Summary
EU public IT procurement has grown rapidly to exceed €80 billion annually, driven by digital transformation agendas, cloud migration, AI adoption, and cybersecurity investment across all 27 member states. Technology companies of all sizes — from hyperscale cloud providers to specialist boutique consultancies — can access this market through TED Europa. This guide covers the key CPV codes, typical qualification requirements, major framework agreements, and winning strategies for EU IT tenders in 2026.
The EU Public IT Market in 2026
Public sector IT spending in the EU has accelerated dramatically since the COVID-19 pandemic, which exposed critical gaps in government digital infrastructure. The European Commission's Digital Decade 2030 targets — including 100% online access to key public services and widespread AI deployment in public administration — are translating into concrete procurement pipelines across all member states.
Key drivers of IT procurement growth in 2026 include:
- Legacy system modernisation across national and regional governments
- Cybersecurity investment following the NIS2 Directive (Directive 2022/2555/EU) coming into full effect
- AI and data analytics deployment in tax authorities, social services, and healthcare
- Cloud-first policies replacing on-premise infrastructure
- Interoperability infrastructure under the Interoperable Europe Act (Regulation 2024/903)
Key CPV Codes for IT Services
- 72000000 — IT services: consulting, software development, internet, support
- 72200000 — Software programming and consultancy services
- 72212000 — Programming services for application software
- 72250000 — System and support services
- 72300000 — Data services
- 72310000 — Data processing services
- 72315000 — Data network management and support services
- 72600000 — Computer support and consultancy services
- 72700000 — Computer network services
- 48000000 — Software packages and information systems
- 48800000 — Information systems and servers
- 79993000 — Building and facilities management systems (for smart building IT)
For cybersecurity specifically, relevant codes include 72212730 (cybersecurity software development) and 72222300 (information technology services). For cloud services, authorities typically use 72320000 (database services) or 72315000, though the CPV system predates dedicated cloud categories.
Major EU IT Framework Agreements
A significant share of EU public IT spending flows through framework agreements rather than individual contract notices. Getting onto a framework is a high-value investment — once listed, you can be called off for multiple contracts without competing in a full tender each time.
Key EU-level IT frameworks include:
- DIGIT frameworks (European Commission): The Commission's DIGIT unit runs multiple IT services frameworks covering software development, cloud infrastructure, cybersecurity, and IT consultancy. These are open to EU institutions and often also to member state authorities.
- ENISA frameworks: The EU Agency for Cybersecurity runs procurement for cybersecurity services and research.
- National central purchasing bodies: France (UGAP), Germany (BWB for federal IT), Denmark (SKI), and the Netherlands (ICTU) all operate IT frameworks accessible to a wide range of public authorities within their country.
Monitor TED for Prior Information Notices (PINs) announcing upcoming framework competitions — these give you advance notice to prepare strong applications.
Qualification Requirements for IT Contracts
IT services contracts typically require:
- Annual turnover: For large framework agreements, €2–10 million minimum; for individual project contracts, proportionate to contract value
- Professional indemnity insurance: €1–5 million coverage typical for software development and consultancy
- Relevant references: 2–5 comparable projects completed within the last 3–5 years, with description of scope, technology stack, and client
- Key personnel CVs: Named project managers, technical architects, developers with relevant certifications
- ISO 27001: Information security management certification — increasingly mandatory for contracts involving sensitive government data
- GDPR compliance documentation: Data processing agreements, DPO appointment evidence
For cloud services, contracting authorities are increasingly referencing EUCS (EU Cloud Services Certification Scheme) levels under ENISA, and some specify requirements for data residency within EU borders.
Emerging Opportunities: AI and Automation
Artificial intelligence procurement by public authorities is growing rapidly. The EU AI Act (Regulation 2024/1689), which defines risk categories for AI systems, is shaping procurement requirements — public authorities deploying high-risk AI systems (in areas like law enforcement, benefits assessment, or recruitment) must now procure AI solutions that meet specific transparency, accuracy, and human oversight requirements.
This regulatory environment creates a competitive advantage for vendors who can demonstrate compliance with the AI Act, including explainability tools, bias testing methodologies, and human-in-the-loop process designs. Companies that invest in AI Act compliance documentation will find it significantly easier to qualify for public sector AI contracts in 2026 and beyond.
Winning Strategy for IT Tenders
IT tenders are evaluated on quality more heavily than most sectors — quality/price splits of 70/30 or even 80/20 are common. Key differentiators include demonstrating deep understanding of the specific legacy environment being modernised, presenting an agile delivery methodology with realistic risk mitigation, showing a track record of on-time, within-budget delivery for comparable public sector clients, and evidencing your team's specific technical certifications (AWS, Azure, Google Cloud, cybersecurity frameworks). Reference letters from public sector clients carry more weight than equivalent private sector references.