Technology Code of Practice (Procurement)

The Technology Code of Practice (TCoP) is a set of criteria published by the UK Government Digital Service (GDS) and Cabinet Office that all central government technology projects and programmes must comply with. It applies at the point of design, procurement, and delivery, and is increasingly used as an evaluation framework in ICT procurement tender specifications. For suppliers, the TCoP represents a codified statement of what the UK government expects from technology investments, spanning standards, security, user needs, sustainability, and value for money.

What is the Technology Code of Practice in procurement?

The Technology Code of Practice sets out thirteen criteria that technology projects must meet to receive government approval (through spend controls or the government's Major Projects Authority review process). In procurement, buyers embed these criteria into specifications and use them to assess whether proposed solutions are compliant. The criteria cover:

Define user needs. Technology must be designed to meet the needs of users, informed by research and testing. Suppliers must demonstrate how their solution has been developed with end-user input.

Be open and use open standards. Solutions must use open standards in procurement rather than proprietary technologies. This applies to data formats, APIs, and protocols.

Make things accessible and inclusive. Systems must meet the Public Sector Bodies Accessibility Regulations 2018 (implementing EU Directive 2016/2102), requiring compliance with WCAG 2.1 AA.

Make sure your technology is secure. Security must be addressed throughout the design and delivery lifecycle. For procurement, this links to Cyber Essentials (procurement requirement) and, for more sensitive systems, the GovAssure cyber assessment.

Make privacy integral. Data protection and privacy must be designed in, not bolted on. This connects to GDPR compliance in procurement and the requirement to complete data protection impact assessments.

Share, reuse, and collaborate. Government should not procure or build systems that duplicate existing shared capabilities. Buyers are expected to reuse common platforms and services where available.

Integrate and adapt technology. Systems must be designed for interoperability with existing government infrastructure, using open APIs and avoiding technical lock-in.

Make better use of data. Technology must support data sharing across government where appropriate, using open standards and respecting privacy obligations.

Define your purchasing strategy. Procurement decisions must consider total cost of ownership, exit costs, and the risks of lock-in. This criterion directly influences how cloud and software contracts are structured.

Meet the procurement rules. All technology expenditure must comply with public procurement law and government commercial guidelines. This criterion makes the TCoP explicitly applicable in procurement evaluation.

Why it matters for bidders

For suppliers selling to UK central government, demonstrating compliance with the TCoP is not optional for contracts subject to spend controls or Gateway reviews. Many departments and arm's length bodies have adopted TCoP compliance as a standard evaluation criterion in their tender specifications, so suppliers should prepare evidence against each criterion as part of their standard bid library.

The criteria on openness, interoperability, and security are the most commonly tested in procurement evaluation. Suppliers should document their open standards in procurement compliance, their API and data portability capabilities, their security certifications, and their accessibility audit results before bidding.

Example

A central government department procures a new case management platform. The evaluation criteria require each supplier to complete a TCoP compliance statement, addressing each of the thirteen criteria with evidence. The assessment is scored, with technology security, open standards, and interoperability weighted most heavily. A supplier who scores poorly on the open standards and interoperability criteria, because their system uses a proprietary data format and lacks documented APIs, fails to win despite competitive pricing.

Frequently Asked Questions

Is the Technology Code of Practice legally binding?

The TCoP is a UK government policy requirement rather than a statutory obligation in the way that procurement law is. However, compliance is effectively mandatory for central government technology spending because projects that do not comply cannot receive spend approval through Cabinet Office spend controls. In procurement, TCoP criteria become contractually binding when embedded in tender specifications and contract terms.

Does the TCoP apply to devolved governments and local authorities?

The TCoP applies directly to UK central government departments and arm's length bodies. Devolved administrations in Scotland, Wales, and Northern Ireland have their own digital and technology standards, which broadly align with TCoP principles but are not identical. Local authorities are not required to follow TCoP, but many adopt its principles voluntarily, particularly the open standards and accessibility criteria.

Are there equivalent frameworks in EU member states?

Several EU member states have published comparable technology governance frameworks. The European Commission's Digital Decade policy targets and the eGovernment Action Plan set similar expectations around interoperability, open standards, and user-centred design. The European Interoperability Framework (EIF) is the closest EU-level equivalent to the TCoP's interoperability and openness requirements. Individual member states such as Denmark, the Netherlands, and Estonia have published their own national technology standards for public sector procurement.