Strategy // 2026Last Reviewed: April 2026TM-INS-105 // APRIL 2026
EU Data Centre and Cloud Procurement 2026: Gaia-X, EUCS, NIS2 Requirements, and Sovereign Cloud Tenders
Summary
EU public sector cloud and data centre procurement has become one of the highest-value and most technically complex categories in the TED marketplace. In 2026, three regulatory frameworks are simultaneously reshaping requirements: the EU Cybersecurity Act's cloud certification scheme (EUCS), NIS2 Directive security obligations for essential entities, and the Data Act's data portability and switching requirements. Overlaid on these is the Gaia-X initiative's specifications for federated, sovereignty-respecting cloud infrastructure — increasingly referenced in public sector tender specifications as a technical requirement rather than an aspiration.
EUCS Cloud Certification: The Three Assurance Levels
The EU Cybersecurity Agency (ENISA) is finalising the EU Cloud Services Scheme (EUCS) — the first EU-wide certification framework for cloud services. Understanding the assurance levels is essential for suppliers bidding on cloud tenders and for contracting authorities specifying requirements:
Assurance Level
Target Use Case
Key Requirement
Basic
Non-sensitive public sector data
Self-assessment against baseline security controls
Substantial
General public sector, critical services
Third-party audit; ISO 27001 equivalent
High
Sensitive government data, critical infrastructure
Accredited conformity assessment body; strict data residency and sovereignty controls
The High assurance level includes contested sovereignty requirements — originally proposed to require EU-based legal entities and EU-citizen staff to handle sensitive data. Non-EU hyperscalers (AWS, Microsoft Azure, Google Cloud) have lobbied against these requirements. The current draft allows non-EU hyperscalers to achieve High certification through EU-incorporated subsidiaries — but the political debate continues, making EUCS High the most watched certification standard in EU procurement.
NIS2 Requirements in Cloud Tender Specifications
NIS2 Directive (2022/2555), transposed by member states by October 2024, creates security obligations for essential and important entities that are flowing directly into cloud procurement specifications. Key clauses appearing in 2026 cloud tenders:
Supply chain security (Article 21): Essential entities must manage cybersecurity risks in their supply chain — meaning cloud and data centre providers must demonstrate their own NIS2 compliance or equivalent security measures. Tenders increasingly require ISO 27001 + NIS2-aligned control frameworks as a minimum technical requirement.
Incident reporting obligations: Cloud contracts must specify response times for security incident notification — NIS2 requires initial notification within 24 hours, detailed report within 72 hours. Contract SLAs must align with these statutory timelines.
Business continuity and disaster recovery: NIS2 requires essential entities to have tested BCM plans — cloud contracts specify minimum RTO/RPO (Recovery Time/Point Objectives) and require annual DR test evidence from providers.
Data Act Portability: Avoiding Cloud Lock-In in Contracts
The EU Data Act (2023/2854), applicable from September 2025, imposes specific obligations on cloud contracts including mandatory switching assistance and data portability. For procurement officers drafting cloud contracts:
Switching assistance obligation: Cloud providers must provide comprehensive switching assistance — including data export in interoperable formats, equivalent functionality during transition, and no lock-in via technical restrictions. This must be specified in the contract with defined timelines (maximum 30 calendar days for data export).
Egress fee elimination: From September 2027, cloud providers cannot charge data egress fees for data transferred out of their platform — removing a major historical lock-in mechanism. Contracts signed now should include provisions reflecting this future obligation.
Essential requirements for interoperability: The Data Act mandates that cloud providers comply with technical standards for data portability — specifying open data formats and APIs that allow contracting authorities to switch providers without re-engineering dependent applications.
EU Procurement Research & Intelligence · Est. 2025
This article was researched and written by the TenderMetric editorial team using primary sources: TED (Tenders Electronic Daily) XML feeds, official EU procurement directives (2014/24/EU, 2014/25/EU), OJEU contract notices, national procurement authority guidelines, and EU Publications Office data. Contract values and award data are sourced from official contract award notices — not estimated.
📅 Last reviewed: 2026-04-17🔄 Tender data updated daily from TED Europa
◆ Editorial Review Panel
EU Procurement Research Analyst
TED Europa · OJEU notices · CPV classification
Public Law Editor
EU Directives 2014/24 & 2014/25 · national transposition
Procurement Compliance Reviewer
Threshold verification · award data · deadline accuracy
Publisher
TenderMetric
Independent EU Procurement Intelligence
Aggregates 700,000+ EU public procurement notices per year. Coverage spans all 27 EU member states, all procurement procedures, and all CPV divisions — sourced directly from TED and the EU Publications Office.
Research Methodology
Articles are researched from official EU procurement sources: TED XML feeds, EU procurement directives, OJEU contract notices, and national procurement authority guidelines. Award data is sourced from official contract award notices — not estimated.
Tender deadlines, contract values, and buyer details change frequently. TenderMetric syncs with TED daily. Editorial articles are reviewed quarterly or when EU procurement legislation changes. Always verify tender status directly on TED Europa before submitting a bid.
◆ Live EU Tender Intelligence
Browse Live EU Public Tenders
Updated daily from TED Europa · All 27 EU member states · All CPV sectors
Editorial Notice: This article was reviewed by the TenderMetric editorial team. EU procurement law and thresholds are revised periodically. For legally binding procurement information, always refer to the official notice on ted.europa.eu. To report an inaccuracy, contact dev@tendermetric.com.
◆
TenderMetric Intelligence Team
EU Procurement Research & Analysis · Last updated May 2026
Analysis compiled from TED Europa (Official Journal of the EU), European Commission procurement data, and CPV code classifications. TenderMetric tracks 10,000+ active EU procurement notices across all 27 member states, updated daily from the TED open data feed.
Get Weekly EU Tender Alerts
New tenders from TED Europa across all 27 EU member states — every Monday. Free forever.
✓ You're on the list!
◆ EU Procurement Intelligence at a Glance
10K+
Active tenders tracked
27
EU member states
€2T+
Annual market value
Daily
Data refresh from TED
◆ EU Contract Value Distribution (above-threshold)
Works contracts (construction, infrastructure)~52%
Source: European Commission Public Procurement Statistics — approximate figures based on TED Europa data.
◆ EU Procurement Lifecycle (Open Procedure)
Day 1
Contract Notice Published (TED)
Day 1–35
Tender Preparation & Submission
Day 35–70
Evaluation & Clarifications
Day 70–85
Standstill Period (10 days)
Day 85
Contract Award Decision
Day 90+
Contract Signature & Start
Timeline is indicative. Open procedure minimum: 35 days from publication to submission deadline (Directive 2014/24/EU).
◆
About the Author
TenderMetric Research Team
EU Procurement Intelligence Specialists · tendermetric.com
Our analysts monitor 10,000+ EU procurement notices daily across construction, IT, healthcare, defense, and energy sectors. All data sourced from TED Europa and the EU Publications Office.
📋 10K+ tenders tracked🇪🇺 27 member states🔄 Updated: May 2026
◆ Common Questions About EU Procurement
What is TED Europa and where do EU tenders come from?
+
TED (Tenders Electronic Daily) is the online version of the Supplement to the Official Journal of the EU, published by the EU Publications Office. It publishes procurement notices above EU thresholds from all 27 member states, EU institutions, and affiliated bodies — approximately 700,000+ notices per year. TenderMetric aggregates and enriches this data daily.
What are the EU procurement thresholds in 2026?
+
For 2026–2027, the EU procurement thresholds are: €143,000 for supplies and services by central government authorities; €221,000 for supplies and services by sub-central authorities; €5,538,000 for works contracts. Utilities and defence sectors have separate thresholds. Contracts above these values must be published on TED.
Can non-EU companies bid on EU public tenders?
+
Third-country participation depends on international agreements. Countries covered by the WTO Government Procurement Agreement (GPA) — including the US, UK, Canada, Japan, and others — generally have access to EU tenders above GPA thresholds. Countries without GPA coverage may be excluded from specific lots. Always check the contract notice for nationality restrictions.
What is an ESPD and is it required?
+
The European Single Procurement Document (ESPD) is a self-declaration form used across the EU as preliminary evidence of a bidder's suitability. It replaces multiple national certificates at the tender stage — you only need to submit the actual certificates if you win. The ESPD is mandatory for all above-threshold EU procurements and can be completed via the eESPD online service.
How can SMEs compete for EU public contracts?
+
SMEs win approximately 45% of EU public contracts by value. Key strategies: focus on lots (contracting authorities must divide large contracts into lots where feasible); form consortia with complementary firms; target sub-central authorities (municipalities, regions) where competition is lower; use framework agreements as a stepping stone to larger contracts. The ESPD simplifies the qualification process specifically to reduce SME burden.
TenderMetric — Independent EU procurement intelligence platform. Not affiliated with the EU Publications Office, the European Commission, or TED (Tenders Electronic Daily). Tender data is sourced from TED for informational purposes only; always verify procurement notices directly at ted.europa.eu before submitting a bid. Full Disclaimer · Last Reviewed: April 2026 · Data Methodology
We use cookies to analyze site traffic and improve your experience. By clicking "Accept", you consent to our use of cookies as described in our Privacy Policy.
◆ Free EU Tender Alerts
Get Weekly EU Tender Alerts
New tenders from TED Europa across all 27 EU member states — every Monday. Free.