The evidence pack British procurement asks a marketing supplier for, and which parts are required by law

A British procurement team assessing a marketing supplier asks for the same seven things almost every time. Company identity and filings. Insurance certificates. Evidence of financial standing. Data protection paperwork. Security certification. Policy statements. Client evidence a third party can check. Two items on that list are set by statute and the rest are conditions the buyer chooses to impose, and knowing which is which saves both sides an argument. Nothing here is legal advice, and a supplier or buyer with a specific question should take it to a solicitor.

The pack, and where a buyer checks each item independently

The two parts set by statute

Employers liability insurance

Government guidance, read on 22 October 2026 at gov.uk on employers liability insurance, states plainly that "You must get Employers' Liability (EL) insurance" and that the cover must be "for at least GBP 5 million". The same page states that "You can be fined GBP 2,500 every day you are not properly insured". It also sets out exemptions for certain kinds of employer, so a supplier should read that page against its own circumstances rather than assume.

The modern slavery statement

Government guidance, read the same day at gov.uk on publishing an annual modern slavery statement, states that "Certain commercial organisations must publish an annual statement setting out the steps they take to prevent modern slavery in their business and their supply chains", and that "This is a requirement under section 54 (Transparency in Supply Chains) of the Modern Slavery Act 2015". The criterion quoted on that page is an organisation that "has an annual turnover of GBP 36 million or more", and the page states that total turnover "means the turnover of the organisation and any of its subsidiary undertakings (including those operating wholly outside the UK)".

Two things follow for a marketing supplier. Most agencies sit well below that threshold and have no obligation, so a procurement form demanding a statement is applying a large company's checklist to a small company. And a large buyer may still require a statement contractually as a condition of its own supply chain policy, which is a different thing from the statutory duty and should be described as such in the answer you give.

Both quotations above come from the government's own guidance pages rather than from the text of the Act. The legislation site could not be read from the machine this was written on, every route returning an empty response behind a browser challenge, so the statutory wording itself is unverified here and the guidance is quoted as what it is.

The parts the buyer chooses to impose

• Professional indemnity insurance. Not a statutory requirement for a marketing supplier, and a near universal contract condition. The cover level is negotiable and the certificate is the artefact. Check the renewal date, because an expired certificate is the most common defect in an otherwise complete pack.
• Public liability insurance. Relevant where the supplier's people attend your premises or run events, and often required regardless.
• A credit check. Buyers run these on the registered entity, so a supplier should know its own score before a buyer quotes it back.
• Policy statements. Equality and diversity, environmental, anti bribery, health and safety. Written, dated, signed and reviewed annually. For a small agency these are short documents, and having them ready is often what separates two otherwise equal bidders.

Cyber Essentials, which is the item most often misunderstood

The National Cyber Security Centre's own page, read on 22 October 2026 at ncsc.gov.uk, describes Cyber Essentials as "the minimum standard of cyber security recommended by the Government for organisations of all sizes" and states that "the certification scheme is aligned to five technical controls designed to prevent the most common internet based cyber security threats".

On the self led route, the page states that you register for certification through the delivery partner, make the payment, then complete a verified self assessment whose answers "will be signed-off by a board member or equivalent and then marked by an assessor". On the second level, the same page states that "Both Cyber Essentials and Cyber Essentials Plus assess the same five key technical controls, but Cyber Essentials Plus goes a step further by independently testing your systems to verify that those controls are working in practice".

So the base certificate is a marked self assessment and the Plus certificate adds independent testing. A buyer asking for the right one, and a supplier quoting the right one, is a small distinction that comes up in almost every security questionnaire.

What makes client evidence verifiable

This is the part of the pack most often filled with prose, and the part a procurement team trusts least. Four elements turn a case study into evidence.

• A named client, or a named sector and size where a name is confidential. "A national retailer" is worth very little, and "a 40 branch retailer in the north west, name available on request under NDA" is worth a great deal.
• A dated window. Start and end, with the measure taken at both ends.
• The measure, defined. Qualified enquiries counted by the client, revenue from the client's own records, cost per acquisition with the definition attached.
• A referee who will take a call. One contactable referee outperforms six written testimonials, every time.

Build the pack once, as a supplier

Keep a single folder with every item above, each file named with its expiry or review date, and refresh it on a diary date each quarter. Questionnaires then take an hour rather than a week.

Then publish the parts that are already public on your own website. Company number, registered address, insurance cover levels, certifications held, policies. None of that is confidential, it is the first thing a cautious British buyer looks for, and a supplier who makes a procurement team's job easy is a supplier who gets to the shortlist with less friction.

Questions about British procurement requirements for marketing suppliers

Do we need Cyber Essentials to win private sector work?

Not as a legal matter, and buyers increasingly ask for it as a contract condition, particularly where the supplier will hold customer data or have access to systems. Read the questionnaire to see whether the base certificate or Plus is being asked for.

Is professional indemnity insurance compulsory for a marketing agency?

It is not a statutory requirement for marketing work, and it is a standard contract condition, so in practice an agency without it is excluded from a large share of mid market and enterprise work.

Does a small agency need a modern slavery statement?

The statutory duty applies above the turnover threshold quoted above. Below it, a buyer may still ask for a statement as a condition of its own supply chain policy, and the honest answer is to say which of the two situations you are in.

Can a buyer check our accounts without asking us?

Yes. The Companies House register is public and free, and filing history is part of what a procurement team reads. Late filings get noticed.

What is the fastest way to fail a procurement check?

An expired insurance certificate, a missing data processing agreement, or a case study with no contactable referee. All three are fixable in a week and all three are routinely fatal.

Should the pack be on our website or sent on request?

Publish what is public and send the rest on request. Buyers who can self serve the basics move faster, and the information is already on public registers anyway.

The same pack is what gets you quoted

There is a second reason to publish the public half of that folder, and we measured it. In 64 blind British readings taken on 22 October 2026 across ChatGPT and Gemini, where the market was fixed inside each question, gov.uk was cited in 16 of them, ico.org.uk in 7 and business.gov.uk in 6, making the public sector the most cited British source apart from a single research publisher. Across the same 64 readings, 92.9 per cent of the host readings went to a page on a vendor's or an agency's own website. Registration numbers, cover levels and certifications are exactly the kind of checkable British fact that makes a supplier page usable in an answer rather than skippable. AI Knows Us measures which companies those answers name across ChatGPT, Gemini, Perplexity, Claude and Google AI Overviews, and the publishing side of the same argument for UK local service firms is set out in our note on publishing the registration number.