The MoD says it wants more SMEs. Its own policy pipeline is quietly pricing them out.
Three compliance regimes are landing on the same defence SMEs inside the same twelve months, while the growth rhetoric points the other way. Here is the whole picture, not just the headline.
The room proves the argument
Today’s announcement confirms the pattern this article set out. Government and industry have signed a new Defence Youth Participation and Employment Pledge, committing to 40,000 young people a year into defence careers by 2030, rising to 50,000 by 2035.
Airbus, Babcock, BAE Systems, Helsing, Leonardo, Lockheed Martin, MBDA, Navantia, Palantir, QinetiQ, Rolls-Royce, Safran and Thales signed it. Every signatory is a prime. Not one SME sat at that table, despite the target landing hardest on the businesses with the least capacity to carry it.
Every signatory a prime. Not one SME in the room.
Apprenticeship places and NEET placements are exactly what PPN 026 scores from January 2027, with no weighting for headcount. A 30 person supplier ends up carrying the same commitment as a 300 person one, without the bid team, the HR function or the headroom to match. This announcement does not change that scoring. It adds a public commitment on top of it.
There is a harder question underneath the number. An apprenticeship only means something if the business taking someone on has the capacity to develop them, not just place them. A headcount target does not distinguish between the two. It rewards the number regardless of what sits behind it.
Good intentions. Same question the rest of this article asks. Who is actually being asked to carry it.
Three regimes, one supply chain, twelve months
What is landing, and whenDefence Cyber Certification Level 0 expected across roughly 12,000 industry partners under DEFSTAN 05-138, flowed down contractually through DEFCON 658.
PPN 026 Social Value Model applies to new central government procurements, scoring workforce commitments on contracts from £1 million up.
Employment Rights Act 2025 phases in: sick pay, unfair dismissal, harassment duties and a stronger day-one right to request flexible working.
The growth story, in one line
The MoD wants to grow SME spend by £2.5 billion by 2028 and has built an Office for Small Business Growth to help deliver it. The ambition is genuine. The problem is what the rest of government is asking the same businesses to do at the same time.
PPN 026 punishes small headcounts twice
PPN 026 goes live for procurements commenced from January 2027, carrying a 20 percent weighting on central government contracts above £5 million, scored against six Model Award Criteria under Good Jobs and Skills. The compulsory threshold for smaller procurements rises from £139,688 to £1 million, which eases the paperwork for SMEs bidding directly on the very smallest lots.
It does not ease it for SMEs bidding directly in the £1 million to £5 million range, and plenty do, particularly on regional MoD lots and framework call-offs. A business with 30 people is asked to write and evidence a social value method statement against the same six criteria as a prime with a dedicated bid team and an established CSR function. Several sub-criteria reward numeric commitments, apprenticeship places, NEET placements, training hours, without weighting for headcount. Five apprenticeships looks identical on paper whether it comes from a 300 person company or a 30 person one, except for the smaller business, five apprenticeship places is a material chunk of payroll.
Subcontracted SMEs are not exempt either. A prime under pressure to evidence workforce outcomes across its supply chain will ask its subcontractors for exactly the training commitments, progression evidence and fair pay data that PPN 026 demands at prime level, with none of the scoring benefit and all of the due diligence cost landing on a business with no HR function to answer it.
An SME does not need to lose a million pound contract to be damaged by PPN 026. It only needs to become the supplier a prime can no longer afford to carry.
The cyber deadline has a name attached to it
The Cyber Security Model version 4, delivered through DEFSTAN 05-138 Issue 4, sets the controls. Eleanor Fairford, MoD’s Director of Cyber Defence and Risk, has been direct about the timeline on the Defence Digital blog: she has personally asked all industry partners, prime or third-tier, to achieve Defence Cyber Certification Level 0 by 31 December 2026. That includes holding Cyber Essentials across every business-critical system in scope, independently assessed rather than self-attested.
The enforcement route is DEFCON 658, the standard contract clause that makes compliance binding and requires primes to push the same deadline down to their subcontractors. DCC is not yet a universal contractual mandate on paper, but Fairford’s instruction, repeated in a follow-up post setting out how primes should schedule subcontractor timescales, makes clear that MoD expects the whole supply chain to be ready regardless. Roughly 12,000 SMEs sit inside that supply chain. Most do not have a security function, and unlike PPN 026’s paperwork, cyber controls cost real money to implement and certify.
Employment law does not care that you also sell to the MoD
The Employment Rights Act 2025 is not defence specific, which is exactly why it compounds rather than competes with the first two layers. The statutory sick pay earnings threshold was removed from April 2026. The unfair dismissal qualifying period drops from two years to six months in January 2027. A new Fair Work Agency becomes operational with an enforcement remit, and from October 2026 employers face tighter duties to prevent workplace harassment, including from third parties.
Flexible working also becomes a stronger day-one right under the Act, and this is where defence sits awkwardly against the general policy intent. Facility-based, security-cleared and shift-pattern roles, common across defence manufacturing, cleared engineering environments and MoD site work, are genuinely harder to flex than an office job, but the legal starting point no longer allows an employer to simply decline. Handling that request properly, with a defensible business reason where one exists, takes HR judgement that most 40 person suppliers do not have in-house. Get it wrong and the shortened unfair dismissal window makes the resulting dispute faster to escalate, not slower.
You cannot ask for both
Each of these three regimes is defensible on its own terms. Social value scoring is a reasonable lever for workforce standards. Cyber assurance across a supply chain that adversaries actively target is not optional. Employment rights reform has been signalled for two years. Nobody in Whitehall sat down and decided to make life harder for small suppliers.
But the effect does not depend on how an SME reaches the contract. Bid directly and you write and evidence the same social value method statement as a prime, at the same numeric thresholds, with none of the bid team. Sit in the supply chain and the same expectations arrive as due diligence from above instead of contract scoring, with none of the leverage to push back. Either way, the business is being asked to hold information, accreditation and legal capability it was never resourced to carry, on a timeline it did not set.
That is the choice government is actually avoiding. Either SMEs are genuinely wanted in defence delivery, in which case the compliance load has to be proportionate to a 30 person business, not scaled down slightly from what a prime carries. Or the compliance load stays as it is, in which case primes are the only realistic delivery model and the department should stop calling this an SME growth policy. What cannot keep happening is publishing both positions at once and treating the tension between them as someone else’s problem to solve.
What is PPN 026 and when does it come into force?
PPN 026 is the UK government’s updated Social Value Model for public procurement, applying to central government contracts commenced from January 2027. It carries a 20 percent weighting on contracts above £5 million, scored against six Model Award Criteria grouped under two outcomes, Good Jobs and Skills, and sets a compulsory social value threshold of £1 million.
Does PPN 026 apply to small businesses, or only large contractors?
SMEs bidding directly on central government contracts between £1 million and £5 million are in scope and must evidence the same Good Jobs and Skills criteria as much larger bidders, without any adjustment for company size. SMEs supplying as subcontractors usually meet the same requirements indirectly, through a prime’s own supply chain due diligence.
Does the new Defence Youth Participation and Employment Pledge change PPN 026 obligations for SMEs?
No. The pledge, signed by major defence primes in September 2026, sets a sector-wide target of 40,000 young people a year into defence careers by 2030, rising to 50,000 by 2035. It sits alongside PPN 026 rather than replacing it. Apprenticeship places and NEET placements remain scored under PPN 026 from January 2027 with no adjustment for company size, so the pledge increases the volume of activity expected without changing the disproportionate load it places on smaller suppliers.
What is Defence Cyber Certification (DCC) Level 0?
DCC Level 0 is the baseline cyber assurance certification in the MoD’s Cyber Security Model version 4, requiring a current Cyber Essentials certificate covering every business-critical system, independently assessed against Defence Standard 05-138 Issue 4 rather than self-declared.
When is the deadline for DCC Level 0 and is it mandatory?
MoD’s Director of Cyber Defence and Risk, Eleanor Fairford, has asked all industry partners, including subcontractors, to achieve DCC Level 0 by 31 December 2026. It is not yet a universal formal contract requirement, but it is enforced wherever DEFCON 658 appears in a contract, and MoD guidance treats it as the expected baseline across the whole supply chain from that date.
How does the Employment Rights Act 2025 affect small defence suppliers?
The Act is not defence specific but phases in through 2026 and 2027: removal of the statutory sick pay earnings threshold, a shortened unfair dismissal qualifying period, tighter harassment prevention duties, and a stronger day-one right to request flexible working. Defence SMEs with facility-based or security-cleared roles face harder decisions on the flexible working duty than most sectors, with less HR capacity to manage it.
Why is it getting harder for SMEs to win MoD contracts despite the government’s growth targets?
The MoD’s £2.5 billion SME growth target and Office for Small Business Growth sit in a different part of government to the policies creating new compliance obligations, PPN 026, DEFSTAN 05-138 and the Employment Rights Act. Each was designed with a sound rationale, but no single function is responsible for the combined weight they place on smaller suppliers at the same time.
Nobody is coming to carry this for you
Fractional access to a Chief People Officer means someone who already understands this landscape is in the room when it matters, helping you work out what actually applies to your business and what to do about it before it becomes a crisis.
See the Executive Access Partnership Get In Touch