For many authorities, the national security exemption has traditionally been viewed as relevant only to defence and intelligence procurements. The exemption, set out in paragraph 25 of Schedule 2 of the Act, exempts "a contract that the contracting authority determines should not, in the interests of national security, be subject to this Act or a part of this Act", enabling authorities to run "closed" tender processes (typically to UK owned, located or controlled companies only) and/or award a contract without publishing a Tender Notice or being subject to any other provisions or remedies within the Act.
Through PPN 025: Protecting the UK's national security through public procurement, the Government is encouraging authorities to think more broadly about national security, resilience, critical infrastructure, and strategic supply chains and to consider whether the exemption may be available in wider circumstances.
This briefing sets out the four-stage assessment authorities should undertake before deciding whether reliance on the exemption can be justified.
PPN 025: Protecting the UK's national security through public procurement
PPN025 signals a significant shift in the Government's approach to public procurement. Its central message is that maintaining national security is not limited to defence, intelligence, and counter-terrorism. Contracting authorities should also be considering resilience, critical supply chains, strategic dependencies, and the long-term sustainability of capability that the UK may need in the future.
Exempting the procurement from the Act means that the relevant authority can either make a direct award or identify a more limited number of "safe" companies with whom to entrust the contract without fear of challenge or the need for full transparency in a way which may reveal information integral to the national security.
The PPN sits within a wider Government agenda focused on security of data, strengthening domestic capability, reducing dependency on foreign states and using public procurement to support long-term economic resilience. In that respect, it aligns with other recent policy initiatives, including the new Social Value Model (PPN 026) which prioritises British jobs, skills, and opportunities for people facing barriers to employment.
The four-stage assessment
The absence of a statutory definition of "national security" gives contracting authorities considerable room for judgement, but it also leaves difficult questions about where the boundaries of the exemption lie. Authorities considering reliance on it will therefore need to demonstrate a clear connection between the procurement and the national security interest they are seeking to protect.
The PPN guidance includes a practical four-step framework for authorities considering whether national security concerns may justify reliance on the exemption:
1. Identify the national security interest
Authorities should begin by identifying the specific national security interest engaged. Authorities should consider not only defence and security implications, but also supply chain vulnerabilities, dependency risks, critical infrastructure, and the consequences of disruption to important services.
This requires more than stating that a service is important or that supply disruption would be undesirable. Authorities should identify the specific issue that gives rise to the concern. The clearer the national security interest, the stronger the foundation for the rest of the analysis. A general concern about resilience is unlikely to be enough. A clearly articulated concern about maintaining a critical national capability or protecting the security of essential infrastructure, data or assets is much easier to evidence.
2. Identify why applying the Procurement Act creates a national security risk
The next step is to identify the risk that arises if the authority were to comply with the Act. That might be disclosure of sensitive information through transparency obligations, exposure of vulnerabilities in critical infrastructure, access to sensitive systems or confidential information by unsuitable suppliers or risks to the continuity of a strategically important supply chain.
The guidance encourages authorities to think broadly about these risks rather than limiting themselves to traditional security concerns. However, the risk must be real and identifiable. The importance of a contract is not, by itself, a national security risk.
3. Consider whether that risk can be addressed in another way
Authorities should next consider whether the risk can be addressed through other means within a regulated procurement process. Strict application of the mandatory and discretionary exclusion grounds, non-disclosure agreements, contractual change of control provisions, cyber security requirements, and restrictions on access to information may be sufficient.
4. Demonstrate why use of the exemption is justified
The final stage is evidencing the decision. The guidance emphasises the need for a clear and evidence-based rationale. Authorities should be able to explain the interest they are protecting, the risks they have identified and why the chosen approach is necessary. The guidance also recommends maintaining a written record of the decision-making process and obtaining legal advice where appropriate.
What are the risks of getting it wrong?
The guidance encourages authorities to approach the national security exemption more flexibly, but it doesn't remove the legal risks associated with reliance on the exemption. Should a supplier become aware of its use, it may challenge the award as a non-compliant direct award of a public contract, resulting in automatic suspension (pre-contract award) or an order to set aside (post-contract award), as well as potential damages for the challenger.
Whether the exemption applies or not is for the contracting authority to determine, as such it may be that an application for judicial review of that determination is also made should there be any doubt as to the correct route to challenge.
Practical points for contracting authorities
Authorities considering whether the national security exemption may be available should engage legal, commercial, and operational stakeholders at an early stage. The strongest rationales are likely to be those where national security considerations have informed the procurement strategy from the outset rather than being raised late in the process.
Authorities should also ensure that the rationale for relying on the exemption is recorded contemporaneously. In the event of a challenge, the focus is likely to be on the quality and reasonableness of the authority's analysis based on relevant considerations, the evidence supporting its conclusions and whether alternative options were properly considered.
The message from PPN 025 is clear. Authorities should think more broadly about what constitutes a national security concern. They should not assume, however, that a procurement becomes exempt simply because it relates to an important service, critical infrastructure or a strategically significant sector.
