G-Cloud 14 Ends on 28 October 2026: What Public Sector Buyers Need to Know About G-Cloud 15

G-Cloud 14 expires on 28 October 2026. Any call-off contract under it must be signed by that date. G-Cloud 15, which the Government Commercial Agency (GCA) launched in August 2026, is already open, and after 28 October it is the only G-Cloud route for cloud hosting, software and support. Contracts already signed under G-Cloud 14 run to the end date in their own order form.

This guide is for the people doing the buying: IT leads, commercial teams and data protection officers. It covers what changes, how the new buying routes work and the questions to ask before you choose a UK sovereign cloud or any other hosting service on the framework.

What happens when G-Cloud 14 ends on 28 October 2026?

After 28 October 2026 you cannot sign a new call-off contract under G-Cloud 14. The GCA’s announcement of G-Cloud 15 says G-Cloud 14 “remains operational until its expiry on 28 October 2026” and that every call-off contract must be signed by that date.

G-Cloud 14 started on 29 October 2024 for 18 months and was then extended by six months, to October 2026. The GCA’s G-Cloud 14 page says it will then be replaced by G-Cloud 15.

If you are part-way through a G-Cloud 14 purchase, the main options are to sign by the deadline or to restart under G-Cloud 15. Suppliers had to bid again to join G-Cloud 15, so check that the service you shortlisted is listed there before you start again.

Signing in time is only half of it. The G-Cloud 14 frequently asked questions (version 3.0) recommend that a call-off starts no more than three months after it is signed. A contract signed on 28 October 2026 should therefore start by 28 January 2027.

What happens to contracts already signed under G-Cloud 14?

They carry on. The framework sets the rules for awarding contracts. Your call-off contract sets how long your service runs. Clause 6.1 of the G-Cloud 14 framework agreement says the framework ending will not affect existing call-off contracts.

Clause 1.2 of the G-Cloud 14 call-off contract says each contract expires on the expiry date in its order form. That is up to 36 months from the start date, plus one optional extension of up to 12 months if the order form allows it, so 48 months at most.

The extension comes with conditions. It must have been written into the contract at the start, and both parties must agree in writing to use it. The G-Cloud 14 FAQ also says central government buyers must agree any G-Cloud 14 call-off that runs beyond 24 months with the Government Digital Service (GDS) spend controls team, so the team can check the exit strategy.

So a contract signed in March 2026 could run into 2029, or 2030 with its extension. Check the expiry date and the extension terms in your own order form, and plan the replacement early. When the contract ends, you buy its successor through G-Cloud 15 or a later framework.

What is the G-Cloud framework, and how has it run since 2012?

The G-Cloud framework is an agreement between the government and assessed suppliers that lets public sector bodies buy cloud services from a published catalogue without running a full tender each time. Each purchase is a call-off contract, which is the individual contract a buyer signs under the framework’s terms. G-Cloud started in 2012, and each version is let as a new agreement with its own supplier list.

Recent versions show how the cycle has worked. G-Cloud 12 was extended twice and, according to the GCA’s G-Cloud 12 page, stayed open for new call-offs until 27 November 2022. The G-Cloud 13 agreement ran from 9 November 2022 to 8 November 2024. G-Cloud 14 started on 29 October 2024 and, after its six-month extension, ends on 28 October 2026. G-Cloud 15 changes the pattern: it runs for four years and lets new suppliers join part-way through.

What is G-Cloud 15, and what has changed?

The G-Cloud 15 framework is the government’s agreement for buying cloud hosting, software and cloud support. The GCA calls it the biggest upgrade in G-Cloud’s history. It merges G-Cloud 14 Lots 1 to 3, G-Cloud 14 Lot 4 and the separate Cloud Compute 2 framework into one agreement, and it is the first version of G-Cloud let under the Procurement Act 2023.

The GCA’s G-Cloud 15 page lists more than 50,000 services from more than 4,000 suppliers. The government expects about £3 billion of public sector cloud spending a year to go through it.

What are the G-Cloud 15 dates?

The G-Cloud 15 start date is 6 August 2026 on the GCA’s agreement page, the day the framework was signed. The buyer guide gives 11 September 2026. The framework runs to 5 August 2030 and reopens to new suppliers after 18 months and again after 36 months. Any G-Cloud 14 call-off must be signed by 28 October 2026.

The 5 February 2028 date on the GCA page is easy to misread as the end of G-Cloud 15. It falls 18 months after the start, when the framework first reopens. The contract details notice on Find a Tender gives the full term as 6 August 2026 to 5 August 2030. At each reopening, the buyer guide says, new bids are assessed on the same basis as at the first award.

Which G-Cloud 15 lot do you need?

For hosting, start with Lot 1a. Lot 1b is for the same kind of service when it has to operate above OFFICIAL.

You can sometimes buy a bundle from one supplier. The G-Cloud 15 buyer guide gives the example of a platform service bought through Lot 1a together with software and a migration. The largest share of your requirement must fall within the main lot, the extra services must be ones that lot allows as add-ons, and you still follow one of the framework’s award procedures. The guide adds that a bundle awarded without competition needs a strong, documented justification.

How do you search the G-Cloud catalogue on the Digital Marketplace?

Anyone can browse G-Cloud 15 services on the Digital Marketplace without an account. For an award, the buyer guide says you find services in the GCA’s Contract Award Service (CAS), apply the framework’s filters in a set order and keep a record of each step. You can look at services before choosing a lot, but you can only save and download your list once a lot is selected.

The public G-Cloud search on the Digital Marketplace uses the same groups of filters as the award process. On 19 October 2026 it returned 43,896 results across the four lots it shows, 2,093 of them in Lot 1a.

The award without competition guidance (version 1.2, updated on 8 September 2026) sets the order. The competitive route uses the same filters to build its shortlist.

1. Write your statement of requirements first. If you need a certification such as ISO 27001, put it in the requirements.
2. Choose the lot. For hosting that is usually Lot 1a.
3. Apply the taxonomy filters, which sort services by type. Virtual servers sit under IaaS Compute, for example.
4. Apply the social value filters, if your organisation uses them.
5. Apply the standardised technical filters. They cover certifications, the cloud deployment model, connection to public sector networks such as PSN or HSCN, data storage and processing locations, staff security clearance and supplier type, among others.
6. Read the technical information in each remaining listing and check it against your requirements. You may ask basic clarification questions, such as current capacity or delivery timelines.
7. If the list is still too long, use keyword search with generic terms. Put exact phrases in double quotation marks. Never search for a supplier’s service name or copy its wording: the guidance says that is unfair and leaves the award open to challenge.
8. Save and download the shortlist, keep the record of how you built it, and move to award soon after, because suppliers can update their listings.

Here is a worked example. A council wants managed virtual servers, with its data held in the UK and multi-factor authentication for administrators. It picks Lot 1a and narrows the taxonomy to IaaS Compute. After any social value filters it uses, it sets the data storage and processing location to United Kingdom and the management access authentication filter to multi-factor authentication. The services left are the ones it reviews and, in an award without competition, prices.

How do you find G-Cloud 14 suppliers and G-Cloud 15 suppliers?

The Digital Marketplace publishes an A to Z list of G-Cloud suppliers for each live version: one for G-Cloud 15 suppliers and one for G-Cloud 14 suppliers. A supplier on the G-Cloud 14 list is not automatically on G-Cloud 15, because suppliers had to bid again. Before you shortlist, check that the service listing names G-Cloud 15 as its framework.

The pool for hosting is smaller than the headline figures suggest. The G-Cloud 15 contract details notice, published on 4 September 2026, names 88 suppliers on Lot 1a and 16 on Lot 1b.

Save a copy of the G-Cloud 14 list before 28 October 2026. It shows which G-Cloud 14 suppliers you may still hold contracts with, and comparing it with the G-Cloud 15 list tells you whether an incumbent has moved across. The lists for G-Cloud 12 and G-Cloud 13 were no longer online on 19 October 2026, so the G-Cloud 14 list may not stay available once the framework expires. Bear in mind that suppliers write their own service names and descriptions, as the GCA’s guidance points out, so a claim in a listing is the supplier’s claim until you check it.

How do you buy through G-Cloud 15?

There are two routes. Award without competition suits simple, lower-value needs that an existing catalogue service already meets. A competitive selection process suits complex, high-value or tailored needs.

Both start in the GCA’s Contract Award Service (CAS), where you filter the catalogue to build a shortlist. You sign in through the Public Procurement Gateway. Under the Procurement Act 2023, your organisation also needs to be registered on the Central Digital Platform.

The two-stage process has a shortlisting stage and then one invitation to tender. The multi-stage process lets you add steps such as demonstrations, site visits or negotiation before the final tender.

An award without competition has firm limits. You apply the framework’s objective mechanism exactly, with no criteria or weightings of your own, and choose the lowest price worked out from the framework prices. Clarification questions must stay basic. Running a request for quotation, a request for proposal or a negotiation, or issuing an invitation to tender, breaches the agreement. The terms are fixed at award, and you cannot add special terms of your own.

A competitive selection process gives you more room. You set the weightings: quality, including social value, between 10% and 90%, and price between 10% and 90%. You can add your own conditions of participation on technical ability, legal capacity or financial capacity. The guidance says you must not demand audited accounts unless the Companies Act 2006 requires them, insist on insurance before award or require previous work for your organisation. Tenders stay open for 90 working days unless you set another period.

What must you publish after a G-Cloud 15 award?

The Procurement Act 2023 adds transparency steps to G-Cloud 15 purchases. The buyer guide says you publish a contract award notice for above-threshold competitive awards and for awards without competition, then a contract details notice within 30 days of entering the contract. It also suggests a voluntary standstill period of eight working days, mainly for high-value contracts.

Contracts above £5 million carry two more duties. Under section 53 of the Procurement Act 2023, you publish a copy of the contract within 90 days of entering it. Section 52 requires you to set and publish at least three key performance indicators, unless one of its exceptions applies.

The guide adds a few practical steps around the notices. The supplier signs the call-off order form first and you sign second. You record the award on the G-Cloud 15 Customer Contract Award Record, and you pay invoices within 30 days of receipt.

How long can a G-Cloud 15 call-off contract run?

According to the buyer guide, a call-off under Lot 1a or 1b can run for up to eight years: an initial term of up to five years, then one or more extensions of up to 12 months each, up to three years in total. Call-offs under Lots 2a, 2b and 3 can run for up to six years: up to four years, then up to two years of extensions.

The GCA’s launch announcement gave a maximum of 60 months, which is the initial term for Lots 1a and 1b. If the length matters to your business case, confirm the maximum with the GCA before you sign. Central government buyers must also follow the Cabinet Office spend controls, which the buyer guide points to.

In an award without competition, the price comes from the supplier’s published listing. Listings cannot say “price on application” or “from £x per day”, and the buyer guide says you cannot negotiate prices or ask for an individual discount. A price review, such as indexation, applies only if both sides agreed it before the award, with its frequency, method and caps set out. In a competitive selection process, prices come from the tenders, which must be based on the framework’s pricing mechanism, and a multi-stage process can include a negotiation stage before the final tender.

Where does sovereignty fit in a G-Cloud 15 purchase?

G-Cloud 15 does not make sovereignty decisions for you. Hosting and software listings state where data is stored and processed, but location is only part of the picture.

UK government policy has no universal requirement for OFFICIAL data to stay in the UK. The government’s multi-region cloud guidance (February 2025), which covers public cloud and SaaS, allows data, including OFFICIAL-SENSITIVE, to be stored and processed overseas when legal, data protection and security practices are satisfactory. In June 2026 the government said in a written answer to Parliament that departments, as data controllers, must assess and mitigate the risk from laws such as the US CLOUD Act themselves.

That makes it a judgement for each buyer, and these are the questions that decide it.

The Information Commission (formerly the ICO) sets out the restricted transfer rules in its guidance on whether you are making a restricted transfer. We explain the difference between where data sits and who controls it in our white paper on cloud sovereignty.

Part of this can go into the shortlist itself. The standardised technical filters include data storage and processing locations, the minimum government security clearance and staff screening against BS 7858:2019. Ownership and sub-processors have no filter. In an award without competition, clarification questions must stay basic, so if those answers will decide the award, the guidance points you to a multi-stage competition instead.

What can you not buy through G-Cloud 15?

Some purchases go through other GCA agreements. The GCA’s G-Cloud 15 page points buyers elsewhere for these.

If your project mixes cloud hosting with rack space in a data centre, you will need G-Cloud 15 for the cloud service and a separate route for the colocation, such as Crown Hosting Services.

Crown Hosting works differently from G-Cloud. The GCA’s Crown Hosting II page, which covers the same RM6262 agreement, lists a single supplier and an expiry date of 6 October 2029. You first sign an access agreement with the framework authority, then a call-off agreement, and then place orders by direct award from a set catalogue of products and prices.

What mistakes should G-Cloud buyers avoid?

The GCA’s guidance warns that leaving the set process, for example by negotiating in an award without competition, leaves the award open to challenge. Three other mistakes are easy to miss: trusting certificates without checking them, buying outside the framework through a supplier’s marketplace, and relying only on the GCA’s financial check.

• Treating a published certificate as proof. The guidance asks you to check that certificates are correct, in date and valid on the day you award, and whether the supplier holds them itself or relies on its hosting provider’s. Our guide to ISO 22301 and what it means for your suppliers shows what to check on one of them.
• Buying through a supplier’s online “marketplace” of other vendors’ software. The buyer guide warns that contracts made that way are not G-Cloud 15 call-offs and come on the vendor’s own terms.
• Relying only on the GCA’s financial check for a large hosting contract. Lots 1a and 1b carry the Gold rating, the most critical level, and the GCA recommends that buyers run their own financial stability checks on Gold contracts.

A buyer’s checklist for G-Cloud 15

1. List anything you are buying under G-Cloud 14 that must be signed by 28 October 2026.
2. List your existing G-Cloud 14 contracts with their expiry dates and extension options.
3. Register on the Central Digital Platform and set up a Public Procurement Gateway account for CAS. Your organisation needs at least one gateway administrator before staff can create accounts.
4. Write a statement of requirements that covers data location, support access and exit, not only technical needs.
5. Pick the lot: 1a for most hosting, 1b for services above OFFICIAL.
6. Choose the route: award without competition, or a competitive selection process.
7. Apply the filters in the set order, then save and download the shortlist with a record of each step.
8. Check suppliers for exclusions under section 57 of the Procurement Act 2023.
9. Check that each supplier’s certificates, including Cyber Essentials Plus for Lots 1a and 1b, are valid on the day you award.
10. Ask the sovereignty questions above and keep the answers with your data protection impact assessment.
11. Publish the notices the Act requires, including the contract details notice within 30 days of signing.

How BlackBox Hosting can help

BlackBox Hosting is listed on G-Cloud 15 (Lot 1a). Our service, Sovereign Cloud Virtual Servers, is a managed private cloud with data stored and processed in the UK. We are also on G-Cloud 14 (Lot 1) until it expires on 28 October 2026.

We are ISO 27001, ISO 22301 and CSA STAR Level 2 certified and hold Cyber Essentials Plus. We describe our billing as “static monthly billing with no consumption penalties”.

Talk to an expert about your requirement and the questions above.

This article explains the framework in general terms as of 19 October 2026 and is not legal or procurement advice.

Frequently asked questions