Central government AI buying of £5m or more now has a national security gate before tender, and suppliers should expect the questions in the bid

The Cabinet Office has set out, in Procurement Policy Note 025, a national security gate that sits ahead of procurement launch. It applies to central government departments, executive agencies and non-departmental public bodies, and it requires those bodies to run review pipelines for procurements in four sectors: shipbuilding, steel, AI and energy infrastructure.

Where a procurement falls within one of those sectors, the buyer must engage the relevant Sector Lead before launching it. That step happens before a tender reaches the market, which means the commercial and security assumptions behind the procurement are settled, at least in outline, before any supplier sees them.

For a supplier, the first discipline is to find out early whether a prospective procurement sits in one of the four sectors. A bid team that learns of the gate only when security questions arrive in the tender pack has lost the chance to prepare evidence, and the commercial team will be answering technical questions on the buyer’s timetable rather than its own.

For AI, the Cabinet Office has stated that the trigger is a procurement substantially related to AI with a value of £5m or more. The note identifies three categories within that: AI hardware, AI for Critical National Infrastructure, and AI that handles sensitive or personal data, with health, financial and biometric data given as the examples.

The third category is the one most likely to catch software and services suppliers. A platform that processes health, financial or biometric data on behalf of a department can fall within the gate even where it has no connection to hardware or infrastructure. Suppliers should assume that a large AI contract involving sensitive personal data will be treated as a gated procurement unless the buyer says otherwise.

Suppliers should also avoid reading the £5m figure as a safe harbour. It is the stated trigger for AI procurements, but the categories (hardware, Critical National Infrastructure, sensitive or personal data) describe the kind of risk the buyer is concerned with. Framework call-offs, extensions and variations should be checked against the same description rather than assumed to fall outside it.

The Cabinet Office has stated that buyers must carry out a national security assessment covering three areas: the supply chain, market concentration and disruption. Those headings are, in effect, the questions the buyer will be asking about your business and the product you propose to supply.

Buyers must also consider the national security exemption in Schedule 2 of the Procurement Act 2023, case by case, and keep a written rationale for that consideration. The practical consequence is a documented trail. A supplier whose answers on supply chain and concentration are vague gives the buyer little to record in support of a competitive procurement.

Each of the three assessment headings can be answered with documents a supplier already holds or can readily prepare: a sub-processor and subcontractor register, a statement of dependency on any single provider, and a continuity plan. The contractual risk lies in giving answers at bid stage that the delivery team cannot later substantiate, because those answers may be repeated in the contract as warranties.

The note does not impose obligations on suppliers directly. There is no clause that must be written into every AI contract because of PPN 025, and no certification a supplier must hold simply because the note exists.

The effects are indirect. Competition for gated procurements may be restricted, and where a procurement is exempted there may be a preference for UK sources. In practice that means the buyer’s assessment will surface in the bid documents as supply-chain, data-location and sub-processor questions, and in the contract as warranties and information rights that evidence your answers. A supplier that has not mapped its own sub-processors and hosting locations will find those questions hard to answer under bid timelines.

The commercial lesson is to treat the security questionnaire as part of the contract, not as a preliminary to it. Where the bid response is incorporated into the agreement, an inaccurate statement about hosting location or sub-processors becomes a breach risk. Suppliers should have the answers reviewed by legal and delivery together before submission.

This is not a fresh development. The note was published on 19 June 2026, and the only update, on 3 July 2026, was a change of contact email address. It is covered here because it remains the live operative gate for central government AI procurement, and because suppliers are likely to meet its effects in tenders now being prepared.

The point for supplier planning is timing. A gated procurement has already been through its security review by the time it is published, so the useful work for a supplier is done earlier: understanding your own supply chain, concentration exposure and data handling before a bid is requested, not after.

Suppliers should therefore plan for the possibility that tenders in this area are reviewed more slowly before launch, and that the bid window, once open, is used to test evidence rather than to introduce new questions. Building a reusable pack on supply chain, data location and concentration is more efficient than answering each tender from scratch.

The following is drafting advice rather than a statement of what PPN 025 requires, since the note places no direct obligations on suppliers. It is aimed at keeping the commitments you give at bid stage accurate, evidenced and allocated.

• Supply-chain disclosure, a schedule listing material sub-processors and subcontractors, with a notification and approval process for changes.
• Data location, an express statement of where sensitive or personal data is stored and processed, with a restriction on moving it without consent.
• Concentration and disruption, warranties and continuity commitments that match what you told the buyer about dependency on single suppliers, plus exit and step-in support.
• Evidence rights, audit and information provisions that let the buyer verify your answers, with the cost and scope of audits settled in advance.
• Change in circumstances, a mechanism for what happens if a sub-processor, hosting location or ownership position changes after award, including notice, remediation and termination rights.