---
title: "National Security in Procurement: Turning New Policy into Proportionate Assurance"
canonical: "https://prestigecommercialconsulting.co.uk/articles/national-security-procurement"
author: "Prestige Commercial Consulting Limited"
category: "Governance and Risk"
published: "2026-08-17"
modified: ""
read_time: "8 min read"
keywords: ["UK public procurement", "Governance and Risk", "Procurement Act 2023", "contract management", "supplier readiness", "procurement evaluation", "AI in procurement"]
---

# National Security in Procurement: Turning New Policy into Proportionate Assurance

PPN 025 puts national-security thinking into relevant procurement pipelines. The practical task is proportionate assurance, not blanket supplier preference.

National security is now a more explicit procurement consideration in certain strategically important markets. The immediate task is not to add a generic security paragraph to every tender. It is to identify the procurements where national-security exposure is relevant, build a proportionate evidence base early and select controls that address the actual risk without losing sight of the authority's other legal obligations.

PPN 025 gives central government a structured prompt to do that in shipbuilding, steel, artificial intelligence and energy infrastructure. Its limits matter as much as its ambition: it is not a universal statutory rule, the relevant sectors are not automatically exempt, and the national-security exemption is not an automatic direct-award route.

## Start with the policy scope and the live pipeline

[PPN 025](https://www.gov.uk/government/publications/ppn-025-protecting-the-uks-national-security-through-public-procurement/ppn-025-protecting-the-uks-national-security-through-public-procurement-html) applies only to central government departments, their executive agencies and non-departmental public bodies. These are the policy's in-scope organisations. They should apply it with immediate effect to relevant procurements in the four critical sectors, using the accompanying guidance and engaging early with the relevant Sector Lead.

Other contracting authorities are not brought into the PPN merely because they are contracting authorities under the Procurement Act 2023. They can consider their own pipelines in the context of the guidance and are encouraged to engage Sector Leads for high-value, complex or national-interest procurements. Private utilities are strongly encouraged to apply the PPN and guidance to relevant energy-infrastructure procurement and to engage the Sector Lead. State these distinctions accurately in governance papers: the PPN is central-government policy, not a general statutory duty.

The definition of a relevant procurement is sector-specific and may be updated as Sector Leads develop their market and pipeline assessment. The [PPN 025 guidance](https://www.gov.uk/government/publications/ppn-025-protecting-the-uks-national-security-through-public-procurement/guidance-to-procurement-policy-note-025-protecting-the-uks-national-security-through-public-procurement-html) identifies steel procurements valued at £10 million or more, or expected to require more than 500 tonnes of steel; shipbuilding procurements over £1 million within the defined maritime scope; and specified AI procurements or elements valued at £5 million or more. Energy-infrastructure scope is defined by sub-sector, including electrical equipment and other infrastructure identified by the Sector Lead, rather than by one generic value threshold. Check the live Annex A and, where uncertain, ask the Sector Lead before deciding that a procurement is out of scope.

## Identify the risk before choosing the control

For a relevant procurement, the guidance says that the authority should assess the national-security implications, including supply-chain risk, before commencing it. The evidence should address the criticality of the capability or service, vulnerabilities in the supply chain, market concentration, dependency and the consequences of disruption or loss of supply. A category label alone does not establish a security case.

That analysis keeps assurance proportionate. A lower-risk procurement may need a clear owner, suitable supplier checks and ordinary contractual controls. A highly critical requirement may need deeper examination of infrastructure, data flows, key components, manufacturing capacity, subcontractors, continuity arrangements and incident response. Record both the assessed risk and why the selected mitigations are adequate; an extensive questionnaire without a risk rationale adds paperwork but not necessarily assurance.

Separate established facts from assumptions. Map essential dependencies, identify the source and limits of market intelligence, distinguish a contractual risk from a wider market risk and decide what information can be safely shared. For in-scope organisations, early engagement with commercial, legal, policy and security stakeholders, as well as the Sector Lead, is part of the PPN's intended approach.

## Do not confuse national security with a blanket UK preference

The national-security exemption is in paragraph 25 of Schedule 2 to the Procurement Act 2023. The [official PPN 025 guidance](https://www.gov.uk/government/publications/ppn-025-protecting-the-uks-national-security-through-public-procurement/guidance-to-procurement-policy-note-025-protecting-the-uks-national-security-through-public-procurement-html) says it is available to all contracting authorities where they consider that, in the interests of national security, a contract should not be subject to all or part of the Act. It does not apply automatically to procurement in the four sectors. Each use requires a case-by-case, evidence-based national-security rationale; an authority cannot rely on it simply to secure an economic advantage for itself.

The exemption gives more freedom to determine the appropriate procurement approach where national-security interests are involved, including whether only part of the Act should be disapplied. It does not create a simple power to favour a domestic supplier or remove the need for commercial judgement. The guidance asks teams to consider the full range of options, including ordinary procurement mechanisms, contractual protections, supplier assurance, social-value criteria where relevant and proportionate, and market-shaping approaches, before deciding that the exemption is justified.

International obligations remain important. Exempted contracts are not subject to the covered-procurement rules, but they remain subject to Act provisions relating to procurement, including the duty not to discriminate against a treaty-state supplier where applicable. The guidance says that use of the exemption must be consistent with the United Kingdom's trade agreements and that any relevant trade-agreement exception must be justified on its own terms. Do not infer a domestic-only result from the existence of a national-security concern.

## Build assurance into the procurement, not after it

For a relevant procurement, start in the requirement. Describe the resilience or security outcome needed in a way that connects to the contract. Depending on the risk, that may address continuity, provenance, data or component security, supply-chain reporting, controlled subcontracting or recoverable transition. It should be specific enough to assess and manage, but not prescribe a familiar solution without evidence that the restriction is necessary.

Use market analysis and early engagement to test whether the market can meet the outcome, where bottlenecks and dependencies sit and whether an intended intervention could unintentionally reduce resilience. The PPN expects in-scope bodies to engage a Sector Lead; other authorities may need equivalent internal expertise and credible market intelligence. Keep a record of what was shared and how potential conflicts, confidential information and unfair supplier advantage were managed.

During selection and award, ask for evidence that is proportionate to the identified risk. State what is sought, how it will be verified, what must be maintained and what happens if a critical dependency changes. Any criterion used to assess tenders should be linked to the contract, clear, measurable, specific and proportionate, with an explainable assessment method.

## Keep a defensible decision record

Where the exemption is considered, the appropriate commercial, legal and project leadership should make and record the decision at the time. The record should identify the national-security interest, the evidence, the options considered, the selected mitigations, the parts of the Act affected and the trade-agreement analysis. Where legal interpretation is material, seek legal advice. A rationale written after challenge is not a substitute for a contemporaneous record.

The guidance specifically expects a final decision on whether the Act is disapplied in whole or part to be recorded when the exemption is used. It also recommends checking the debarment list. These are not administrative afterthoughts: they give the authority a way to explain how it balanced resilience, competition, transparency and international obligations in the facts of the particular procurement.

## Carry the assurance into contract management

A tender cannot preserve resilience if assurance stops at award. Contract-management arrangements should give a named owner visibility of critical dependencies through agreed evidence updates, notification of material supply-chain or ownership changes, continuity review, change control and incident escalation. Focus on the controls that show whether the intended resilience outcome is holding, ensure they are reflected in the contract and handle sensitive information appropriately.

The main takeaway is to treat PPN 025 as a prompt for evidence-led commercial judgement. Identify a relevant procurement, understand the actual risk, engage the right specialists, select the least intrusive effective controls and record why the approach is justified. That is stronger than either ignoring a genuine exposure or treating policy as a blanket preference for one supplier category.

[Prestige's services](https://prestigecommercialconsulting.co.uk/services) include governance, risk and compliance reviews, tender-document support and evaluation assurance. For organisations developing a reusable evidence structure, the [Supplier Assurance & Evidence Pack](https://prestigecommercialconsulting.co.uk/digital-products/supplier-assurance-evidence-pack) is available on its direct product page. Prestige can help organise evidence and controls; clients retain responsibility for risk appetite, legal judgements, approvals and procurement decisions.

## Important scope note

This article is general information, not legal advice. PPN 025, the national-security exemption and trade-agreement considerations are fact-specific and may change. Readers should check current law, guidance and their own organisation-specific rules before acting.

## About this article

Published by [Prestige Commercial Consulting Limited](https://prestigecommercialconsulting.co.uk/about).
Canonical HTML: [https://prestigecommercialconsulting.co.uk/articles/national-security-procurement](https://prestigecommercialconsulting.co.uk/articles/national-security-procurement)

This article provides general procurement information and does not constitute legal advice.