RM6378 Statutory and Technical Compliance: What Suppliers Must Demonstrate Across All Lots

For many suppliers considering a bid under the Crown Commercial Service RM6378 Facilities Management and Security Services Framework, statutory and technical compliance is the area that causes the most hesitation. The framework brings together a wide set of legal, regulatory and technical duties across Hard FM, Soft FM, Security and Total FM. It is written to protect public sector buildings, staff and visitors, and therefore expects suppliers to operate safely, legally and in line with industry standards from day one.

This article explains, in straightforward terms, what compliance looks like under RM6378, what suppliers need to show, and what smaller FM businesses must prepare before bidding. It does not offer bid answers or model text — instead, it clarifies what CCS expects and how organisations can demonstrate readiness.

Why statutory and technical compliance matters under RM6378

RM6378 is clear: suppliers must already understand and comply with the laws that govern facilities management and security work. This is not optional. Failure to meet statutory duties can lead to service failure, contractual action, or removal from the framework. The specification spells out compliance expectations across every Lot, and suppliers who understand these early have a far smoother path to mobilisation and long-term delivery.

The good news is that CCS does not expect complicated explanations. It expects organisations to show they can operate safely, legally and reliably, using processes they already follow in their day-to-day work.

Compliance expectations for Hard FM suppliers (including TFM bidders)

Hard FM brings the most intensive set of statutory obligations. RM6378 expects suppliers to have robust processes for areas such as:

Asset safety, inspection and maintenance

Suppliers must demonstrate that building fabric and engineering assets are managed in line with statutory inspection intervals, competent personnel requirements and recognised industry standards. This includes electrical safety, gas safety, pressure systems, lifts, water systems and fire safety infrastructure.

Building safety regulations

The framework aligns with current UK building safety requirements. Suppliers must operate within relevant legislation, maintain clear records, and escalate any risks that could lead to enforcement action.

Legionella and water hygiene

Clear procedures must already exist for monitoring water systems, ensuring safe temperatures, carrying out required testing and flushing, and maintaining auditable evidence.

Asbestos management

Organisations must be able to work within an existing asbestos management plan and know how to identify, report and escalate asbestos-related risks safely.

Fire safety duties

Suppliers must understand their responsibilities under relevant fire safety legislation, including maintaining passive and active fire systems, supporting the customer’s fire risk assessment process, and ensuring competent persons carry out works.

These are not theoretical expectations. RM6378 assumes that suppliers already run these controls as part of everyday FM operations.

Practical advice for bidders

If you are a smaller FM business, now is the time to check that your statutory compliance processes are written down, up to date and have clear evidence trails. CCS will not ask for this evidence during the bid, but you will need it for mobilisation and ongoing assurance.

Compliance expectations for Soft FM suppliers

Soft FM has a lighter regulatory footprint than Hard FM, but there are still essential duties that cannot be ignored.

Cleaning and hygiene legislation

Suppliers must demonstrate safe use of chemicals, training in cleaning standards, and adherence to workplace hygiene rules relevant to different building types.

Catering and food safety

Where catering is included, the framework requires strict compliance with national food safety legislation, allergen controls and hygiene monitoring — all backed by competent staff and appropriate records.

Waste and recycling duties

Suppliers must operate within environmental legislation governing waste segregation, storage and disposal, particularly where hazardous or clinical waste is present.

Grounds and pest management

Organisations must have safe procedures for grounds equipment, chemicals, wildlife protection duties and pest control regulations, including licensing requirements where relevant.

Practical advice for bidders

Soft FM suppliers should confirm that staff training records, COSHH documentation, food hygiene procedures and waste management processes are complete and easy to evidence during mobilisation.

Compliance expectations for Security suppliers

Security services sit under a distinct legal framework, and RM6378 requires suppliers to meet those standards consistently.

Licensing requirements

The Security Industry Authority requirements apply across guarding, door supervision and associated roles. Suppliers must ensure that all operatives hold valid licences and that renewal processes are well managed.

Data protection and surveillance obligations

Where CCTV is managed, suppliers must operate in line with UK data protection legislation and recognised codes of practice. Record-keeping, access control and incident reporting must be properly maintained.

Incident and escalation processes

The specification expects disciplined reporting, including safeguarding concerns, physical incidents, breaches of access control and emergency situations.

Practical advice for bidders

Security providers should make sure licensing records, training logs, incident reporting procedures and control room processes are up to date and consistent.

Compliance expectations for Total FM suppliers

Total FM suppliers must meet all of the compliance duties above and present a coherent structure that ties them together. This means:

• clear responsibility lines across Hard FM, Soft FM and Security
• consistent data, reporting and governance
• competent persons for each service area
• strong escalation and risk processes

The framework expects Total FM suppliers to keep every function compliant while maintaining a single leadership structure.

Practical advice for bidders

Ensure there is a simple explanation of how you coordinate compliance across multiple workstreams. CCS does not expect complexity; it expects clarity and control.

Why evidence matters — even though CCS does not ask for documents at bid stage

RM6378 does not request supporting evidence during the tender. However, successful suppliers will be required to provide documentation during mobilisation and contract operation. This means that organisations who prepare early avoid delays and risks later on.

For SMEs, a practical way to get ready is to assemble:

• statutory compliance procedures
• training and competence records
• inspection frequencies
• escalation routes
• example logs and forms
• evidence of competent persons
• subcontractor compliance controls

These materials are not shared with CCS during the competition but are required to run services safely and successfully once awarded.

Summary

RM6378 requires suppliers to demonstrate that they can operate safely and legally across all facilities management and security services. The framework specification sets the baseline, and suppliers need to be confident that their compliance processes are documented, reliable and supported by competent staff. SMEs can absolutely meet these requirements, provided they prepare their evidence and procedures early.

If you need an independent review of your readiness, email hello@baachu.com with the subject RM6378 Review.

You might also find these RM6378 guides helpful: