By Rob Atkins, Founder & Principal Consultant
It can be tempting to put compliance on the back burner, but addressing it now can save you significant time, cost and stress later. Public sector buyers, and increasingly the large private customers above you in the supply chain, no longer just ask whether you can make the product. They ask whether you are safe, legal, insured, certified and demonstrably responsible before they'll let you near a contract. Two distinctions run through this guide. Some things fine you: health and safety, employment law and data protection are enforced by regulators. Others cost you the contract: requirements like Cyber Essentials, insurance, financial standing and social value carry no government fine, but where a buyer asks for them they can rule you out or out-score you.
The Employment Rights Act 2025 is law. Statutory sick pay and paternity and parental leave are now day-one rights, the protective award for getting a collective redundancy wrong has doubled to 180 days' pay per employee, and a new Fair Work Agency began enforcing on 7 April 2026. From 1 January 2027 the unfair dismissal qualifying period drops from two years to six months. People and employment law
HSE fines scale with turnover and run into millions for serious breaches. The Corporate Manslaughter Act carries unlimited fines and directors can face personal prosecution. It's also assessed at the Selection Questionnaire stage on virtually every public contract. Health and safety
UK GDPR is fully in force, and a reportable breach must reach the ICO within 72 hours. If you process a customer's data, your Data Processing Agreement pins the liability on you. GDPR and data protection
On many contracts it's the floor you must clear even to bid. Where a tender requires it, you're out without it, and if a required certificate lapses you can breach the contract. Do I need Cyber Essentials?
Public and Employers' Liability, Professional Indemnity and Product Liability must be held at the levels the buyer specifies, with certificates in the right format. Under-insured, wrong format or missing a policy can be a straightforward fail. Insurance and key person cover
Buyers check turnover against contract value, filed accounts and ratios such as current ratio, gearing and interest cover. Newer businesses without three years of filed history need the right management accounts and accountant's letters. Financial standing
ISO 9001 is table stakes. ISO 14001 and ISO 45001 are increasingly required, and ISO 27001 appears on larger or data-heavy contracts. Many manufacturers hold 9001 alone and are quietly screened out of everything that asks for the others. ISO management systems
Under the Procurement Act 2023, award moved to the most advantageous tender. Manufacturers already do local hiring, apprenticeships and community work but can't evidence or quantify it, so they leave those marks on the table. Bid writing
Statutory carbon reporting (SECR) applies only to large companies. Below that there's no general legal duty, but buyers can ask for a Carbon Reduction Plan and Scope 1, 2 and 3 data whatever your size. Do I need a Carbon Reduction Plan?
A statement is a legal obligation only once turnover reaches £36m. Larger customers require one in their tender questions anyway, and evaluators check your website for it. People and employment law
Standard terms often set liability caps and clauses that conflict with your insurance or operating model. Missing an Anti-Bribery or Whistleblowing policy is also a common questionnaire fail. Contract review
During due diligence, evaluators can go straight to your site to verify your certifications, Carbon Reduction Plan, Modern Slavery statement and privacy policy. Stale logos or missing policies can sink a good bid. Web design and digital
Not law when this guide was written, with phased implementation possibly running to 2028. Manufacturing isn't currently named in direct scope, but it regulates managed service providers and creates designated critical suppliers, and large customers may push requirements down to you by contract.
The proposed payment ban targets the public sector and critical national infrastructure. A duty to notify before paying and mandatory incident reporting may reach everyone else, so tested offline backups and a rehearsed continuity plan matter. Managed IT
Since 11 September 2026, manufacturers of products with digital elements have had to report actively exploited vulnerabilities and severe incidents. If you sell anything with software or connectivity into Europe, the clock is already running. OT and industrial cybersecurity
Sixteen separate suppliers can produce sixteen documents that contradict each other under scrutiny. A lapsed certificate, an out-of-date website and a missing policy compound. Technology roadmap
Separate a fine from a lost bid: health and safety, employment law and data protection can fine you today, while Cyber Essentials, insurance, financial standing and social value can cost you the contract.
Then separate what the law forces on you from what your customers force on you. Most manufacturers sit below the statutory thresholds for carbon and modern slavery reporting, but big customers can still ask for the same evidence.
The point of the Cure Alliance isn't sixteen invoices. It's one coordinated plan that closes the gaps in the order that matters, starting with whichever one is costing you the next contract or the next inspection.
Book a Comprehensive Health Assessment and we'll show you exactly where you stand.
Health and safety, employment law and data protection are enforced by regulators. HSE fines scale with turnover, and the ICO can fine up to £17.5m or 4% of global annual turnover under UK GDPR.
Only once turnover reaches £36m. Most manufacturers with 10 to 500 employees sit under that, but larger customers can still ask for one in their tender questions.
The Employment Rights Act 2025 brought day-one rights to statutory sick pay and paternity and parental leave from 6 April 2026, doubled the protective award to 180 days' pay and created a Fair Work Agency. From 1 January 2027, the unfair dismissal qualifying period drops to six months.
Sources: Published UK and EU regulatory sources current at July 2026, including the Employment Rights Act 2025 (GOV.UK); Cyber Essentials v3.3 requirements (NCSC, IASME); Procurement Act 2023 and related policy notes (GOV.UK); SECR and Modern Slavery Act thresholds; UK GDPR (ICO); the Cyber Security and Resilience Bill (UK Parliament); the UK ransomware legislative response (Home Office); and the EU Cyber Resilience Act. Confirm figures and dates against the current position before using them in a live bid. This is guidance, not legal advice.
Written by Rob Atkins, Founder & Principal Consultant, Your Best Solution Limited. Last updated .