Web design tenders cover website redesigns, CMS builds, intranets, hosting and support, and accessibility remediation, bought by councils, schools and arm’s-length bodies. This page lists live notices matched to web design codes, explains the accessibility standard public sector sites must meet, and sets out when Cyber Essentials applies and how an agency can win, from small council sites to digital frameworks. Our tender eligibility checker is coming soon. Until then, tell us your trade and postcode to join the free weekly list of live tenders, starting soon.
What buyers usually ask web design suppliers for
Accessibility is the requirement with the clearest legal basis for a website. Security, hosting and insurance vary by buyer, and the pack has the detail.
Accessibility: WCAG 2.2 AA and an accessibility statement
Public sector websites and mobile apps must meet WCAG 2.2 AA, unless meeting it would be a disproportionate burden, and publish an accessibility statement, under the Accessibility Regulations 2018. The statement has to explain how accessible the site or app is, and be reviewed regularly. The duty sits with the public body, but it will expect you to build to the standard, test it and help keep the statement accurate. Exemptions exist, for example for third-party content the body didn’t pay for or develop, and schools and nurseries are only partly covered, so ask what is in scope.
Cyber Essentials and Cyber Essentials Plus (PPN 014)
PPN 014 covers central government departments, executive agencies, non-departmental public bodies and NHS bodies, from 24 February 2025. It points them to Cyber Essentials, or equivalent controls, for contracts with characteristics such as citizens’ personal information or ICT systems that store or process OFFICIAL-level data. Certification is renewed annually, and Cyber Essentials Plus adds remote and on-site vulnerability testing. The PPN says the scheme shouldn’t be applied to every contract as a matter of course, so whether it applies to a given site depends on the data the site handles. Evidence of Cyber Essentials (or equivalent) is needed before award. Councils may ask for it anyway. See Cyber Essentials for government contracts.
Hosting and security expectations
If you host or process personal data, the Data Protection Act 2018 applies. Expect questions on where data is hosted, who your sub-processors are, backups and how you would handle a breach. Some packs ask for ISO 27001. We make no claim about how many, so check whether the pack wants certification or evidence of a security management approach.
Insurance
Professional indemnity and cyber cover are set by each buyer, and we can’t give typical figures. Check the pack, and see professional indemnity insurance.
The GOV.UK Service Standard
The GOV.UK Service Standard is a 14-point standard for creating and running public services, and its points include accessibility and security. We haven’t sourced which buyers must meet it. If a pack names it, show how your delivery approach maps to the points.
How to win website contracts
Below-threshold builds
Smaller builds can fall below the thresholds. From 1 January 2026, services contracts fall under the full Act rules at £135,018 including VAT for central government and £207,720 for other authorities. Below that, when a buyer invites tenders, section 85 bars a separate suitability stage before tenders are submitted, but the buyer can still assess suitability at the award stage (Welsh devolved buyers follow their own rules, and call-offs from frameworks are excluded).
If a buyer advertises a below-threshold contract worth £12,000 or more (central government, including NHS trusts) or £30,000 or more (other authorities), including VAT, it must first publish a below-threshold tender notice (section 87). Buyers can also invite quotes from chosen suppliers without advertising. A school’s own procurement is outside these rules, so check who the named buyer is.
Digital frameworks and dynamic markets
Public bodies can buy digital work through frameworks on the Digital Marketplace, which lists G-Cloud and Digital Outcomes and Specialists. Check which G-Cloud iteration is open before you plan around it. Dynamic markets (formerly dynamic purchasing systems) are another route for contracts above the thresholds. They must stay open to new suppliers at any time, the buyer can’t cap the number of members, and contracts under them are awarded through the competitive flexible procedure. A buyer can use one to line up web suppliers and then compete each job. Our guide covers frameworks and dynamic markets.
Show your testing, migration and support
Evaluators score what happens after launch as well as the design. Show how you test for accessibility, including manual testing with assistive technology, how content is migrated and checked, what training editors get, and what support you offer after go-live, with response times. Say who does each task.
Pitfalls to check before you commit
- Content migration left unpriced. Ask how many pages, documents and redirects are in scope.
- Hosting terms. Check who holds the hosting contract, the exit arrangements and how data is returned at the end.
- Accessibility debt in legacy content. Old PDFs, forms and third-party widgets may fail the standard, so find out who is responsible for fixing them before you agree a fixed price.
Who issues web design tenders
Councils, schools and arm’s-length bodies all commission websites, from small town council sites to larger service portals. IT services (division 72) had 30 live notices in the week to 10 Oct 2026, and software (division 48) had 11. Both divisions are wider than web design, so use the live list above for the count that matters. Related pages: IT services tenders, IT support contracts, software tenders and marketing and creative tenders.
Questions
Where are council and public sector website contracts advertised?
Notices appear on Find a Tender and Contracts Finder, and the live list on this page draws on both. Some buyers use frameworks or dynamic markets instead, and below the thresholds a buyer can invite quotes from chosen suppliers without advertising at all.
Which accessibility standard must public sector websites meet?
WCAG 2.2 AA, with an accessibility statement published by the public body, under the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018. Some content is exempt and schools are partly exempt, so ask the buyer what is in scope for the project.
Do web agencies need Cyber Essentials to win government work?
Not for every contract. PPN 014 covers central government departments, executive agencies, non-departmental public bodies and NHS bodies, and points to Cyber Essentials where a contract has certain characteristics, such as citizens' personal information or ICT handling OFFICIAL-level data. It says not to apply the scheme to every contract as a matter of course. Councils may still ask for it.
Should I bid through G-Cloud or open tenders?
Both routes exist, and which one a buyer uses is shown in the notice or on the Digital Marketplace. Check which G-Cloud iteration is open on the day you look. Open notices are a second route, so watch both rather than choosing one.
Can a small agency win a council website redesign?
Yes, it is possible. Below the thresholds, section 85 bars a separate suitability stage before tenders are submitted, but a buyer that invites tenders can still assess suitability at the award stage (Welsh devolved buyers and framework call-offs are excluded), and it must consider the barriers small firms face. Read the specification for migration, hosting and support before you price.