UK Law and Practice Contributed by: Richard Brown, Louisa Chambers, Adam Wyman and Michael Ross, Travers Smith LLP
Public Sector Outsourcings Depending on the nature of the contract and its val - ue, a public sector outsourcing can be subject to UK public procurement rules – although these apply to a wide range of contracts, not just outsourcing transac - tions. By way of example, the awarding authority can be required to advertise the contract, observe cer - tain timings with regard to responses to tender, etc, and ensure that all bidders are treated equally and without discrimination. Public procurement rules are most likely to have a significant effect on the timing of the pre-contract procedure, the criteria for selec - tion of successful tenderers, and the duration of the outsourcing contract. Following the UK’s departure from the EU, UK public procurement law has been reformed and new legisla - tion in the form of the Public Procurement Act 2023 came into effect on 24 February 2025. This legislation aims to create a more streamlined, efficient and trans - parent system for public bodies. Although the new Act therefore makes some aspects of public procurement more straightforward, the reforms are more evolution - ary than revolutionary. The Act does not have retrospective effect and there - fore will not affect procurements commenced before 24 February 2025. It should also be borne in mind that, owing to the provisions of the Brexit Withdrawal Agreement, EU public procurement rules continue to apply in limited circumstances – for example, to framework contracts where the tender process (for the framework itself) was commenced on or before 31 December 2020. Critical Infrastructure and National Security Organisations supplying critical national infrastructure – for example, those in sectors such as electricity sup - ply, oil and gas, water, transportation, healthcare and digital infrastructure (including cloud computing stor - age providers) – and meeting certain size thresholds are subject to the Network and Information Systems Regulations (the “NIS Regulations”). The UK gov - ernment plans to introduce the Cyber Security and Resilience Bill by the end of 2025. This is expected to place greater emphasis on the importance of supply chain cyber management and make the regulations applicable to a broader range of digital services pro -
viders. At the time of writing (September 2025), the Cyber Security and Resilience Bill has not yet been introduced to Parliament. In brief, the NIS Regulations require in-scope organi - sations to: • take appropriate and proportionate technical and organisational measures in order to manage the security risks posed to them (eg, measures to pro - tect against cyber-attacks); and • report incidents to regulators in certain circum - stances. Where organisations are outsourcing the provision, management or maintenance of any element of the systems on which they rely to provide such infrastruc - ture, they will need to consider how to ensure that the outsourced activities continue to meet the standards required by the NIS Regulations. More generally, outsourcings involving critical infra - structure and other matters regarded as important to UK national security may be subject to scrutiny under the National Security and Investment Act 2021. This allows the UK government to review (and, in extreme cases, to block) the transfers of certain businesses or assets on the grounds of protecting national security. Other Sectors The parties to an outsourcing will also need to con - sider any relevant sector-specific regulations, such as requirements for licences or authorisations. These are not normally intended to regulate outsourcing per se but, rather, to regulate the activity that is covered by the outsourcing. In the UK, the sectors listed below are subject to industry-specific regulation by the regu - lator listed in brackets: • aviation (Civil Aviation Authority); • consumer credit (FCA); • education and childcare (Ofsted); • energy (Ofgem); • food (Food Standards Agency); • gambling (Gambling Commission); • health and social care (Care Quality Commission); • medicines and medical devices (Medicines and Healthcare Products Regulatory Agency);
69 CHAMBERS.COM
Powered by FlippingBook