Supplier information

Private sector

Introduction or inbound enquiry, a technical call, then a written proposal with a fixed price or a day rate. Above roughly £50,000 a procurement team joins and the supplier is checked for insurance, financial standing and security posture. Many larger organisations buy only from a preferred-supplier list, so getting onto that list is a separate exercise from winning the work.

Public sector

Public bodies buy through Crown Commercial Service frameworks, most often G-Cloud on the Digital Marketplace for cloud and analytics services, or through Digital Outcomes-style routes for delivery teams. Above-threshold requirements are advertised on Find a Tender, and the Procurement Act 2023 regime governs the process. Direct award is possible under a framework and is far quicker than an open competition.

Who has to say yes

1. Budget holder, usually a finance director, CIO or head of data
2. IT and information security review, increasingly including a supplier questionnaire
3. Procurement, for value above the delegated authority threshold
4. Legal, for the master agreement rather than the statement of work

Documents expected

• Certificate of incorporation and latest filed accounts
• Professional indemnity, public liability and employer's liability insurance certificates
• Cyber Essentials or Cyber Essentials Plus, effectively mandatory for public-sector work
• Data processing agreement under UK GDPR Article 28
• Completed security questionnaire, often a standard set the client reuses
• Two or three client references in a comparable sector

Private sector

A local sponsor agrees the work, then the supplier is onboarded into a group procurement system (Ariba, Coupa or similar), which can take several weeks and is a separate process from winning the engagement. The group master agreement usually overrides local terms, and a purchase order must exist before any invoice will be paid.

Public sector

Public bodies buy through eTenders, with framework agreements run by the Office of Government Procurement. Above EU thresholds the requirement also appears on TED. Many framework mini-competitions are decided on a scored submission rather than a meeting, so the written response matters more than the relationship.

Who has to say yes

1. Local sponsor, head of data, finance director or country manager
2. Group procurement, frequently in another country and another time zone
3. Information security and privacy review, often against a standard questionnaire
4. Legal, usually applying a group master agreement rather than negotiating a new one

Documents expected

• Tax clearance certificate from Revenue, checked routinely, including for non-resident suppliers
• Certificate of incorporation and company registration details
• Insurance certificates, with professional indemnity at the level the group policy requires
• Data processing agreement under EU GDPR Article 28
• Security questionnaire, often a standardised set such as SIG or CAIQ
• Supplier portal registration and bank details verification

Private sector

The business area issues a Lastenheft describing what it needs, or asks the supplier to produce a Pflichtenheft specifying how it will be delivered. The supplier responds with a formal Angebot: itemised positions, a stated Tagessatz or fixed price, delivery dates and acceptance criteria. The Einkauf then negotiates commercial terms separately from the technical discussion, and a Betriebsrat consultation runs in parallel wherever the system could be used to assess individual employee performance.

Public sector

Public bodies procure through e-Vergabe and the Land Vergabeportale under VgV above EU thresholds and UVgO below them, with above-threshold notices also published on TED. The process is formal, the award criteria are published in advance, and a submission that misses a formal requirement is excluded regardless of quality.

Who has to say yes

1. Fachbereich, the business area that owns the requirement
2. IT, for architecture and operability
3. Datenschutzbeauftragter, for the AVV and the processing position
4. Betriebsrat, wherever employee performance could be derived from the reporting
5. Einkauf, for commercial terms
6. Geschäftsführung, above the delegated authority threshold

Documents expected

• Handelsregisterauszug, a current commercial register extract
• Unbedenklichkeitsbescheinigung for tax and social security contributions
• Betriebshaftpflicht and professional indemnity insurance certificates
• Auftragsverarbeitungsvertrag (AVV), the Article 28 processing agreement, in German
• Referenzen: named comparable projects, frequently with a contactable referee
• ISO 27001 certification where IT security matters, or TISAX in the automotive supply chain

Private sector

A relationship and a reference open the door; a formal supplier onboarding then decides whether the work can proceed. Expect a security questionnaire, financial checks and, in financial services, an outsourcing assessment against the FINMA circular with documented audit rights and a tested exit plan. Background checks on individual engineers are routine in banking, and some clients require that named staff never move data outside Switzerland.

Public sector

Federal and cantonal bodies publish on SIMAP under BöB at federal level and IVöB at cantonal level, with WTO/GPA thresholds determining the procedure. Cantonal rules differ, and language requirements follow the canton.

Who has to say yes

1. Fachstelle, the business owner
2. IT security, with a questionnaire and frequently an architecture review
3. Datenschutz, against the revFADP rather than an EU-shaped pack
4. Einkauf for commercial terms
5. Outsourcing or risk committee, in regulated financial services
6. Geschäftsleitung, for anything touching client-identifying data

Documents expected

• Handelsregisterauszug, current commercial register extract
• Betreibungsregisterauszug, a debt enforcement register extract, requested more often than people expect
• Insurance certificates including professional indemnity, in CHF cover levels
• Data processing agreement drafted against the revFADP, not a translated EU template
• Security questionnaire, frequently the client's own rather than a standard
• Confidentiality undertakings, and in banking a criminal record extract for named staff

Private sector

Many Belgian organisations are the European hub of a larger group, so a local sponsor agrees the requirement and a group procurement function runs the contracting. Documentation frequently has to exist in Dutch and French as well as English, and works council consultation applies to anything that could monitor individual performance.

Public sector

Federal bodies publish on the Belgian e-Procurement platform, with above-threshold notices on TED. Flanders, Wallonia and the Brussels-Capital Region each run their own procurement for regional competences. The EU institutions in Brussels procure through their own calls and framework contracts, which are a separate discipline with longer timescales and heavier formal requirements.

Who has to say yes

1. Local sponsor, head of data, IT manager or finance director
2. Group IT and procurement, often outside Belgium
3. DPO, for the processing position and the DPA
4. Ondernemingsraad / conseil d'entreprise, for employee-related reporting
5. Legal, applying either Belgian law or the group agreement

Documents expected

• KBO / BCE enterprise number and registration extract
• Attestations for social security (ONSS / RSZ) and tax, routinely requested in public procurement
• Insurance certificates including professional indemnity
• Data processing agreement under EU GDPR Article 28
• Security questionnaire, often the group's standard
• Evidence that employee-facing documentation can be delivered in the language of the region