Britain's £14B Cloud Framework Just Started a Compliance Clock

The G-Cloud Paperwork Layer

Britain has put 4,233 cloud companies on a compliance clock. Most of them will never win a government contract. All of them still have to keep their paperwork valid, every year, or lose their place.

A deadline arrived on August 6

On August 6, 2026, the UK government awarded G-Cloud 15, the framework public bodies use to buy cloud services. Buyers got access in mid-August 2026. It's the largest rebuild since the framework launched in 2012, and the first issued by the Government Commercial Agency, the body created on April 1, 2026 by merging Crown Commercial Service with the Cabinet Office's central commercial teams.

The headline numbers do their job. G-Cloud 15 is expected to carry about £3 billion of public-sector cloud spending a year, roughly £14 billion across its four-year term. 4,233 companies won a place on at least one of its five lots. Around 90% are small and medium-sized businesses. Buyers range from Whitehall departments to NHS trusts to county councils.

The more consequential line sits further down, buried in the framework terms.

Cyber Essentials is now mandatory on every lot. Suppliers on the two hosting lots had to hold Cyber Essentials Plus at application. Everyone else, meaning the software and cloud-support suppliers who make up the bulk of the framework, gets twelve months from the August 6 award to produce a valid certificate. Miss it and you're suspended. Produce the certificate later and you're reinstated.

Cyber Essentials certificates last twelve months. They renew annually, forever.

So the UK government has just attached a recurring, enforcement-backed paperwork obligation to roughly 3,800 small companies at once, with the first hard checkpoint landing around August 2027. Around 35,000 UK organisations hold an active Cyber Essentials certificate. The SME suppliers on this one framework amount to more than a tenth of that entire population, and a large share of them are newly obligated.

The certificate itself is a small job. The obligation it creates is where the business lives.

Here's the opportunity:

The framework stopped being an event

G-Cloud used to be episodic. A new version appeared, suppliers scrambled to apply, the window shut, everyone waited two years for the next one. Bid consultants made their money in the scramble.

G-Cloud 15 runs under the Procurement Act 2023 as an open framework. The Government Commercial Agency says new and growing businesses can join during a reopening window 18 months after go-live, and at intervals across the four-year term. Existing suppliers can refresh their services and pricing at the same points. Digital Outcomes and Specialists 7, which went live on January 30, 2026, works the same way on a six-year term.

A one-off deadline creates a consulting engagement. A framework that keeps reopening for four years turns the same work into maintenance, which is a very different thing to sell.

The volume of material involved is the part people underestimate. The G-Cloud tender library carries separate documents for financial viability assessment, lot-specific technical ability certificates, a quality questionnaire, a carbon reduction plan template, and pricing. Downstream call-off schedules cover security, business continuity, performance, data processing, insurance, sustainability, modern slavery, and Cyber Essentials. The hosting lots demand a Gold-standard financial viability assessment on top. Across the framework, suppliers list tens of thousands of individual services, each needing its own service definition and pricing document kept consistent with the others.

In practice, all of that lives across SharePoint, three Google Drives, a Dropbox nobody has audited since 2024, and the laptop of a sales director who left in March 2026.

What these companies need is a single structured record standing behind every answer they give:

Requirement → claim → supporting document → exact section and page → owner → review date → current version → previous version → reviewer.

That's an evidence graph, and it's a fundamentally different product from chat-with-your-documents or an AI that writes bids for you. The distinction carries the entire business.

Most G-Cloud suppliers are bad customers

The flattering version of this market will bankrupt you, so start with the unflattering one.

A place on the framework isn't a revenue stream. A Tussell analysis of G-Cloud 10 found that only 480 of 3,474 listed suppliers, 14%, won any business at all across the twelve months studied. Crown Commercial Service disputed the count at the time, putting transacting suppliers closer to 965, which still leaves roughly three quarters of the framework earning nothing. The data is old and shouldn't be projected onto G-Cloud 15 directly, but the structure holds: spend concentrates violently. Roughly a tenth of suppliers take well over half of it. The Home Office, HMRC and DWP consistently rank as the largest central-government buyers on the framework.

The SME opportunity is real at the aggregate level. UK public bodies spent £45.2 billion directly with SMEs in 2025, 21% of direct procurement and a six-year high, with local government alone at £29.1 billion. It's just not evenly distributed across the SMEs sitting on this framework.

So your customer isn't "a G-Cloud supplier." It's a company with 10 to 100 employees, one to five cloud services listed, a public-sector pipeline that already matters to its revenue, and a founder or commercial lead who still personally assembles the bids. No proposal operations team. Probably hired a bid consultant at least once. Probably holds ISO 27001 or Cyber Essentials already, and definitely can't tell you which current document supports which procurement answer.

That company has both the pain and the budget. The three-person shop that applied because government sounded interesting has neither, and will happily absorb six weeks of your time proving it.

There's one exception worth noting, and it's your cheapest customer acquisition of the year: the Cyber Essentials mandate hits every supplier on the framework regardless of whether they've won a single contract. Suspension is suspension. So you have a reason to contact all 3,800 of them, and a filter for finding the 500 who'll pay you properly.

Don't build the supplier passport

One trap kills more procurement startups than any other, and it sits directly in front of this idea.

The government is already building part of the passport. Under the Procurement Act, suppliers register on the Central Digital Platform inside Find a Tender. It holds reusable core supplier information: company details, economic and financial standing, connected persons, exclusion grounds. Suppliers update it once and reuse it across procurements. Buyers can't award regulated contracts to companies that aren't registered.

Competing with that is a losing business. The government's version is free and legally required, and yours would be neither.

Your product lives entirely in the space beyond the government's core record. Government knows the registered company name and the filed accounts. Your system knows which paragraph of the current business continuity plan supports a specific G-Cloud requirement, whether the pricing schedule still matches the service definition, whether the Cyber Essentials certificate expires before the next reopening window, who owns the carbon reduction plan, what changed between service definition v7 and v8, and whether a claim in an earlier call-off answer points at evidence that has since been superseded.

Government guidance is explicit that information outside the platform's defined core dataset still gets collected separately during each procurement. That gap is your product.

The Central Digital Platform holds the company's identity. Your system holds the case that company makes about itself, and the evidence sitting behind every line of it.

Sell the service before you build the software

Don't spend four months writing code before you've opened a real supplier's evidence folder.

The first product is a fixed-price engagement with a boring name. Call it the G-Cloud 15 Evidence Baseline. Charge £2,400. Deliver within ten business days of receiving documents.