A UK shortlist should cover more than one city
Buyers here often run a search that is really a search of the capital, then conclude that the market is expensive. The mobile app supplier base is in fact spread across a dozen regional clusters, and the day rate difference between them is large enough to change what your budget buys, while the practical difference in how you work together is now close to nothing.
The useful discipline is to decide what proximity is actually for. Workshops with stakeholders who will not engage over video, research sessions with users in a particular place, or a regulated environment where someone has to be on site are real reasons to buy locally. Convenience is not one, and paying a premium for it means paying for offices rather than for engineering. Write down how many days on site you genuinely need across the whole engagement, then let the shortlist follow from that number.
Where the rate differences actually come from
A wide spread of quotes for the same brief usually reflects three things rather than one. The first is location cost, which is real and says nothing about quality. The second is seniority mix: a low blended rate often means junior developers with occasional oversight, which is fine for well trodden work and expensive for anything ambiguous. The third is scope, and it is the largest factor by far.
So read the exclusions before the totals. Discovery, design iterations, content entry, store submission and the response to a rejection, device test breadth, accessibility work, analytics, training and the first months of support are the usual gaps between a cheap document and a complete one. Ask every candidate for the seniority of the named people and how many hours each will give you weekly, because a plan that depends on one senior engineer for a few hours a week behaves very differently from one where they are present daily.
If users can post, upload or message, you have statutory duties
Online safety rules now place obligations on services that let people share content with each other, and they apply to a mobile app as much as to a website. The practical consequences are concrete: a way to report content and a defined response, moderation that actually happens, risk assessment documented rather than assumed, and age assurance proportionate to what your service exposes people to.
None of that can be bolted on cheaply, because reporting, blocking and moderation tooling are product features with screens, workflows and staffing behind them. Ask each candidate whether they have shipped a product with user generated content under these rules, what they built for moderation and who operates it after launch. If a supplier treats this as a legal question rather than a design and operations question, they have not built one.
Subscription rules your mobile app has to inherit
Consumer protection law here has tightened around automatic renewal, reminders and the ease of getting out of a contract. That sits awkwardly with the fact that a subscription bought inside a store is managed by the platform: renewal, cancellation and refunds run through their system, and your own support team sees less than a customer expects them to.
Resolve the tension deliberately rather than discovering it in a complaint. Decide where subscriptions are sold and what happens to someone who buys on one platform and contacts you on another channel. Make the renewal terms legible at the point of purchase rather than in a settings screen, and make sure the description in the store listing matches what the product does today rather than what is planned. Ask each supplier how they have handled cancellation journeys before, since the difference between a compliant path and a frustrating one is a handful of screens.
Data protection after divergence, and what to put in the contract
The domestic regime remains close to the European one but is no longer identical, and the practical questions for a buyer are unglamorous. Where is personal data stored and processed. Which subprocessors are involved. What transfer mechanism covers any of them sitting overseas. What the breach notification path is and who makes the call.
Get the processing agreement and the subprocessor list during the tender rather than after, and attach the list of third party components to the contract so it cannot grow quietly. Every analytics, advertising and crash reporting library you include carries its own collection behaviour into the privacy declaration both platforms require before they accept a submission, and a mobile app that cannot explain its own data flows will stall at review as well as at the regulator.
Employment status, relief claims and who owns the code
Two commercial details catch mobile app buyers out here more than anywhere else. The first is how the people on your project are engaged. Firms vary between employed staff, long term contractors and associates brought in per project, and the status rules mean the arrangement has consequences for both sides. Ask who employs the individuals doing the work, because it affects continuity, confidentiality and what happens when someone leaves mid engagement.
The second is research relief. Development work involving genuine technical uncertainty may qualify, and the rules on subcontracted and overseas work have moved. Both you and the supplier may have an interest in claiming, and both positions cannot be true in the same way. Settle it during contracting alongside the ownership clause, and keep the documentation of who did what. Then fix the basics: store accounts, signing keys and push credentials registered to your organisation, the repository under your control, and a clean build from your own copy as part of acceptance.
Running a national tender for mobile app suppliers
Brief three firms with an identical document covering what the product does, who uses it, what it integrates with, what data it touches, what obligations apply and what the first release must achieve. Compare their questions, assumptions and exclusions before their figures, and ask each of them what they would remove. Take references from whoever ran the product a year after launch rather than from the person who signed.
Price maintenance separately and say what it covers, including the annual operating system releases both platforms ship, store policy changes and expiring certificates. City level pools are listed on their own pages, so a requirement that needs a specific market can start from the capital, Manchester, Bristol or Edinburgh. Keep adjacent scopes as their own tenders with custom software firms, web development suppliers or marketing agencies working nationally, and use the mobile application development directory for the wider picture. When the brief is written, put it in front of several verified studios at once.