The 2025–26 tax year ends on 6 April 2026. For most UK SMEs, that date triggers a familiar scramble across finance and operations — but IT compliance often gets pushed to the bottom of the pile until it is too late.

Several regulatory deadlines and compliance renewals converge at this point in the calendar. Cyber Essentials certificates expire after 12 months. Making Tax Digital for Income Tax continues its phased rollout. And procurement opportunities in the new tax year will expect up-to-date security credentials from any supplier that wants to bid.

This checklist walks through the IT tasks that SMEs should complete before 6 April, so you start the new tax year compliant, not caught out.

What IT compliance tasks expire around 6 April?

The most common deadline that lands at this time of year is the annual renewal of Cyber Essentials. Your certificate — whether the standard scheme or Cyber Essentials Plus — is valid for 12 months from the date of issue. If you were certified in late March or early April last year, your certificate will expire within weeks of the new tax year beginning.

Cyber Essentials is not optional for many businesses. It is a mandatory requirement for suppliers bidding on UK government contracts. Even outside the public sector, commercial clients increasingly ask for proof of Cyber Essentials certification as a condition of engagement.

The scheme has also been updated. From 26 April 2026, the NCSC's Requirements for IT Infrastructure v3.3 (the "Danzell" question set) replaces the previous Willow set. The five foundational controls remain the same — firewalls, secure configuration, access control, malware protection, and patch management — but the marking criteria have been tightened. Cloud services are now explicitly in scope. External attack surface vulnerability management has a new 14-day automatic-fail criterion for critical vulnerabilities. And for the first time, a senior director must sign a declaration confirming ongoing compliance.

If your certificate expires near 6 April, you should start the renewal process well in advance. Under the new rules, you will have six months from the date your IASME account is created to complete the assessment. Starting early avoids last-minute pressure and gives you time to address any gaps before the stricter marking criteria apply.

Is your business ready for Making Tax Digital for Income Tax?

Making Tax Digital for Income Tax Self Assessment (MTD ITSA) has been postponed several times, but the current timetable is clear. Sole traders and landlords with qualifying income above £50,000 must comply from 6 April 2026. Those with income between £30,000 and £50,000 will join from April 2027.

MTD ITSA replaces the traditional annual Self Assessment tax return with a digital process. You must keep digital records using MTD-compatible software, submit quarterly updates to HMRC, and file a Final Declaration at the end of the tax year.

For SMEs that are sole traders or small landlord businesses, this means your accounting software must be MTD-compatible and your bookkeeping processes need to support quarterly submissions. If you are still using spreadsheets or non-compatible tools, the next six weeks are the time to switch.

Even if your income falls below the current threshold, adopting MTD-compatible software now means you will be ready when the lower threshold takes effect in 2027. It is not a task that benefits from procrastination.

What about your backup and disaster recovery posture?

Year end is also a natural point to test your backups. Many SMEs have a backup solution in place but have not verified that it actually works — or at least, not recently enough to be confident.

Before 6 April, run a restoration test on your critical systems. Verify that your backups cover all business-critical data, that off-site or cloud copies are current, and that the restoration process is documented and accessible to whoever needs it.

If you do not yet have a structured backup and business continuity plan, this is the moment to build one. A proper plan covers backup frequency, retention periods, testing schedules, and clear escalation procedures. Without it, you are operating on hope rather than evidence.

See how our standard approach to backup and business continuity helps SMEs stay resilient. Learn more about our backup and business continuity service.

Should you review your IT governance and standardisation?

If your business has grown over the past year — new hires, new equipment, new cloud services — your IT environment may have drifted from a consistent baseline. Ad hoc software installations, inconsistent password policies, and varying device configurations are common in growing SMEs, and they create security gaps that attackers exploit.

Standardisation is the discipline of ensuring every device, every account, and every service follows a defined baseline. It is not about control for its own sake; it is about reducing the surface area for compromise and making your IT environment predictable, manageable, and auditable.

Before the new tax year begins, take time to inventory your assets and verify that your IT standards are being enforced. This is the kind of exercise that also makes Cyber Essentials renewal smoother, because you will already know where your gaps are.

Read about how standardisation creates control instead of guesswork in growing businesses. Understand the difference between control and guesswork.

Is your IT support framework up to date?

Managed IT support is not a luxury for SMEs — it is the baseline expectation for any business that cannot afford unplanned downtime or a security incident. But having a support provider is only half the equation; you need to verify that the service level, coverage, and response times match what your business actually needs.

Before 6 April, review your managed IT support contract. Confirm that it covers your current infrastructure, that response times are adequate for your operations, and that you have clear escalation paths. If your business has changed — more staff, more cloud services, remote working — your support arrangement should reflect that.

See how our standard-by-default approach to managed IT support in Sussex keeps SMEs running smoothly. Explore our managed IT support offering.

What other IT tasks should SMEs complete before the new tax year?

Beyond the major compliance items above, there are several smaller tasks that are worth addressing before 6 April:

Update your IT asset register. Every piece of hardware and software in use should be recorded, including purchase date, warranty status, and responsible person. An accurate register makes budgeting for the new tax year much easier.

Review user access and permissions. Staff departures and role changes over the past 12 months mean some people may still have access they no longer need. Remove former employees' accounts immediately and audit current permissions against job roles.

Check software licences and subscriptions. Unused or duplicated licences are a common waste of budget. Consolidate where you can, and ensure every active licence is properly assigned and documented.

Verify your insurance coverage. Many SMEs' cyber insurance policies require specific security controls — Cyber Essentials certification, MFA, encrypted backups — as a condition of cover. Confirm that you still meet those requirements before the policy renewal date.

Plan next year's IT budget. Use the findings from your year-end review to build a realistic budget for 2026–27. Factor in compliance renewals, equipment refreshes, and any infrastructure changes your business growth will require.

When should SMEs start these tasks?

There is no benefit to waiting until the last week of March. The Cyber Essentials renewal process under v3.3 can take several weeks, particularly if you need to implement new controls. MTD ITSA adoption requires software migration and team training. Backup testing should not be rushed.

Starting these tasks now — in late March 2026 — gives you breathing room to address issues without the pressure of an approaching deadline.

Final thought: start the new tax year on the right foot

The 6 April date is not just a financial milestone. It is a natural checkpoint for your entire IT compliance posture. Completing these tasks before the new tax year begins means you start 1 April with confidence rather than catching up.

If you would like a structured assessment of your current IT compliance position, our Security Triage Call gives you a clear baseline and a practical roadmap. Book your Security Triage Call today.

This article was published on 30 March 2026. It covers UK regulatory deadlines and compliance requirements applicable to SMEs in the United Kingdom. Always verify current requirements with official sources or a qualified advisor.