Modern slavery in public supply chains: why PPN 009 is a contract management problem, not a tender question

The update is about language, the work is about evidence

The February 2025 refresh of PPN 009 exists mainly to align the note with the terminology of the Procurement Act 2023 and the Procurement Regulations 2024, which bite on procurements commenced on or after 24 February 2025. The note is explicit that this is not a change in policy or a new call for action, and that organisations do not need to repeat what they already did when it was first published in February 2023.

It is easy to read that as permission to do nothing. That would be a mistake. The note also says in-scope organisations should continue to apply any ongoing obligations in its provisions, and the obligation to identify and manage risks in existing contracts is exactly the kind of ongoing work that quietly lapses when nobody is asked for it.

There is also a version boundary worth getting right. Procurements commenced or contracts awarded before 24 February 2025, including through frameworks and dynamic purchasing systems set up under the old rules, sit with PPN 02/23. Live portfolios will contain both populations for years, so teams need to know which note governs which contract.

What most organisations get wrong

The first common failure is treating risk designation as a formality. If every procurement is scored the same way regardless of category, the high risk label never gets applied, and the supply chain information requirement that attaches to high risk procurements never triggers. The named sectors of concern, cotton, PPE and polysilicon among them, exist precisely because risk is concentrated, not evenly spread.

The second is collecting information nobody reads. Supply chain data submitted at bid stage has value only if someone assesses it, records the assessment and can find it again. Where that assessment is not written down, the organisation has the cost of the exercise and none of the protection.

The third is the gap between concern and action. The PPN points to using existing exclusion grounds more effectively. Exclusion is a serious step and it needs a serious evidence base. Teams that have not thought about what evidence would justify exclusion tend to discover, at the worst moment, that they do not have it.

What good looks like

A workable approach has four parts. A category informed risk screen that actually produces a meaningful number of high risk designations. A standard, proportionate supply chain information request for those procurements. An enhanced due diligence route for the cases where the answers raise questions. And a contract management rhythm that revisits the highest risk contracts rather than filing them at award.

None of this needs to be elaborate. It needs to be consistent and recorded. The single most useful test is whether, picking any high risk contract at random, you can produce within an hour the risk designation, the information the supplier provided, the checks performed and the conclusion reached.

Wider public sector bodies are not bound by PPN 009, but the note invites them to apply the approach. Given that many of the sectors of concern sit in categories bought heavily by local government and the NHS, adopting the approach is usually easier to defend than declining to.

The takeaways

• PPN 009 updates terminology for the Procurement Act 2023 regime, not the underlying policy.
• Procurements before 24 February 2025 remain governed by the earlier note, PPN 02/23.
• Risk characteristics now reflect sectors of concern including cotton, PPE and polysilicon.
• High risk procurements carry a supply chain information requirement, and it needs to be assessed, not just collected.
• Existing contracts are in scope, so this is contract management work as much as tendering work.

Want the full breakdown?

The complete explainer covers the key facts, the requirements in detail and a practical action list, free and printable in the Procurement Library.