EU Public Procurement Act to prioritize cybersecurity, resilience, and origin

The European Commission has introduced a new draft Public Procurement Act, intended to replace three 2014 directives with a single, directly applicable legal framework. The proposal, published on September 9, 2026, introduces significant changes, particularly for IT procurements. For the first time, cybersecurity, supply chain resilience, and the origin of technology will have their own dedicated chapter within the general public procurement law.

The new regulation aims to simplify and increase the flexibility of public procurement processes, which account for approximately 2.5 trillion euros annually within the EU. According to the Commission, the current regulations have proven to be too complex and rigid, leading to legal uncertainty and often resulting in contracts being awarded primarily based on price. The reform also seeks to better address the current geopolitical landscape, where market access for third countries presents new challenges.

The most notable change for IT procurement is found in Article 66 of Part III, Title II, Chapter 4. This article obligates public contracting authorities to implement appropriate measures to protect the security interests of the Union or a Member State at every stage of the procurement procedure, provided that the procedure involves a relevant risk. This applies from planning and market consultation to contract execution and is explicitly outside the defense and security sectors.

The new act replaces three separate directives with a single regulation, thereby reducing the administrative burden. It is estimated to bring significant cost savings for both bidders and contracting authorities. The changes will also considerably impact small and medium-sized enterprises, which are expected to benefit from simplified processes. Public contracting authorities and IT providers must now carefully review the new requirements and prepare for their implementation.