩

  40. GOV.UK, Procurement Act 2023 guidance: electronic invoicing and payment, updated 20 July 2026. https://www.gov.uk/government/publications/procurement-act-2023-guidance-documents-manage-phase/guidance-electronic-invoicing-and-payment-html ↩↩↩

  41. GOV.UK, Procurement Act 2023 guidance: payments compliance notices, updated 20 July 2026. https://www.gov.uk/government/publications/procurement-act-2023-guidance-documents-manage-phase/guidance-payments-compliance-notices-html ↩

  42. GOV.UK, Government Baseline Personnel Security Standard, version 7.0, June 2024. https://www.gov.uk/government/publications/government-baseline-personnel-security-standard ↩

  43. GOV.UK, "National security vetting: clearance levels", updated 23 September 2024. https://www.gov.uk/government/publications/united-kingdom-security-vetting-clearance-levels/national-security-vetting-clearance-levels ↩

  44. NWUPC, "Become a supplier". https://www.nwupc.ac.uk/become-a-supplier/ ↩↩↩↩

  45. University of Manchester, "Bidding for contracts". https://www.staffnet.manchester.ac.uk/procurement/supplying/bidding-for-contracts/ ↩

  46. Fusion21, home page. https://www.fusion21.co.uk/ ↩

  47. Fusion21, "Become a supplier". https://www.fusion21.co.uk/become-a-supplier ↩

  48. Procure Plus, frameworks, dynamic purchasing systems and "Procurement Act 2023 and social housing". https://www.procure-plus.com/procurement-act-2023-social-housing/ ↩↩

  49. Efficiency North, "EN:Procure: become a supplier". https://www.efficiencynorth.org/en-become-a-supplier/ ↩

  50. BlueLight Commercial, home page. https://bluelightcommercial.police.uk/ ↩

  51. BlueLight Commercial, "Suppliers". https://bluelightcommercial.police.uk/suppliers/ ↩↩

  52. Go4Growth. https://www.go4growth.co.uk/ ↩

  53. Network Rail, "Information for SMEs". https://www.networkrail.co.uk/industry-and-commercial/supply-chain/information-for-smes/ ↩↩

  54. Achilles, "UVDB". https://www.achilles.com/community/uvdb/ ↩↩↩

  55. Electricity North West, "Procurement". https://www.enwl.co.uk/about-us/aboutus/procurement/ ↩

  56. Manchester Airports Group, "Procurement and contracts". https://www.magairports.com/work-with-us/procurement-and-contracts/ ↩

  57. Transport for Greater Manchester, "Procurement". https://tfgm.com/procurement ↩

  58. Department for Education, "Get help buying for schools". https://get-help-buying-for-schools.education.gov.uk/ ↩

  59. GOV.UK, "Buying for schools", updated 16 October 2025. https://www.gov.uk/guidance/buying-for-schools ↩↩

  60. The Procurement (Amendment) Regulations 2026, SI 2026/360. https://www.legislation.gov.uk/uksi/2026/360/made ↩↩

  61. Companies House, "Identity verification" (checked 18 October 2026; no fee is stated for verifying through GOV.UK One Login). https://changestoukcompanylaw.campaign.gov.uk/identity-verification/ ↩↩

  62. GOV.UK, Procurement Act 2023 guidance: conditions of participation, updated 17 August 2026. https://www.gov.uk/government/publications/procurement-act-2023-guidance-documents-procure-phase/guidance-conditions-of-participation-html ↩↩↩↩↩↩↩↩

  63. GOV.UK, "Employers' liability insurance". https://www.gov.uk/employers-liability-insurance ↩↩↩

  64. Hiscox, "How much does professional indemnity insurance cost?" (the page does not say whether the example figures are annual). https://www.hiscox.co.uk/business-insurance/faq/how-much-does-professional-indemnity-insurance-cost ↩

  65. NCSC, "Cyber Essentials: overview" and FAQs. https://www.ncsc.gov.uk/cyberessentials/overview ↩↩↩↩↩↩↩↩↩

  66. Amtivo, "ISO 9001 certification". https://amtivo.com/uk/standards/iso-9001/certification/ ↩↩

  67. SSIP, home page, figure correct at 12 January 2026. https://ssip.org.uk/ ↩↩

  68. CHAS, "Pricing". https://www.chas.co.uk/pricing/ ↩↩↩↩↩↩

  69. Constructionline, "Sub-contractor memberships". https://www.constructionline.co.uk/products-services/memberships/sub-contractor-memberships/ ↩

  70. GOV.UK, "DBS check requests: guidance for employers". https://www.gov.uk/guidance/dbs-check-requests-guidance-for-employers ↩↩↩

  71. GOV.UK, "DBS Update Service". https://www.gov.uk/dbs-update-service ↩↩↩

  72. The Data Protection (Charges and Information) (Amendment) Regulations 2025, SI 2025/63, from 17 February 2025. https://www.legislation.gov.uk/uksi/2025/63/made ↩↩↩↩↩

  73. ICO, "Contracts" (processor contracts and Article 28), checked 18 October 2026. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/contracts/ ↩↩

  74. GOV.UK, "Publish an annual modern slavery statement", updated 25 April 2024. https://www.gov.uk/guidance/publish-an-annual-modern-slavery-statement ↩↩

  75. Cabinet Office, Modern Slavery Assessment Tool. https://supplierregistration.cabinetoffice.gov.uk/msat ↩↩↩↩

  76. SME Climate Hub. https://smeclimatehub.org/ ↩

  77. Living Wage Foundation, "What is the real Living Wage", rates announced 15 October 2026. https://www.livingwage.org.uk/what-real-living-wage ↩

  78. Living Wage Foundation, FAQs: accreditation fees. https://www.livingwage.org.uk/faqs ↩↩↩↩↩

  79. Ministry of Justice, Bribery Act 2010 guidance, updated 22 January 2025. https://www.gov.uk/government/publications/bribery-act-2010-guidance ↩↩

  80. GOV.UK, Procurement Act 2023 guidance: exclusions. https://www.gov.uk/government/publications/procurement-act-2023-guidance-documents-procure-phase/guidance-exclusions-html ↩↩↩↩

  81. GOV.UK, "Check a job applicant's right to work". https://www.gov.uk/check-job-applicant-right-to-work ↩↩

  82. GOV.UK, "Penalties for employing illegal workers". https://www.gov.uk/penalties-for-employing-illegal-workers ↩↩

  83. GOV.UK, "Business transfers, takeovers and TUPE". https://www.gov.uk/transfers-takeovers ↩

  84. GOV.UK, Procurement Act 2023 guidance: key performance indicators, updated 20 July 2026. https://www.gov.uk/government/publications/procurement-act-2023-guidance-documents-manage-phase/guidance-key-performance-indicators-html ↩

  85. GOV.UK, Procurement Act 2023 guidance: Central Digital Platform and publication of information, updated 17 August 2026. https://www.gov.uk/government/publications/procurement-act-2023-guidance-documents-procure-phase/guidance-central-digital-platform-and-publication-of-information-html ↩↩

  86. Cabinet Office, Debarment List version 1.0, effective 17 November 2025 (PDF). https://assets.publishing.service.gov.uk/media/69cbc2028017673ffec0f329/2025-11-17_OFFICIAL-_Debarment_List_V1.0.pdf ↩

Written for businesses, founders and researchers in the North West of England and checked against the sources listed above on 18 October 2026. Funders change their rules, so always read the current call before you apply. Spotted something out of date? Tell us.

Public contractsHow public procurement works now: a bidder's map of the Procurement Act 2023One map of the Procurement Act 2023: what changed, each stage of a contract and your move at it, 2026 thresholds, financial tests, payment and where SMEs win.21 min readPublic contractsFinding tenders and choosing the ones to bid forWhere public contracts appear, how to watch them free, how to read a notice in ten minutes, and a bid/no-bid screen so you stop chasing everything.19 min readPublic contractsHow to get on a framework, and win work once you are on itWhich frameworks matter for North West firms, when each opens, what joining costs, and how call-offs are actually won. A place is a licence to compete, not an order.21 min readPublic contractsSocial value that scores: PPN 002, the TOMs and commitments you can keepWhat counts as social value, how central government, councils and the NHS score it, every North West weighting with its source, and a template for commitments that win marks and survive as contract KPIs.21 min readPublic contractsSelling innovation to the public sector: Contracts for Innovation, SBRI Healthcare and the NHSContracts that pay 100% of development costs, how SBRI Healthcare and Innovate UK score them, the NHS buying rules (PSR, DTAC, Supply Chain) and the North West front doors, at October 2026.20 min read

Put it to work

Find live opportunities → Get email alerts All guides