Procurement rules for UK public sector buyers of customer success software

What to take away

What UK public sector buyers expect from customer success software

UK public sector buyers are not shopping for a generic retention tool. They want a system that can hold citizen or service-user records lawfully, report on outcomes to a board or elected member, and survive an audit by the Information Commissioner's Office.

A local authority in the West Midlands or a Scottish health board will ask how your platform handles subject access requests. A regulator such as Ofcom or the Financial Conduct Authority will ask how consent and contact history are evidenced. HMRC teams working on Making Tax Digital want audit trails that stand up years later.

That changes the product conversation. Dashboards and health scores matter less than data residency, retention schedules and role-based access. Buyers in Greater London and the South East often run larger estates and expect integration with existing case management or CRM systems.

Smaller bodies in Wales, the North West or the East of England may have no dedicated procurement team. They rely on framework agreements to do the heavy lifting on terms, which is why the route to market matters as much as the software.

Public bodies also expect suppliers to show social value. Under the Procurement Act 2023, central government tenders must award at least 10 per cent of the total score to social value, covering local employment, skills and environmental goals. Other public bodies set their own weightings.

Expect buyers to ask for a proof of concept on their own data, not a sandbox. They will want to see how your tool handles a messy legacy export from a system built in the 2000s.

Finally, buyers expect honesty about what the software cannot do. Overclaiming on artificial intelligence or automation is the fastest way to fail a clarification question.

Crown Commercial Service frameworks and how they are used

The Crown Commercial Service, usually shortened to CCS, is the UK government's central purchasing body. It runs frameworks that let public bodies buy without running a full open tender each time. For customer success software, a common route is G-Cloud 14 (RM1557.14), Lot 2 Cloud Software.

CCS frameworks work as umbrella agreements. CCS agrees terms with suppliers once, then public bodies run a further competition or direct award among listed suppliers. This saves time and gives buyers pre-vetted contractual protection.

A buyer in a district council can call off from a framework without advertising in Find a Tender. That is a significant advantage when the requirement is urgent, for example when a service is migrating off a legacy CRM.

Framework agreements typically last two to four years, with options to extend. Suppliers must reapply when a framework is replaced, so a place on one is not permanent. Track CCS pipeline notices to know when a replacement is coming.

The national policy context matters here. Government has set out procurement priorities in Procurement in the national interest - GOV.UK. From 2026 the Procurement Act 2023 and its National Procurement Policy Statement set the current rules for CCS lots and award criteria.

Being on a framework does not guarantee sales. Buyers still run mini-competitions, and a supplier with no public sector references will struggle even with a place on the agreement.

CCS also offers a route for smaller suppliers through lots reserved for SMEs. If your customer success software business is under the threshold, check whether a reserved lot fits before bidding for a place on a larger one.

For buyers, the framework is not a substitute for requirements. You still need to define outcomes, data flows and service levels.

Tendering routes, lots and evaluation criteria

There are three common routes for UK public sector software procurement. The first is a CCS further competition. The second is an open tender under the Procurement Act 2023, or under the Public Contracts Regulations 2015 for procurements started before 24 February 2025. The third is a below-threshold award for smaller contracts, which still needs a written justification.

Below-threshold awards are quicker but capped. From 1 January 2024 the central government threshold for goods and services is £139,438; for other public bodies it is £214,904, excluding VAT. Thresholds are reviewed periodically, so check the current published figures.

Above the relevant threshold, the Procurement Act 2023 process is formal and timescales are set in law. Miss a clarification deadline and you are out.

Lots split a framework by category. A customer success software lot might cover CRM, case management or citizen engagement. Bidding for the wrong lot wastes time and can lead to disqualification.

Evaluation is usually split between quality and price. For software, typical weightings are around 60 to 70 per cent for quality and 30 to 40 per cent for price, but treat those as illustrative because the contract notice sets the exact split. Social value is a scored criterion in most central government tenders.

Typical evaluation criteria for customer success software include:

Price is rarely the deciding factor on its own. A cheap licence with expensive implementation and locked-in data migration is a poor deal for a public body.

The tender process itself follows a pattern:

Suppliers should treat the selection questionnaire as a pass or fail gate. Financial standing, insurance and mandatory exclusion grounds are checked before quality is scored.

Buyers should publish a realistic timeline. Rushed tenders attract fewer bids and weaker competition. A four to six month runway is normal for a mid-sized software procurement.

Compliance expectations: security, data protection and accessibility

Compliance is where most customer success software bids fail. Public bodies cannot accept a supplier that has not evidenced basic cyber hygiene.

Cyber Essentials is the baseline for many contracts. It is a government-backed scheme that certifies five technical controls. Some buyers require Cyber Essentials Plus, which includes an independent technical assessment.

The National Cyber Security Centre publishes guidance for suppliers and buyers. The government's own collection of Cyber security guidance for business - GOV.UK is a useful starting point for SaaS vendors preparing evidence. It covers risk management, incident response and supply chain security.

Larger contracts may require alignment with the NCSC's Cyber Assessment Framework. That is common in health, local government and critical national infrastructure, where a breach could affect service delivery.

Data protection is governed by UK GDPR and the Data Protection Act 2018. The Information Commissioner's Office enforces both. A public body remains the data controller when it uses your customer success software, so you are a processor and need a written data processing agreement.

That agreement must cover processing purposes, retention periods, sub-processors, international transfers and breach notification. Transfers outside the UK need an adequacy decision or appropriate safeguards.

The British Standards Institution publishes standards and best practice for data and privacy management. Its guidance on Data & Privacy Standards & Best Practices | BSI helps suppliers map controls to recognised frameworks such as ISO/IEC 27701. Buyers often ask for certification or a clear roadmap to it.

Accessibility is a legal requirement for public sector websites and apps under the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018. The standard is WCAG 2.2 level AA. Your customer success software must meet it if public sector staff or citizens use the interface.

An accessibility statement is mandatory. It must explain how the software meets the standard, known gaps and how users can request alternatives.

Records management matters too. Public bodies must follow retention schedules and the Freedom of Information Act 2000. Your platform needs export, audit and deletion functions that support those duties.

Security questionnaires are common. Expect questions on penetration testing frequency, encryption at rest and in transit, vulnerability disclosure and incident response times. Vague answers are scored down.

For a deeper look at what buyers should verify before shortlisting, see our guide to vendor due diligence.

Contract terms, call-off arrangements and exit planning

A call-off contract is the agreement between a public body and a supplier under a framework. It adopts the framework terms and adds the specific requirement, price and service levels.

Call-off contracts can be direct awards or further competitions. Direct awards are only allowed where the framework permits them and the requirement is clearly within scope.

Key terms to negotiate or confirm include:

Liability caps are often capped at the contract value, which can be a problem for high-risk data. Buyers should push for cover that reflects the potential harm, not just the licence fee.

Public bodies should require data export in an open format, a documented migration path and a defined period of post-termination support.

Suppliers should price exit assistance into the deal rather than treating it as an afterthought. A buyer that feels locked in will not renew, and word travels across the public sector.

The financial terms of a commercial contract for customer success software often include annual uplifts. Public bodies prefer fixed pricing or uplifts capped to a published index.

Payment terms are usually 30 days from a valid invoice. Late payment harms supplier cash flow and is monitored by government departments.

Contract management is ongoing. A named service manager on both sides, quarterly reviews and a live risk register prevent small issues becoming disputes.

Irrecoverable VAT, if applicable, should be stated clearly. Public bodies cannot always recover VAT, so the total cost matters more than the headline licence fee.

A procurement readiness checklist for vendors and buyers

Readiness is the difference between a bid that scores well and one that is rejected at the questionnaire stage. Use this checklist before you commit resources.

For vendors:

For buyers:

The selection checklist that buyers use for shortlisting should be agreed before the tender is published, not after bids arrive.

Government also expects suppliers to protect their own innovation and intellectual property. The Business innovation, protection and cyber security - GOV.UK guidance covers how to handle IP and security in commercial relationships.

A worked example shows the value of preparation. A county council in the East of England needed a customer success platform for its adult social care enquiry team. It ran a further competition under a CCS technology framework with quality weighted at 70 per cent.

Three suppliers bid. The winner had Cyber Essentials Plus, a UK data centre and a two-week exit assistance clause.

The lowest bidder failed on data protection evidence. The contract was signed eleven weeks after the contract notice. That timeline is realistic when requirements are clear. It collapses when buyers change scope mid-tender or suppliers cannot evidence compliance.

Common questions