Procurement Act 2023 · Suppliers
CDP onboarding
The Central Digital Platform, usually shortened to CDP, is the government service where a UK supplier registers its organisation once and holds the core information that every contracting authority asks for. A share code is how you let a buyer see it. Registration is free, and it is organisational rather than personal.
This page covers what CDP is, why it was created, how you register, what a share code actually is and how long one is good for, and precisely how far our own platform uses it today. That last part matters, so it is set out plainly rather than implied: saving a share code works now, redeeming one does not yet, and we say which is which.
Definition
What the Central Digital Platform is
CDP is a register of supplier information, run centrally, that suppliers maintain themselves and share with buyers by consent. It sits on the same service estate as Find a Tender, which is why people meet the two together and often conflate them. They do different jobs. Find a Tender is where opportunities and the notices that go with them are published. CDP is where the facts about your organisation live.
The information it holds is the part of a bid that never changes between bids: your legal identity and the register you appear on, your registered and trading addresses, the people connected to your business, your financial standing, and your declarations against the exclusion grounds and conditions of participation the Procurement Act 2023 sets out. None of that is the interesting part of your bid, and all of it used to be retyped every time.
Two things it is not. It is not a place you submit a tender, and it is not a list you get onto. Registration admits you to nothing. It gives you one place to hold your information and a mechanism for handing it over.
Why it exists
The problem it was built to remove
Before the Act, a supplier bidding for ten public contracts filled in ten selection questionnaires, and roughly the first third of each one was identical. The same company number. The same directors. The same three years of accounts. The same insurance certificates. The same declarations about convictions and misconduct, answered slightly differently each time because ten different buyers had worded the question ten different ways.
That repetition was not merely irritating. It was a real barrier for smaller suppliers, whose bid capacity is measured in evenings rather than in departments, and it produced inconsistency that helped nobody: the same company holding five marginally different sets of answers with five authorities, none wrong when written and none current.
The design principle behind CDP is register once, share by code. You maintain one authoritative version of your organisational information. When a buyer needs it, you hand over a share code and they retrieve it, rather than you retyping it and them rekeying it. The consequence for a supplier is that the standing part of a bid becomes maintenance you do once a year, and the tender week is spent on the part that decides who wins.
Registering
How to register, in the order it happens
Registration is free and takes an afternoon if the information is to hand, and a fortnight if it is not. The step that catches people out is never the form. It is gathering connected person details and financial information from colleagues who are not thinking about a tender.
One person registers the organisation, not each bidder
CDP registration is organisational. The first person from your company creates it and then adds colleagues. If somebody has already registered your company, join their registration rather than creating a second one. Duplicate registrations are the commonest self-inflicted problem here, and far easier to avoid than to unpick, so ask internally before you start.
Establish your registered identity
Your legal name as registered, your registered address, and your identifier on a recognised register, which for most UK bidders is the Companies House number. Charities, partnerships, sole traders and non-UK entities use the register that applies to them. This is what later determines how a buyer can name you in a published award notice, so it is worth getting exactly right rather than approximately right.
Add your connected persons
Directors, people with significant control and other connected persons, in the detail the platform asks for. This is normally the slowest step, because the information sits with a company secretary or an accountant rather than the bid team, and it has to match the public register. Start it before you have a deadline.
Complete the supplier information
Financial standing, insurances, and the declarations against the exclusion and conditions of participation grounds set out in the Procurement Act 2023. Answer these carefully. A declaration made here is one you are relying on in every procurement where you share it, and correcting it later is a conversation with a buyer rather than an edit.
Add the colleagues who will actually bid
The person who registers is rarely the person under deadline pressure at 16:00 on submission day. Give bid managers their own access early, so nobody is chasing a former employee for a login in the last hour of a tender.
Generate a share code and record it
Generate the code, and keep it somewhere your bid team can find it alongside your company number and VAT number. You will be asked for it, and you will be asked again. Regenerate it whenever the underlying information changes.
Have these open before you start
Companies House number or equivalent register reference, registered address, VAT number, the full list of directors and people with significant control, your most recent statutory accounts, insurance certificates with renewal dates, and whoever in the business can answer the exclusion ground questions without guessing. The Cabinet Office guidance published on the platform itself is the authority on what is required; where this page and that guidance differ, follow the guidance.
The share code
What a share code actually is
A share code is a short reference you generate on CDP and give to a buyer, and it is the consent mechanism. Handing over the code is the act that permits retrieval. Without it there is no route in: retrieval is by share code only, and there is no lookup by company name or by organisation identifier. That constraint is deliberate, and it is the answer to the reasonable worry that a central register means anyone can help themselves to your information.
The second thing to understand is that a share code is a snapshot, not a login. It reflects your information as it stood at the moment you generated it. It is not a live window into your account that updates as you edit.
How long does one last?
It is better to think in terms of staleness than expiry. A code does not lapse on a clock the way an insurance certificate does, but it stops being an accurate account of your business the moment anything behind it changes, and buyers commonly ask for a recently generated code or a fresh one where something material has moved. The safe working habit is to generate a new code for each submission, quote it in that submission, and regenerate whenever a director changes, your registered address changes, new accounts are filed, or your position on any exclusion ground changes. Generating a code costs nothing and takes seconds, so there is no reason to nurse an old one.
Identifiers
PPON, and why the identifier matters at the end
Registration produces a persistent organisation identifier, the PPON. Suppliers usually meet it as a code they are asked for and then forget, but it earns its keep at the far end of a procurement rather than at the start. A published contract award has to name the winning supplier under a recognised register, so that the organisation in the notice is unambiguously the one that won.
That is a real constraint in the Find a Tender rules rather than a formality, and it is why our own award notice drafts carry the winner’s registered identity, preferring a genuine Companies House number where one exists and using the PPON where it does not. Keeping company number, PPON and legal name consistent across your own records removes a whole category of delay from the end of a procurement you have already won.
Common confusions
What CDP does not do
Almost every support question about CDP is really one of these five.
It is not a bid portal
You do not submit tenders on CDP. Bids go to whichever system the buyer runs the procurement in, which may be ours, may be another platform, and may still be a document upload somewhere else.
It is not a supplier list
Registering does not admit you to anything, does not shortlist you and does not mean you have been approved. There is no waiting to be accepted.
It does not find work for you
CDP holds your information. Finding the opportunity is a separate job, done on Find a Tender or through a discovery service.
It does not replace the buyer questionnaire
It removes the repetitive core of it. Buyers still ask requirement-specific questions, and you still write the answers that win the thing.
It does not verify you to a buyer
It holds what you declared, sourced where relevant from public registers. Assessment stays with the contracting authority.
On this platform
How CDP is used here, today
Plenty of procurement software describes CDP in the future tense while implying the present one. We would rather be exact, because a supplier discovering the difference mid-bid has lost an afternoon, and a buyer discovering it in a demo has stopped believing everything else on the page.
Works today
Suppliers. Your account page holds your company name and number, addresses, website, SME status, DUNS and VAT numbers, and your CDP share code, PPON and SSQ code. Saving those is deliberately not gated, so those references are on file for buyers who need them, and your code is already recorded for the day automatic retrieval arrives.
Buyers. Notices are composed by the stage of the procurement that generates them, validated against Find a Tender’s own XSD and rule set at the production weight, held for a named person to review, and released to Find a Tender as a deliberate, audited act. Test and live environments are kept strictly apart: an unset test endpoint causes a refusal rather than a quiet fallback to production, and any call whose host contradicts its declared environment is refused in either direction. A rehearsal cannot become a publication by accident.
Built, tested, and switched off
Redeeming a share code to fill in your profile does not work yet. The code for it exists and is exercised end to end in mock mode: retrieval by share code, mapping the response onto a supplier profile, collecting every identifier, normalising the CDP organisation identifier into the form a notice can publish, and a preview mode that shows you what would change before anything overwrites what you typed. It is written, audited and waiting.
It is switched off in two independent places. In the product interface, the pull button carries a “coming soon” badge and is disabled by a build-time constant. On the server, the retrieval target fails closed unless the Central Digital Platform endpoint and key are configured, and those values come only from completing CDP onboarding as a platform. Either gate alone is enough to stop it, which is how it should be. Note too that suppliers do not, and will not, hold CDP API keys of their own: a supplier-side pull is performed with the platform credential, on the strength of the share code you provided.
So the honest framing is the one the product itself uses. Save your share code now. Automatic pulling is coming, and your code will be ready when it arrives. In the meantime you enter your company details manually, which takes a few minutes once rather than a few minutes per tender.
One thing not to read into it
A share code saved on a supplier profile is a reference, not a verification. Nothing on our side currently checks it against the Central Digital Platform, and nothing checks a company number against Companies House. They are fields you control. Treat any system that describes a self-entered code as a verified supplier record with the scepticism that deserves, including ours if you ever see it worded that way.
Practical
What to do this week
If you are a supplier
Check whether a colleague has already registered your company before you create anything. Gather connected person details and your latest accounts now, while nothing is due. Register, generate a share code, and keep it with your company number so a bid manager can find it at short notice. Set a reminder to review the record after your next accounts are filed. If you are bidding through a buyer running eSourcing OS, that code can go straight onto your supplier profile today.
If you are a buyer
Ask for the share code in the same place you ask for the company number, and ask for a recent one. Decide now what your team does when a supplier has not registered, because that decision taken under time pressure is the one that produces inconsistent treatment. And check the identifier you publish the winner under, since that is where an identity mismatch surfaces at the least convenient moment.
Questions
CDP, answered
What is the Central Digital Platform?
The Central Digital Platform, usually shortened to CDP, is the UK government service where a supplier registers its organisation once and holds the core information that contracting authorities ask for on every procurement: who you are, your registered identity, your connected persons, your financial standing and your position on the exclusion grounds set out in the Procurement Act 2023. It is the same service estate that Find a Tender sits on. Registration is free.
What is a CDP share code?
A share code is a short reference you generate on the Central Digital Platform and give to a buyer. It is the consent mechanism: handing over the code is how you permit that buyer to retrieve the supplier information you have already entered, rather than typing it into their questionnaire again. It records your information as it stood at the moment you generated it.
How long does a CDP share code last?
Treat it as a snapshot rather than a certificate with an expiry date. It does not lapse on a clock, but it goes out of date the moment anything behind it changes, and buyers routinely ask for a code generated recently or a fresh one where a material fact has moved. The practical habit is to generate a new code for each submission and to regenerate after any change of directors, registered address, accounts or exclusion position.
Do I need a CDP registration to bid?
For procurements advertised under the Procurement Act 2023 you should expect to be asked for a share code, because that is the route the regime was designed around. It is worth registering before you need it rather than during a tender week, since gathering connected person details and financial information takes longer than the form suggests.
What is a PPON?
A PPON is the persistent organisation identifier issued when you register on the Central Digital Platform. It matters at the far end of a procurement, because an award notice has to name the winning supplier under a recognised register, and the PPON is one of the identifiers that can carry that. Where a real Companies House number is available it is generally the better identifier to publish under.
Can eSourcing OS pull my details from my share code today?
No, and we would rather say so plainly than let you find out during a bid. Saving your share code, PPON and SSQ code to your supplier profile works today. Redeeming the code to populate your profile automatically is built and tested but switched off, in the product interface and again on the server, until the platform completes Central Digital Platform onboarding and holds the credentials that make a retrieval call possible. Until then you enter your details manually, and your saved share code is there for buyers to use in their own systems.
Does saving a share code mean my company is verified?
No. On the supplier profile the share code, PPON and SSQ code are free-text fields you control. Nothing on our side currently checks them against the Central Digital Platform or Companies House. They are references buyers can act on, not a verification badge, and any page that tells you otherwise is overstating it.
Where is the authoritative guidance?
The Cabinet Office guidance published on the Central Digital Platform itself. This page explains how the platform works in practice and how far our own system uses it, but where the two differ, the official guidance governs.
More on the platform these suppliers bid through: eSourcing OS
Stuck on your CDP registration?
We run procurements as well as build software, so we have seen most of the ways this goes wrong. Ask, and if the answer is that you are already fine, that is a useful answer too.