Procurement of digital solutions set to become significantly more complex in the EU--time to move away from 'regulation by contract'?

Source: Did loud music cause Bristol's Pero's Bridge to collapse? - BBC News.

I was invited to deliver a lecture on “Public procurement and European industrial policy: Strategic dependencies, European preference and legal limits” at Nova in Lisbon in a programme led by Filomena Vieira (slides available here). The lecture was in a module on digital procurement, which gave me the opportunity to reflect on recent EU digital law proposals bound to impact procurement of digital solutions. For me, the question was not only how much more complex digital procurement is likely to become, but what (if any) changes in approach to the current ‘regulation by contract’ model of procurement-based digital gatekeeping could arise from the proposals. Short answer: there is not much change other than in relation to (defeasible) centralised requirements by the Commission. Longer answer follows.

Procurement under the EU AI Act as the regulatory benchmark

To date, the EU AI Act has set the path for the ‘regulation by contract’ of digital technologies acquired by the public sector. As I have shown elsewhere, EU law has not directly regulated public sector AI adoption, but rather relied on public procurement as a regulatory tool. The EU AI Act contains a series of requirements for high-risk AI use cases that public buyers are required to operationalise through their tender processes and public contracts.

Setting aside the issue of the uncertainty of what AI solutions are covered by the EU AI Act’s ‘high-risk regime’ (due to the potentially rather narrow definition of AI systems in the Commission’s guidance, and the equally unclear applicability of the ‘filter exemption’ in Art 6(3) to use cases otherwise captured by Annex III, also as a result of the Commission’s guidance), in themselves, the obligations arising from the ‘high-risk’ regime are rather open-ended—which creates significant space for legal uncertainty and difficult practical operationalisation. Despite the endorsement of model contract clauses for high-risk AI procurement by the Commission, there is still no default or fallback set of terms for AI procurement under EU law and each public buyer is meant to set its own requirements by contract. This leaves a significant number of challenges unaddressed—which under-resourced public buyers can struggle to meet.

In my view, this is an unsatisfactory approach to digital regulation and, more generally, evidences the shortcomings of the ‘regulation by contract’ approach. I was thus interested in assessing if the same approach underpinned other recent proposals with an impact on the procurement of digital solutions. Without aiming to be comprehensive, I looked into the Cloud and AI Development Act, Chips Act 2.0, Industrial Accelerator Act and the proposed EU Public Procurement Act. And, within those, I focused on issues of digital sovereignty (broadly construed) and geopolitical management of access to EU procurement markets as a related concern.

Cloud and AI Development Act (CADA)

Of the several proposals, CADA is the most closely linked to the EU AI Act by subject matter. From a procurement perspective, CADA is interesting because it creates a system of tiered assurance that could relieve procurement of part of the digital gatekeeping role it has been assigned. CADA sets four levels of EU assurance. The requirements for each level are cumulative and concern issues such as the need to be established in the EU, the localisation of infrastructure and assets in the EU, data localisation, and aspects of personnel dedicated to the provision of relevant connected services. The elements that are more modular across assurance levels concern cybersecurity requirements, as well as the risk of interference by legal entities established in third countries or third country governments. Notably, while level 1 can be self-assured by the tech provider and would only, at most, require registration with a national competent authority; assurance at levels 2-4 would require independent audit and separate verification by such a national competent authority. Under this model, public buyers seeking to procure cloud services (for exclusive use…) would be able to simply state the level of assurance required and then check against the relevant decisions.

Relatedly, CADA, in principle, requires public buyers that ‘procure cloud computing services for their exclusive use’ to at least procure solutions with a tier 1 of assurance, with the requirement heightened to levels 2-4 for those public buyers whose activities have been identified as contributing to the preservation of public order or which are active in the areas of national security, internal security, external border management, defence, justice or law enforcement, including the prevention, investigation, detection and prosecution of criminal offence. However, in a return to the decision-making decentralisation characteristic of regulation by contract, this is subject to exceptions; public buyers would be able, on an exceptional basis, to decide not to procure cloud computing services recognised as having a Union assurance level 1, 2, 3, or 4 where (i) there is no recognised cloud computing services provider in the relevant EU-wide register and there is no reasonable alternative, (ii) there has been an unsuccessful attempt to procure assured services in the previous year, or (iii) ‘applying the requirements of [CADA] would require the contracting authority to procure services at disproportionate cost.’ CADA does not set a threshold of cost disproportionality for those purposes.

More centrally in the ‘regulation by contract’ approach, CADA contains a second regime of relevance for procurement, which seeks to promote the taking into consideration of Union added value. In that regard, CADA requires that ‘In public procurement procedures for innovative cloud computing services and AI systems, contracting authorities shall include, as part of the quality evaluation of the tender, non-price award criteria that allow them to evaluate the tenderer’s contribution to the development of a European cloud and AI ecosystem.’ The scope of application of this obligation is unclear, as ‘innovative cloud computing services and AI systems’ remain undefined—which seems to leave unspecified the key trigger for the obligation to use non-price award criteria relating to the tenderer’s contribution to the development of a European cloud and AI ecosystem.

Notably, those non-price award criteria must (a) be linked to the subject matter of the contract; (b) not confer unrestricted freedom of choice on the contracting authority; (c) be expressly set out in the procurement documents or in the contract notice; and (d) ancillary and not decisive in the award of the contract. I struggle, in particular, with the last requirement, especially if the issue of Union value is to be used as a tie-breaker or in any other way to differentiate between ‘EU’ and ‘non-EU’ solutions. CADA also provides a list of the considerations contracting authorities should take into account in relation to those non-price criteria, such as the tenderer’s contribution to strengthening the digital technology supply chain in the Union, or whether it has integrated technologies developed in the Union. From a procurement perspective, another difficulty is that most of those considerations relate to tech provider-level, rather than offer level, considerations—which makes their treatment as award criteria legally challenging.

Overall, then, CADA does not move very far away from the ‘regulation by contract’ approach. While the process to assure cloud solutions in pre-defined tiers could be helpful, its effectiveness is conditional on market conditions (availability, relative cost) and, ultimately, it is likely that a significant number of cloud solutions will only be subject to level 1 self-assurance, which does not address the issues of verification of tech providers’ self-declarations. Additionally, in relation to the promotion of Union value added, CADA leaves it all for public buyers to figure out (save for problematic constraints on how to do so).

Chips Act 2.0

The Chips Act 2.0 includes some rules of relevance to procurement concerning infrastructures, equipment or systems in sectors of high criticality and in other critical sectors for the purposes of the NIS 2 Directive (Annexes I and II). In those cases, public buyers may require economic operators to submit, together with their tender documents, a security of supply declaration relating to the sourcing of semiconductors incorporated into the infrastructures, equipment or systems covered by the contract. Importantly, this request is not self-standing; the Chips Act 2.0 foresees that ‘Where a security of supply declaration is required from economic operators, contracting authorities and contracting entities may specify, in the procurement documents, requirements relating to security of supply relating to the sourcing of semiconductors… To that end, contracting authorities and contracting entities may include technical specifications, selection criteria, award criteria or contract performance clauses.’ This is also followed by the same caveats that those requirements must (a) be linked to the subject matter of the contract; (b) not confer unrestricted freedom of choice on the contracting authority; (c) be expressly set out in the procurement documents or in the contract notice; (d) ancillary and not decisive in the award of the contract; and (e) designed in line with the Union’s international commitments. This is merely a reminder of the possibility of ‘regulation by contract’.

Going beyond this approach, the Act empowers the Commission, upon identifying a potential supply chain risk, to issue recommendations to contracting authorities and contracting entities regarding the supply of semiconductors by domestic undertakings for the procurement procedures mentioned above. Where the Commission is not satisfied that those risks are sufficiently being taken into account, the Commission can then adopt an implementing decision specifying for which specific infrastructures, equipment or systems contracting authorities and entities shall require a security of supply declaration from economic operators. While this goes some way to centralising decision-making and the exercise of regulatory power, once again, compliance with such requirements is subject to exceptions where (i) there is no reasonable alternative, (ii) there has been an unsuccessful attempt to procure assured services in the previous two years, or (iii) applying the requirements ‘would require a contracting authority or contracting entity to acquire goods, services or works having disproportionate costs or would result in technical incompatibility in their operation and maintenance’. In this case, the Chips Act 2.0 sets a 25% cost difference as the relevant disproportionality threshold.

The only exception to the possibility of deviating from Commission-issued requirements concerns the risk-prone sectors listed in Annex V or Annex VI. In these sectors, the Commission can issue guidance on how to carry out security of supply risk assessments and recommend possible mitigation measures. If the Commission considers that this does not lead to sufficient risk management, it can then adopt an implementing act on specific risk mitigation measures that sectors or subsectors shall take for specified semiconductor products, namely mitigation measures related to: (a) performance of a risk assessment; (b) procurement of semiconductors; (c) dual sourcing; (d) stockpiling; [or] (e) diversification of supply of semiconductors or related components. There is no exception to the obligation to apply this implementing act (though it is conceivable that such possibility is included in the act itself).

All in all, the Chips Act 2.0 also follows a ‘regulation by contract’ approach to the intended management of risks in semiconductors supply chains. Only in relation to risk-prone sectors can the Commission exercise binding regulatory discretion and, even then, its application is likely to require a fair amount of follow-on technical discretion from public buyers.

Industrial Accelerator Act (IAA)

Focusing solely on the specific requirements for procurement, for specified sectors (steel, concrete and mortar, aluminium, and electric vehicles), the IAA contains two relatively-clear rules. First, public buyers must exclude tenders submitted by economic operators owned or controlled by an entity established in third countries which have not concluded an international agreement with the Union guaranteeing such access. Second, they must apply the Union origin requirements and low-carbon requirements laid down in the IAA.

However, once again, these obligations are excepted where (i) there is no reasonable alternative, (ii) there has been an unsuccessful attempt to procure assured services in the previous two years, or (iii) applying the IAA requirements ‘would require a contracting authority or contracting entity to acquire goods, services or works having disproportionate costs or would result in technical incompatibility in their operation and maintenance’, with the IAA also setting a 25% cost difference as the relevant disproportionality threshold.

The IAA, then, also stays close to the ‘regulation by contract’ approach in relation to the exception from its main obligations, at least in relation to the possibility to deviate from them in relation to their likely cost implications.

A question the IAA, CADA and Chips Act 2.0 do not address is the extent to which contracting authorities can (or should) seek to retain most of their requirements where compliance is subject to an exception (ie are the requirements all-or-nothing). In the absence of guidance, it is also unclear whether, for procurements not covered by their requirements, public buyers should (or can) seek to take inspiration from the (skeletal) legal regimes they develop in creating their own contractualised requirements for levels of assurance falling short of the legal benchmark. In itself, it seems that the proliferation of EU digital laws can lead to the development of templates and standard terms that could overshoot the mark in some procurements. In that regard, the scant guidance accompanying the EU AI Act model clauses for non-high-risk AI procurement could be a harbinger of the vacuum public buyers would (continue to) face where relevant legal instruments are not (fully) applicable.

EU Public Procurement Act (PPA)

A final proposal worth considering concerns the current review of the procurement rules themselves, as they will provide the legal framework underpinning the exercise of ‘regulation by contract’. Although the PPA is a rather complex instrument, a focused analysis on the guiding principles of its treatment of the issue of third country access / European preference, as well as the management of risks to national (cyber)security also show a clear alignment with the ‘regulation by contract’ model.

In outline, the PPA includes an explicit regime of access to EU procurement markets that largely consolidates the complex and fractioned legal regime left by the Kolin and Qingdao line of case law. Generally, covered third-country operators benefit from equal treatment and non-discrimination (Arts 4(2) and 70), subject to an extremely problematic proposed power for the European Commission to restrict their access where there is insufficient reciprocity (Art 72). The PPA allows for the exercise of an ‘EU preference’, which can take the form of requirements for EU content, exclusion of ‘non-EU’ tenders and evaluation adjustments — though, for all intents and purposes, ‘EU content’ extends to that of countries with which the EU has international obligations (Art 73).

Non-covered third-country operators are left to the discretionary approach by contracting authorities, but cannot benefit from equal treatment (Art 4(2) a contrario + Kolin/Qingdao as saved by Recital (33)), subject to power of the European Commission to close access or impose ‘EU preference’ mechanisms ‘where this is in the interest of the Union’ (Art 75). However, this is subject to exceptions: (i) emergency procurement, (ii) unavailability, (iii) unsuccessful procedure in prior two years, (iv) disproportionate costs — with no stated benchmark (Art 76), as well as subject to special ‘European preference’ rules in sectoral legislation (art 77). In short, this is a model of ‘regulation by contract’, even where the Commission may seek to impose centralised European preference requirements.

Differently, the PPA contains an expanded scope for rules based on national security concerns (Art 66). These include: (a) a general duty to to ensure the protection of the security and public safety interests of the Union or one or more Member States for any public procurement procedure identified as presenting or including a risk for security or public safety; (b) an indication of sources of risks that covers both issues arising from the subject-matter of the contract and from economic operators (which opens the door to geopolitical considerations); (c) the mandatory exclusion of operators identified as high-risk suppliers pursuant to the proposed Cybersecurity Act 2; and (d) an empowerment to the Commission for the adoption of delegated acts for specific categories of goods, services or works where such elements address an identified specific security and public safety interest of the Union. In this case, it seems that the centrally-established requirements would be entirely mandatory for public buyers, without possibility to except them.

Still on cybersecurity matters (Art 68), the rest of the PPA is somewhat less centralised, including rules on the: (a) mandatory screening of compliance with the requirements of the Cyber Resilience Act; (b) possibility for additional requirements where digital elements are procured or used for national security or defence purposes; and (c) possibility to impose other cybersecurity requirements, without prejudice of the NIS 2 Directive. The last two measures are clearly just an empowerment and would still leave it to public buyers to set the relevant cybersecurity requirements as ‘regulation by contract’.

Overall, especially in relation to the third country access regime and cybersecurity issues, the PPA remains closely aligned to the ‘regulation by contract’ model (and, on a quick reading, the same applies to most of the core issues the PPA seeks to address in relation to strategic procurement more widely). This shows limited potential for a change of model where the PPA contains rules that reflect elements of digital regulation.

Final reflection

This overview of some of the recent proposals on EU digital law with an impact on procurement, as well as the proposed new procurement regime, shows that the model remains one of ‘regulation by contract’ where public buyers will be expected to manage an increasingly diverse and ever more complex array of technical, socio-technical, geopolitical, economic and other risks and considerations. In my view, this is not the best way forward. Overburdening procurement as not only a tool for the enforcement of horizontal/sectoral regulation, but a tool to formulate such ‘regulation by contract’ can only (continue to) generate difficulties and lead to growing ineffectiveness of a function that is key to the functioning of the public sector. There is a need to rethink the regulatory architecture underpinning the (formulation and) delivery of the EU’s policy goals. If procurement is the only (or the primary) regulatory infrastructure being engaged, the system will be ineffective and it is likely that it will collapse.

Initial assessment of proposed EU Public Procurement Act

I have submitted feedback to the public consultation on the proposed EU Public Procurement Act (currently open until 24 December). My submission (F33581451) provides an initial high-level assessment of the proposal for a Public Procurement Act. It focuses on selected issues.

The first part focuses on the choice of legal instrument and proposes a split approach to the legal form underpinning the process of review: a short regulation on digital ecosystem, a transfer of the third country access rules to the revision of the International Procurement Instrument, and a resubmission of a proposal for a new directive, subject to there not being enough support for an alternative approach not to revise the procurement rules and instead make significant investments in boosting procurement capacity.

The second part engages in some more detail with the content of the proposed Public Procurement Act, flagging selected issues that would require reconsideration in the legislative process leading to new EU procurement rules, regardless of the choice of legal instrument. The submission is by no means comprehensive and has focused on those issues that are either most problematic, or that would require significant development.

The full text of the submission is available here. Comments most welcome, as always.

AI's absence from the proposed EU Public Procurement Act -- suggested improvements

Jamillah Knowles & Digit / https://betterimagesofai.org / https://creativecommons.org/licenses/by/4.0/

If we live in the age of artificial intelligence, the proposed EU Public Procurement Act is anachronistic in its omission of AI. AI simply does not feature in the Public Procurement Act — or at best, only as an after-thought or ‘something to think about at a later time’. Given the continuous expectation that procurement will operate as a key governance tool for public sector AI use, that is not good enough.

As is now trite, there are two major interactions between AI and procurement: procurement is the gateway for AI acquisition by the public sector (‘AI procurement’); and AI can be (and is increasingly) used to manage procurement (‘AI for procurement’). Here, we can distinguish the direct use of AI for procurement and the use of AI to monitor procurement (eg to tackle corruption or collusion risks). The latter could be thought about as a meta application of AI for procurement.

Despite the growing understanding of these two/three layers of issues and the emergence of a quickly-expanding academic literature, as well as policy and guidance literature from across a wide variety of jurisdictions, the Public Procurement Act does not include meaningful consideration of AI.

Missing priority

To be fair, other than in relation to some meta applications of AI for procurement, AI also did not feature in the key documents influencing the Commission’s approach to the proposal. The report by the European Court of Auditors and the Council’s conclusions that kick-started the review solely referred to AI in passing (in relation to automated translation by ECA, and about exploitation of public procurement data by the the Council). The Parliament’s resolution on procurement similarly solely stressed that the transition to a digital-first approach would “reinforce the possibility of public scrutiny in the procurement process, especially considering the potential offered by disruptive technologies such as artificial intelligence” and called the Commission to update its tools for monitoring competition in public procurement. As far as I know, only the opinion of the European Committee of the Regions has gone beyond consideration of these meta uses of AI for procurement, and stressed that “it is necessary to provide a specific legal regime for the use of AI in the area of public procurement, thereby guaranteeing a framework of legal certainty” (para 38).

Similar considerations were captured in the public consultation underpinning the proposal. As the Commission’s impact assessment reflects, “several respondents see AI and advanced analytics as a way to improve procurement governance, through automated checks, risk scoring, fraud detection, and carbon-footprint verification. At the same time, they call for clear rules on the use of AI and algorithmic tools in award processes, to maintain transparency, fairness and legal certainty”.

The Public Procurement Act’s approach

This has not translated into any provision in the proposed Public Procurement Act, not even in relation to the (meta) use of AI for procurement. All there is, in the Legislative financial and digital statement (part 4.3), is a consideration that several elements of the envisaged new digital architecture (such as the Commission’s eProcurement platform, the electronic eligibility service, or the procurement data spaces) could interact with the EU AI Act. However, there is a repeated statement that “No AI-based decision-making is foreseen for the core legal obligations. If automated risk detection, ranking, recommendation or fraud analytics are introduced, an AI Act risk/compliance assessment will be carried out.” So, if anything, the proposal suggests that the digital architecture will not include ways to embed AI for the purposes of any of the key aspects of a procurement procedure (ie ‘core elements’). Is this a tenable position? Is this a ‘future-proof’ approach to regulating procurement in the EU, especially on the basis of a single rulebook? What would happen when Member States start (or continue) deploying AI in relation to ‘core obligations’? Would that be permitted? Under which conditions? How would divergence in the (applicable by default) administrative law of the Member States be negotiated?

Regulatory assumptions?

More broadly, it seems that, at best, the Commission operates on the assumption that the EU AI Act would provide the regulatory architecture for the use of AI in procurement (if there was any), but this is only explicit in relation to the meta use of AI for procurement and pending some future impact assessments (not least, because there is no detail whatsoever on what those components will look like in the many delegated and implementing acts required to develop them). Even then, the use of AI for procurement is not really considered in full, such as eg the Public Procurement Act’s omission of the more immediate potential obligation to disclose human-AI interaction under the transparency requirements of Art 50(1) EU AI Act even where no AI-based decision-making takes place—as soon as tenderers or public buyers eg interact with a chatbot.

The procurement of AI is, in itself, not even referred to in the proposal. Perhaps this is based on the Commission’s view that its (meagre) work on this issue to date suffices.

However, this ‘silent approach’ to reflecting the AI/procurement interactions in the Public Procurement Act ignores the fact that, other than transparency, the EU AI Act does not create obligations for the use of AI in procurement and, at best, provides a very weak level of regulatory assurance for AI procurement, and that the model clauses for AI procurement are nothing but an empty shell.

taking (more meaningful) action

All in all, the Public Procurement Act does not contain any provisions on AI procurement, does not fully consider the use of AI for procurement, and only hints at the future consideration of meta uses of AI for procurement monitoring purposes. This is at odds with the pressure for procurement to regulate AI acquisition by the public sector, as well as the pressure to deploy AI to manage procurement processes.

In my view, there are at least three improvements the co-legislators should introduce in the legislative process the Public Procurement Act is undergoing.

First, the Public Procurement Act should reform the EU AI Act and, in particular, Annex III to include the use of AI for public procurement (both directly, and in relation to its meta monitoring) as a ‘high-risk’ AI use case. This would bring procurement within the scope of the EU AI Act, but would still be largely ineffectual due to the exemptions in Article 6(3) EU AI Act. Therefore, the Public Procurement Act should also specify that Article 6(3) EU AI Act is inapplicable to the use of AI for procurement. This would go a long way in addressing the governance of AI use by public buyers.

As a complement—or a rather weak substitute, if modifying the EU AI Act in this way is not (politically) feasible—the Public Procurement Act could include an explicit provision on AI use for procurement to make public buyers directly responsible for the consequences of AI use for procurement, regardless of any responsibility or liability that can be sought from the providers of the used AI solutions—and this could be coupled by an obligation to develop, publish and constantly update a policy on the use of AI for procurement. This should include specific approaches to testing for bias and anticompetitive effects potentially arising from AI use (for discussion, see here).

Second, to mirror this, the use of AI by economic operators participating in procurement procedures would also need regulating. At a minimum, this should be reflected in the rules on exclusion (which need a significant overhaul more generally, in particular to make all exclusion grounds mandatory if the instrument is to remain as a Regulation) and an explicit exclusion ground should cover the misuse of AI in the participation in procurement procedures or in the execution of public contracts.

Finally, AI procurement needs to be given legislative coverage. As there is no chance that a full regime can be included in an Act, and much less that this would be sufficiently dynamic and adaptable, the Public Procurement Act should include a new article mandating the Commission and the Member States, jointly, to develop and constantly update a set of mandatory (not model) clauses for AI procurement. These would need to be a lot more detailed and implementable than the current clauses, and it seems to me that the future clauses need to be jurisdiction-specific (not merely translated into relevant languages) for them to adequately bridge the gap between public and private law rules (including liability) and jurisdictional variations. It would also be important to consider comparative approaches and to reflect on and learn from, eg recent developments in the US with the adoption by the General Services Administration (GSA) of a new clause for incorporation into government contracts of artificial intelligence systems (552.239-7001, Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems).

These interventions would still need refining and careful drafting and, most likely, would probably still be insufficient to fully assure AI procurement and the use of AI for procurement and its oversight, but they would provide a firm statutory grounding on which to continue the regulatory conversation.

EU Public Procurement Act: a “break the mould” approach to reform that won’t do

** This was first published as a Long-Read EU Law Live on 18 September 2026 (formatted pdf version). I am reposting it here in case of broader interest. **

The Commission’s Proposal for a Public Procurement Act: A ‘Break the Mould’ Approach to EU Procurement Reform That Won’t Do

The European Commission has adopted a proposal for new EU public procurement rules.[1] Bear with me. This could seem like the relatively technical ‘once in a decade’ review we have been witnessing since the adoption of the first set of procurement directives in the 1970s, with the most recent iteration leading to the current ‘fifth generation’ adopted in 2014.[2] However, the European Commission has adopted a proposal that seeks to break the mould in more than one way. The underpinning policy approach and the emboldened strategy followed by the Commission may interest even those who do not relish procurement issues.

First, the proposal is for a regulation rather than a set of directives and, in itself, this change marks a seismic event that could well have a ripple effect across the ‘EU administrative space’. Second, the proposal promises modernisation and simplification, ‘radical transparency’ and a ‘digital first’ approach. Third, the proposal seeks to eliminate price-driven procurement ‘once and for all’. Fourth, the proposal attempts to impose constraints on ‘what to buy’ and ‘whom to buy from’ in order to leverage policy goals at an EU-wide level. There are several other things the proposal seeks to achieve, and plenty of issues of detail in relation to the more procedural side of procurement regulation,[3] but let’s focus on those four goals as the primary or most radical changes sought by the Commission.

Before we get into that, a couple of contextual points are worth noting.

First, procurement reform seems to have attracted political and wider interest beyond what we are used to. This can in part be due to the geopolitical issues arising from the security threats facing the EU, in relation to non-standard warfare and cybersecurity issues in particular, as well as the trade instability arising from the erratic behaviour of the US administration and its knock-on effects on the current framework of trade regulation—which, in short, is showing a sharp turn towards economic nationalism that the EU has been quick to embrace. The floated creation of an ‘EU preference’ and the push for ‘digital sovereignty’ in procurement have probably driven most of the broader interest in the reform.

Weirdly, this heightened interest led to a leak of the Commission’s proposal earlier this summer and, even earlier, a somewhat unprecedented public call by 18 EEA States for the Commission to reconsider using a regulation once that approach was disclosed to them.[4] Despite clear indications that a regulation may be hard to work with for a significant number of Member States (or, rather, I would say all of them for the reasons explored later), and while the proposed regulation has changed between the leaked (at best half-baked) draft and its current official version, most of its essential pillars have remained intact and the Commission seems convinced that the future regulation can be adopted by the end of 2027. This may be an indication that the Commission may attempt to overcome Member State (or Parliament) opposition to some aspects of the proposed reform by bundling together things on which there may be a majority consensus with issues not everyone would be prepared to accept—in a sort of ‘take it or leave it’ approach to procurement reform that I am not sure is the best political strategy (but this is not where my expertise lies).

Second, by way of broader context, the Commission’s proposal shows some awareness that legocentrism and magical thinking would not significantly change procurement practice, regardless of what the statute book (in regulation or directive form) says. The proposal thus highlights the need for Member States to go (way) further in procurement professionalisation and capacity building. However, in that regard, the proposal both triggers déjà vu and disappointment.

Déjà vu because capacity constraints and a generalised limited ability to take advantage of the flexibility in the pre-existing legislative framework were already flagged as a clear weakness in the prior reviews of the EU procurement rules and no significant progress has been made, despite the adoption in 2017 of a recommendation on procurement professionalisation and in 2020 of a dedicated ProcurCompEU tool setting out a common professional skills reference for public procurement.[5]

Disappointment because the proposed regulation solely contains generic obligations for Member States to adopt a national professionalisation strategy and some support measures for public buyers. Given the ambition (or power grab) shown by the Commission in other areas of the proposal, it is disappointing that the regulation does not seek to create EU-wide centralised mechanisms for capacity building and support and instead limits itself to assigning the Commission an assistive role it already has anyway.

Perhaps this is due to the hard reality of the limits arising from the Member States’ power of administrative self-organisation. Or perhaps the issue is that the big-money demands of a true push for more strategic procurement lie here. Be it as it may, this is (again) the Achilles heel of the proposed reform, even more than the perhaps more salient policy issues the Commission is pursuing. Let’s get to those.

A Regulation to Rule Them All?

The single most radical and probably controversial aspect of the proposal is its legal form and expected prescriptiveness. As the Commission emphasised in the press release, “[t]he proposed Public Procurement Act makes the rules simpler and clearer by consolidating into one directly applicable Regulation the three existing public procurement directives and procurement provisions currently spread across sector-specific legislation. This will create a more coherent and predictable procurement framework, reducing complexity, administrative burden and inconsistencies in how the rules are applied with three procedures instead of five currently. It will reduce complexity and inconsistency resulting from separate legislative acts and divergent national transposition choices.”[6] If only.

While it is true that the proliferation of procurement-related requirements and rules across a multiplicity of EU instruments creates significant complexity and inconsistency,[7] the scattering of those requirements across legal instruments is only one part of the complexity and related legal uncertainty. In many cases, public buyers will struggle to interpret and apply the relevant requirements even if they are all contained in the Public Procurement Act—which they will not (at least in the mid- to long-run) as consolidating the current requirements does not eliminate the risk of proliferation of procurement-related rules across legislative files. And even if consolidation is undertaken on an ongoing basis, the complexity and uncertainty derived from legislative change will also not be diminished by the requirements being brought together into a single instrument—with the related obligation for public buyers to keep checking for updates. Even if the concentration point is clearer, the update, interpretive and application effort is bound to be no smaller.

Moreover, the adoption of a regulation will not and cannot prevent legal variation across Member States even in relation to activities covered by the regulation because of the peculiarities of public procurement regulation and practice. To begin with, the proposed regulation is not exhaustive on many issues, some due to a lack of detail and others due to the creation of discretion for public buyers. On those deliberately open issues, and in relation to unforeseen issues, the legal framework of the Member States will remain important in providing default rules or constraints on the exercise of administrative discretion. Anything short of creating a general EU administrative law regime to crowd out domestic frameworks will, by necessity, create this issue of national variation, and there seems to be little realistic prospect of that happening any time soon.

The scope for national variation is, of course, much larger in relation to activities not covered by the regulation. Given the strict approach to value thresholds to determine whether a procurement is or is not covered by the EU rules (both current and future), Member States will have to retain domestic rules for below-threshold and non-covered procurement. This does not create simplicity because it is unlikely that, other than in some sectors (if at all) or for centralised procurement bodies, either public buyers or economic operators will solely operate in relation to either the EU regime or the domestic regime. So (almost) everyone will still have to procure across regimes and, in that regard, the simplification of the single EU rulebook seems more theoretical than practical.

Finally, and most importantly, despite the claim that the proposal reduces the number of procedures, in reality, by providing practically unfettered discretion to carry out negotiations, the proposal creates such scope for procedural variation that each contracting authority could carry out a slightly different type of negotiated procedure every time it launched a procurement. The Commission seems not to have grasped the significant complexity this can generate and the participation costs it can impose on economic operators. It is a notable misunderstanding of the unavoidable trade-off between simplicity and flexibility in procurement regulation.

‘Radical Transparency’ and ‘Digital First’

As a key plank to modernise and strengthen procurement oversight, the Commission has proposed a significant revamp of procurement data collection and publication requirements. This is linked to the “creation of an integrated digital procurement marketplace consisting of interconnected and interoperable Member States’ eProcurement platforms”, which is not only meant to make the new data architecture possible, but also to reduce the administrative burden of carrying out and participating in procurement procedures. This is probably the part of the proposal the Commission gets most right, though it is hard to tell given the lack of detail on the data and digital platform architecture, which is mostly left to implementing acts.

What the proposal shows is that there are at least 15 components of the foreseen data and platform architecture. While the Commission will develop most of them, some crucial parts depend on tools and interfaces to be developed by the Member States—for example, to ensure interconnection of registers holding information to check eligibility for participation, such as criminal records, trade registers, tax and social security records, insolvency records, or beneficial ownership. Already at the stage of the proposed regulation, and regardless of the specific details to be settled through implementing acts at a later date, it is clear that the demands of the foreseen ‘digital first’ approach will require a significant push for the digitalisation of non-procurement specific registers at national level—with varying current levels of preparedness across jurisdictions.[8]

The ambition here is commendable, but the timelines foreseen in the proposed regulation seem way too optimistic—with Member States having to implement significant measures by 2028 and 2029, with a view to an effective use of the tools by 2030. Given how long it has taken the Commission to develop the public procurement data space and the ongoing limitations identified in the now-to-be-abandoned eForms, there are indications that the digital architecture may take (way) longer to develop than the 18 to 24 months foreseen in the proposal (and this is regardless of a potential delay of the official adoption unless work is kick-started sooner). This has also been the case in the UK with the rollout of the transparency and digital regime adopted in the Procurement Act 2023, and that did not even require supranational coordination or work on a true marketplace.

The issue of what a realistic timeline looks like is important for two reasons. First, because without the (fully functioning) digital architecture, the reforms in the proposal fall apart or get further delayed. Second, because the development of the tools and the creation of a ‘digital first’ framework can (and should) be decoupled from the legislative process and the unavoidable discussions of the substantive and procedural issues to be included in the future EU procurement rules. While some aspects of, e.g., the future digital platform supporting e-procurement will be dependent on the design of the future procedures, most issues on registry access and interoperability, digital wallet and transparency measures can be developed as a self-standing piece of work and investment into modernisation of EU procurement. This could have been done some time ago. Now is as good a time as any to get on with it. In my view, this should be decoupled from the proposal and a separate, shorter regulation could do the job of empowering the Commission and bringing the Member States together for that development.

No More ‘Price-Only’ Procurement?

Another major aspiration of the proposal is to bring an end to ‘price-only’ procurement and to force public buyers “to systematically consider not only price, but also quality, including environmental, social, innovation, security and resilience, and ‘European preference’ considerations”. In particular, the Commission has proposed a minimum 30% weighting for quality criteria (which would go up to 50% for labour-intensive contracts). However, this is subject to a ‘comply or explain’ mechanism whereby public buyers can opt-out of the minimum weightings where they are satisfied that the quality of the product, service or works procured can be ensured differently. This approach raises several issues.

To begin with, the experience with ‘comply or explain’ approaches to procurement policy delivery has been extremely poor to date, as evidenced by the limited use of SME-friendly measures such as the division of contracts into lots (which has been under a comply or explain regime since 2014). Additionally, the options over which explanations are expected are extremely unclear. A wide concept of quality that encompasses environmental, social, innovation, security and resilience, and ‘European preference’ considerations (as well as the more natural understanding of quality in terms of how good a product or service is in relation to its intended use) creates too wide a surface for considerations eg whether all of those dimensions are relevant to a contract and how to ensure them, including whether mechanisms other than award criteria are adequate. This is simply to say that it would be extremely hard to challenge a contracting authority that provided a (plausible) explanation for why 30% is not adequate or necessary. And unenforceable obligations also have a very checkered record in EU procurement.

Conversely, the inclusion of so many considerations as standard expectations for public buyers to embed in their procurement creates significant complexity and can create intractable trade-offs. It is hard to think of a situation where tenderers can offer conditions that are entirely aligned along all those dimensions (and price, which can still carry 70%) while, at the same time, not being dissuaded from putting together bids with expectations that can far exceed the market norm. While this can be explored through market consultations, this further push to move away from ‘price-only’ procurement epitomises the tension between simple and strategically relevant procurement, as well as underscoring issues of capability and capacity for public buyers and economic operators alike.

The bit I find the most counterintuitive is that the Commission considers that this approach to pushing for more strategic procurement addresses the concerns of the European Court of Auditors (ECA) in its damning assessment of the effectiveness of the EU procurement rules.[9] As a reminder, in relation to strategic procurement, ECA recommended that “The Commission should initiate a process in order to: (a) formulate and prioritise fewer, but clearer and more measurable objectives; (b) reflect whether EU strategic policy objectives should be achieved by means of: strategic requirements for public procurement procedures, or rather further regulation of the specifications for works, goods and services.” In my view, the Commission has gone in the opposite direction. First, the list of ‘strategic goals’ has been expanded with the inclusion of security and resilience, and ‘European preference’ to the classic triad of environmental, social and innovation considerations. Second, if anything, the Commission has both advanced an extension of strategic requirements for procurement and sector-specific regulation (even if some of it is to be consolidated in the regulation itself). Quite how this will enhance the clarity and measurability of strategic goals, or how this will not continue to have a negative effect on participation rates and, ultimately, competition for public contracts is something I struggle to fathom.

The Commission as the ‘Single EU Buyer’?

A final major aspiration for the proposed regulation is to empower the Commission to exercise the EU’s competence to regulate ‘what to buy’ and ‘whom to buy from’ to a further extent than is now the case. While there has been a proliferation of legal instruments imposing requirements, or allowing the Commission to impose requirements, on what to buy, the proposed regulation would significantly extend this—both in relation to environmental considerations, where there is already precedent, and in relation to security and resilience issues. In relation to security and resilience, this can be a pill hard to swallow for some Member States, as the Commission can use the delegated acts foreseen in the proposal to fast-track the imposition of constraints and requirements that would otherwise have gone through other procedures.

However, the area where the proposal mostly seeks to ensure the possibility for the Commission to act as the ‘single EU buyer’ concerns third country access to EU procurement opportunities. This is an area that has been left in need of explicit reform after the Court of Justice created in Kolin and Qingdao an overcomplicated framework for the regulation of third country access.[10] The main difficulty with the proposal is that, by leaving the issue of access and differential treatment to the discretion of public buyers, it does not address the current uncertainties. While the proposal would empower the Commission to take EU-wide decisions via delegated acts (eg to entirely ban Chinese access or to exclude US or UK tech providers on digital sovereignty considerations—but how likely is that?), there are significant uncertainties, including a possibility to deviate from a prima facie mandate to exclude operators from a specific jurisdiction. This uncertainty is compounded by the unclear interaction between this ‘European preference’ regime and the existing International Procurement Instrument (IPI, currently under review) and the procurement limb of the Foreign Subsidies Regulation (FSR).

While this is an area that requires regulatory intervention at EU level (in the form of a regulation), it both requires a very different approach to avoid the atomisation of discretion created by the Court, and should be decoupled from the other issues covered in the proposal to avoid the Commission using the (generally wanted) possibility to constrain access to EU markets on geopolitical grounds as a lever to force through other aspects of EU procurement reform.

Final Thoughts

My general view is that, at the point of proposal, the Public Procurement Act has significant weaknesses due to the form of instrument chosen by the Commission—and that these weaknesses could either significantly complicate the legislative process to the point of extensively delaying procurement reform or, worse, create a seismic event with very significant problematic implications for years to come.

My view is that there are issues that need separating and dealing with in a focused manner. There is a need for a short regulation to launch the work of developing the data and digital infrastructure, which could draw from what is in the proposal. There is also a need to reconsider the IPI and use it as the only instrument to control structural access to EU procurement markets by third-country operators, while retaining the FSR as is for now.

Everything else requires a much slower, careful, and technical revision, with a view to adopting a (single) revised procurement directive. Not least because, at the end of the day, none of the issues above is really a core procurement issue and there are many of those in need of some review and innovation, but landing on a workable alternative to the current rules will not be a quick or easy process and there is also some value in (re)considering the do-nothing approach, as significant developments in digitalisation and professionalisation would unlock significant gains even without (or perhaps especially without) a concurrent review of the rules.

Therefore, without further ado, both the Commission and the Member States should use the open conversation to push on procurement capacity much further than they have gone to date, and start creating effective mechanisms to bring up capability and expand capacity—which are needed today, not in 2030 or later, when a future regulation would start to bite.

[1] COM(2026) 590.

[2] Of course, things are a little more complicated, with the all-important underpinning remedies directives having fallen out of cycle and remaining unchanged since 2007, and a clear forking of the cycles of review of general procurement rules and those for defence and security given the accelerating focus on the latter triggered by geopolitical instability.

[3] For an analysis of issues requiring reconsideration, see Roberto Caranta, Coherence in the EU public procurement directives – A study into the internal coherence between the objectives, the principles and the provisions in the EU public procurement and concessions directives (2025) Publications Office of the European Union. DOI: 10.2873/3304248.

[4] The text has been collected by Pedro Telles in his blog. Note that his own views on the arguments put forward could not be more opposed to my own: P Telles, ‘Fisking the joint call by 17 member States for the Commission to retain Directives as procurement regulatory instrument’ (telles.eu, 14 May 2026).

[5] European Commission, ‘ProcurCompEU European Competency Framework for Public Procurement Professionals’ (29 July 2020).

[6] European Commission, ‘Commission proposes simpler and more strategic Public Procurement rules’ (IP/26/1817).

[7] Willem A Janssen, The coherence of public procurement legislation in the European Union – A study into the external coherence between the public procurement directives and other legislative instruments regulating public procurement (2025) Publications Office of the European Union. DOI: 10.2873/7419429.

[8] Timo Rantanen is carrying out an interesting exercise to assess readiness across EEA jurisdictions. It is worth following it on LinkedIn though his personal profile.

[9] European Court of Auditors, ‘Special report 28/2023: Public procurement in the EU – Less competition for contracts awarded for works, goods and services in the 10 years up to 2021’ (4 December 2023).

[10] See eg OECD-SIGMA, ‘Participation of third‑country bidders in the EU procurement market’ (15 April 2026) SIGMA Public Procurement Briefs No. 40. DOI: 10.1787/c2b218e1-en.

The UK's "Sovereign AI R&D Procurement Scheme" -- anything but compliant procurement?

The UK Government has launched a ‘£100 million fund competition [to] help promising British AI start-ups start in the UK and tackle some of society's biggest challenges.’ The main purpose is to provide funding for UK-based start-ups to develop solutions tested in UK public services—initially across four priority areas inclusive of an ‘NHS productivity challenge’ seeking to boost AI development for the healthcare system.

In that stream, the funded start-ups will have access to ‘working with the Department of Health and Social Care to develop AI systems that can automate workflows, coordinate care and support decision-making across health services, helping deliver the ambitions of the NHS 10 Year Health Plan while improving productivity and staff experience’. Crucially, ‘successful firms will work with government departments to develop demonstrator-stage technologies with the potential to scale across the public sector and beyond’, while ‘keep[ing] the intellectual property they create, allowing them to take those innovations beyond the pilot stage and develop commercial products for customers in the UK and around the world’.

While this very much looks like a subsidy mechanism, it has been launched as a ‘procurement’ scheme. In this post, I take a closer look at a procurement scheme that seems to be about ‘anything but procurement’ and that, in my view, raises significant compliance risks.

The scheme as ‘exempted procurement’

As mentioned above, one of the interesting aspects of this initiative is that SOV/AI explicitly stresses that ‘[t]he scheme has been deliberately designed to help innovative start-ups to participate in public procurement, removing the barriers typically faced.’ It is unclear whether this statement refers to access to the scheme itself, or to access to procurement initiatives post-scheme. Either way, it is worth taking a closer look at the procurement implications of the scheme’s design.

The first observation is that the scheme is structured around the R&D services exemption in the Procurement Act 2023 (which is equivalent to the R&D exemption in eg Directive 2014/24/EU, art 14). The scheme’s competition guidance is explicit on this:

It is worth stressing that contracts for R&D services are included in the list of ‘subject-matter exempted contracts’ in Schedule 2 of the Procurement Act 2023. As the cited Guidance on Exempted Contracts makes clear, ‘[a]n exempted contract is a type of contract … to which the rules on covered procurement in the Procurement Act 2023 … do not apply.’ This sets aside most requirements in the Procurement Act 2023 (bar, mostly, some transparency requirements) and, in plain terms, makes the award of these contracts ‘not really procurement’. This creates significant procedural flexibility and SOV/AI has used it to reduce the qualitative selection requirements (or conditions for participation, in the Procurement Act’s terminology), in particular in relation to not setting minimum annual turnover, trading history, net assets, or cash reserves requirements—with other measures such as ‘prompt payment arrangements and simple contracting’ always being a possibility for covered procurement.

Precisely because the exemption places the award of R&D services (largely) outside the procurement rules, this requires narrow interpretation. In my view, the most difficult to meet constraint is that the R&D services must ‘be for, or result in, benefit to the public’. The Guidance on Exempted Contracts further elaborates on this requirement by stressing that ‘[t]he R&D services exemption gives contracting authorities the freedom to design R&D programs that could seek to develop products or technology for the benefit of the market as a whole, and for which the authority itself has no requirements’ (para 41, emphasis added). I have doubts that a scheme that ‘has been designed to help companies establish a direct supplier-customer relationship with public-sector organisations’, and where start-ups retain the relevant IP rights but the government obtains a seemingly unlimited licence, meets this constraint.

First, because IP retention by the developing start-up and government licencing raises a significant question on whether the R&D is ‘for the benefit of the market as a whole’, rather than the start-up and the government narrowly. Second, because it seems clear that the solutions are to be co-developed with DHSC (or other relevant departments in the parallel streams) and, consequently, it is hard to see how ‘the authority itself has no requirements’ for solutions meant to address specific challenges and meant to be operational in the specific context foreseen by the authority. This is particularly questionable in view of the FAQs in the competition guidance, which explicitly state the following:

Will the scheme give me direct access to the end users? The relevant challenge-owning department is expected to support each funded project, including by contributing relevant operational context and engaging with the supplier during delivery. The precise form and level of engagement will depend on the challenge.

In my view, this raises significant compliance risks in relation to the scheme in itself, as its terms seem to breach the constraints for the exemption on which it relies. Moreover, given its focus on ‘post-scheme’ commercialisation, there are additional compliance risks to consider.

Compliance risks for future acquisition/procurement

It seems clear that the scheme intends to create a ‘pathway to market’ for developers of AI solutions for the NHS (and other challenge-owning departments), at least where SOV/AI indicates that ‘[b]y becoming an early customer, government can help companies validate their technology in real-world settings and create a pathway to wider commercialisation.’ More specifically, the regulation of IP rights foresees that government is to be ‘granted a licence to use the outputs, data, and results for public sector purposes (this will be set out in the contract)’. This suggests a direct governmental acquisition of the solution and, on the face of it, this is not subject to any limitations in terms of volume of adoption or use under the licence.

I have several concerns on this specific issue.

First, because the Guidance on Exempted Contracts is clear that ‘[t]he scope of R&D services exemption is limited so it falls short of the commercial industrialisation of the goods and/or services’ (para 40) and, relatedly, that ‘Contracting authorities are also able to procure R&D under a competitive flexible procedure if, for example, the intention is to build an R&D phase into a procurement in order to be able to also purchase the resulting product’ (para 43, emphasis added). This creates a clear stop point preventing the government from becoming an early customer without running a separate procurement process—which could, of course, result in an award to another tech provider on the basis of a different solution.

This was been made (more) clear in recent comparable R&D competitions and, in particular, in the ProQure competition for Quantum Computing, which clearly indicated that:

• ‘This competition is a standalone Contracts for Innovation competition. It does not involve the purchase of any solution, and taking part in this phase does not give any organisation automatic eligibility in any future procurement exercise’; and that

• ‘Any adoption and implementation of a solution from this competition would be subject to a separate, possibly competitive, procurement exercise’ [the use of ‘possibly’ causing some discomfort here, though].

The Sovereign AI scheme is (at best) definitely less clear on this and, to the contrary, seems to suggest that the challenge-owning department (and potentially the entirety of government) will be adopting the developed solutions (for public sector purposes). In my view, any such outright acquisition or adoption of the solution without a separate procurement exercise would breach the limits of the R&D services exemption.

Beyond that, and second, I have doubts that a compliant workaround could be found to run a separate but not competitive procurement exercise. This would need to be justified on one of the grounds for direct award in Schedule 5 of the Procurement Act 2023 and, in particular, likely rest on IP rights exclusivity (Sch 5 para 5). In my view, this would also create compliance risks because the IP exclusivity would have arisen from the earlier questionable award of the R&D services contract in terms that create a benefit for the start-up (the IP rights) rather than the market as a whole and, ultimately, undermines the limits of the R&D exemption. Moreover, beyond such a logic of pre-empting the avoidance of competitive procurement, it is important to highlight that a direct award based on IP exclusivity can only be made after the contracting authority has excluded the existence of any reasonably alternative solutions. This seems an extremely unlikely scenario, given the many ways in which AI can be implemented to address any given technical challenge, especially once the organisational and functional embeddings of challenges such as ‘NHS productivity’ involve.

Final thoughts

It seems that the ‘Sovereign AI R&D Procurement Scheme’ seeks to bypass or minimise procurement constraints in the co-development and acquisition of AI solutions and, in my opinion, that it does so in a way that raises present and future compliance risks or, to put it more clearly, in a way that exceeds the limits of the R&D services exemption. It is hard to understand why this is the case and why the scheme is not structured and presented as a subsidy scheme pure and simple (which would, however, raise the issue of the future ‘non-competitive’ procurement of the solutions). It is also hard to understand why the R&D exemption has been the one used by the UK government, given that at least some of the AI challenges that deserve funding could arguably have better coverage under other potential exemptions in relation to national security or public interest.

Some initial thoughts on the leaked Draft EU Public Procurement Act -- irredeemably half-baked?

The much-awaited proposal for revised EU public procurement rules (the ‘EU Public Procurement Act’) was leaked earlier this summer. Given the generalised lack of mainstream interest in procurement issues other than in the context of maladministration scandals, the fact of the leak itself is somewhat interesting and probably reflects the highly (geo)politicised context in which this reform will take place.

Setting that aside, and ahead of its expected formal adoption on 9 September 2026 (probably with some improvements or at least some more proof-reading), I offer below some thoughts on the perils of switching from a set of Directives to a single Regulation, as well as some related concerns on the under-developed contents of the leaked draft in relation to some key issues.

I come a bit late to this party, as many other commentators have already offered their initial reaction earlier this summer (see eg Pedro Telles, Marko Turudic and Abby Semple for some thought-provoking views). I was a bit surprised by the mostly positive views on the switch to a Regulation, despite the acknowledgement that it will bring complications. I will not try to rebut earlier views, though there is clearly scope for some focused back and forth. I am also saving some thoughts on (very many) points of detail, as they may or not make sense depending on the final content of the officially adopted proposal. The below are thus just some reflections on the big ticket issues raised by the leaked draft. It is also my first proper blog post in over a year, so bear with me if it is clunkier than it should be.

Choice of instrument and implications

The switch from a set of Directives to a Regulation is the most radical and problematic policy choice in the leaked draft. In my view, most of the reasons offered in the Explanatory Memorandum and in the recitals are insufficient to justify the adoption of a Regulation and the choice of instrument has a lot more to do with empowering the European Commission in relation to two primary areas concerning geopolitical and policy issues, than with the objective of ensuring a single market for public contracts.

The choice of a Regulation aligns well with the development of a single EU-wide regime for third country access to EU procurement opportunities, and is also necessary for the European Commission to impose ‘what to buy’ constraints on Member States’ procurement decision-making (at all levels of governance), but is not necessary or helpful in relation to most other content. To me, this suggests that there is a need for a coordinated adoption of a Regulation and a revised Directive. Only the subject matter that absolutely requires a Regulation should go into it, and the rest should remain in Directive form — as this is the only legal architecture that can minimise the perils and likely problems of attempting to regulate procurement with a directly applicable legal instrument (which necessarily crowds out national regulatory space).

This is important because there are many issues where a single EU-wide solution will not be easy to define or be made workable and where there is sufficient variance of Member State practice and preferences that the practical problems will outweigh the expected benefits of a single rule. It is also important because there is no EU-wide set of default rules in many aspects — and fundamentally on administrative procedure and administrative jurisdictional issues. This means that all issues not explicitly and exhaustively covered in the Regulation will still generate (potentially) 30+ varying approaches and solutions. To put it simply, it is illusory to think that a Regulation can achieve full (procedural) harmonisation of procurement across the EU, unless its content is to be extended to something resembling the very detailed codes of public contracts in place in many EU countries (and which would, then, probably not work well for jurisdictions with a different approach to procurement regulation).

It is also important because of the practical impossibility to ensure that the Regulation does not encroach on Member States administrative self-regulation. For example, the leaked draft would seem to prevent centralised approaches to important issues (eg exclusion) and also extend to an extreme the possibility for public buyers to directly rely on the Regulation even where it breaches domestic public law requirements (not only in the context of cross-border or collaborative procurement, but also there).

This is also important because of the break-up of the legislative frameworks for all Member States. The adoption of a Regulation would force all Member States to have at least two sets of procurement rules — the directly applicable Regulation and a domestic set of rules for below threshold and not covered procurement. It could be said that this is not different from a Directive. But in law it is because, at least as a point of principle, a Directive allows Member States to have a single set of rules for all procurement by making their domestic transposition applicable beyond the minimum required. This is no longer a possibility in the case of an EU Regulation. It is also important to recognise that Member States may (continue) to take very different approaches to non-covered procurement and this will continue to create issues from the perspective of the integrity of the EU internal market for public contracts (if we are worried about it), as covered procurement seems to only represent around 20% of total procurement expenditure across the EU. Given a goal to revise GPA thresholds upwards, this suggests that the percentage of covered procurement could even reduce in the near future.

Empowerment of the Commission

A second area of concern is the empowerment of the Commission to take measures that would be binding on all public buyers across the EU. This concerns key areas of digitalisation and policy delivery through procurement. While in some areas (mainly on geopolitical issues) this is a continuation of recent shifts in policy and case law, in other areas (green, social and innovation), this is a major new issue. The move towards empowering the Commission seems to presume that it can effectively be mandated for procurement to achieve specific policy goals through the imposition of hard constraints. Setting that presumption aside, in order to allay (anticipated) concerns on the Commission’s power grab, most of the relevant clauses are couched in limitations and exceptions and, ultimately, the empowerment of the Commission will remain weak where the EU does not have exclusive competence. The issues that can arise from this should be carefully considered, as well as the likely limited effectiveness of EU-wide applicable requirements with locally-managed exceptions.

On digital — on which there are some good general ideas as well as a renewed attempt at completing projects that should have been long completed under the current rules, such as the full transition to digital procurement — the empowerment of the Commission to develop (or request standardisation bodies to develop) key aspects of the digital infrastructure meant to support the revised EU system poses a different issue. Namely, that the leaked draft offers no meaningful detail to understand what the EU system of transparency and procurement data may look like. While the headlines make sense (interoperability of platforms, data interconnection, a tiered approach to data access and transparency, digital credentials, etc), there are so many issues requiring definition that the Regulation could end up enabling very different types of system and imposing very different types of requirements to Member States and public buyers. As presented, it largely is a blank cheque for the Commission to develop rather complex systems. It seems to me that a lot more detail and basic constraints should be put into relevant annexes of any future Regulation on procurement.

Goal proliferation

Despite presenting the draft Regulation as a response to the European Court of Auditors’ recent special report on procurement — which clearly took the view that current EU rules contain an excessive number of under-specified and non-prioritised goals, and that revised rules should focus on less and more measurable, clear goals — the draft Regulation contains a proliferation of goals. Not only due to the inclusion of geopolitical and national security considerations in a scale unprecedented in EU procurement rules, but also in the way it not only perpetuates the broad (scattershot) approach to green, social and innovation procurement but exacerbates it with the inclusion of an (unenforceable?) provision on procurement’s strategic goals (Art 5). Quite how public buyers are meant to make structured decisions with such a multiplicity of goals and constraints is anybody’s guess and, in my view, the draft worsens rather than improve the situation on this front. This is of further relevance given the imposition of (exemptable) minimum requirements for the consideration of quality issues related to those goals as award criteria.

Simplification?

The leaked Regulation also contains some aspects of false (or overclaimed) simplification. The clearest example in my view is the regulation of procedures. Seemingly taking a leaf off the book of the recent UK procurement reform, the leaked draft considers there are too many procurement procedures and seeks to reduce their number to four. However, on a closer look, the number remains higher and the practical differences pull in directions that are not always simpler. Take the open-negotiated procedure. Given the obligation to reflect in procurement documents an intention to negotiate, in reality, the relevant provision regulates two procedures in one: an open procedure and a negotiated procedure. Counter-intuitively, the negotiated procedure is (at best) a basket of procedures, as each public buyer can define the negotiations (content, rounds, BAFO, etc) in their own way. Similarly, the procedure representing a direct award in reality contains three (sub)procedures to request negotiations, a tender or direct delivery. Given under-specification, it is unclear whether some of these procedures can contain an element of competition — but, otherwise, requesting a tender seems to make no sense. I have not played out all scenarios in relation to the dynamic simplified procedure, but I have a sense that at least in some conditions, it can allow for a close recreation of the (seemingly eliminated) restricted procedure. This does not straightforwardly seem like a definitive simplification approach.

Relatedly, there are may issues in relation to the procedures that the Regulation contains no rules on (eg on the possibility to ask for clarifications on tenders and its limits, or the boundary between clarification and negotiation). This highlights one of the main risks in pursuing a Regulation. What happens with issues not covered in the Regulation? What is the default/suppletory rule or position? Any chances there is a single rule across EEA jurisdictions?

Fighting risk-aversion and gold plating

Another theme that runs through some of the provisions in the draft Regulation is to seek to prevent risk aversion and gold plating. For example, in relation to qualitative selection and in particular in relation to the turnover volume that can be required of economic operators in order to be eligible for a contract opportunity. The proposal would reduce this from the current 200% to 50% of the value of the contract. However, in both cases, the upper threshold can be exceed in view of specific circumstances of the contract. This is the sort of change that can be both ineffectual where public buyers are unwilling to revise their risk-taking and lead to poor screening of public contracts where (for whatever reasons) public buyers take the opposite view. The very many examples of maladministration of procurement during the pandemic showed us the importance of robust screening and due diligence of economic operators. While it is clear that some flexibility may be required in order to facilitate SME participation (with the obsession with start-ups also requiring some separate analysis), a starting point of requiring public buyers to routinely be ready to contract with providers that would by definition be delivering their biggest contract ever and would need to expand, seems a stretch. There is, in general, a risk of the Regulation seeking to push authorities too far from established approaches and practices. Whether this can lead to a significant change in procurement practice is highly questionable and it is unclear that there will be a monitoring capacity able to take action on instances of non-compliance with that sort of requirement.

Mandatory professionalisation with no resource

A final point worth mentioning is that the draft Regulation would seem to impose hard obligations on Member States to invest in professionalisation and in structured procurement expertise governance. However, meeting those obligations is both expensive and difficult. Realistically, and based on the experience with this sort of requirement (and independent oversight issues) in earlier iterations of review of the EU procurement rules, it seems unlikely that the final text will impose requirements commensurate with the increase in complexity and discretion implicit in the model underpinning the draft Regulation. This could take us to a scenario where the chasm between the legal architecture and the delivery infrastructure are such that procurement practice and outcomes do not meaningfully improve or are even worsened. It is thus very important that the legislative process remains cognisant of the trade off between flexibility, complexity and procurement capability requirements.

Final thought

There are aspects of the leaked Regulation that represent a clear consensus across Member States — mostly, around the need to revise the geopolitical aspects of procurement. This could suggest the Commission can get the Regulation through the legislative process quickly. However, there are other aspects that can be very problematic and that could suffice for the proposal to be embroiled in a long legislative process. In my view, this largely aligns with the divisibility of content between aspects relating to trade and (possibly) digitalisation, and the more technical review of procedural rules and requirements (which I would dare say are the core of procurement legislation and governance). The more I think about it, the more I sense the way forward may require a split between a short Regulation based on the current draft in relation to geopolitics and digital, and a slower process of consolidation and review of the three current Directives into one.

AI Procurement and AI in Procurement

In the new working paper “AI Procurement and AI in Procurement”, with a focus on the promotion of responsible and trustworthy AI adoption across the public sector, I explore (or rather, revisit) the emerging trends in regulating AI procurement and in the use of AI to manage procurement.

The paper is intended for another ‘research agenda’, this time ‘A Research Agenda for Public Procurement Law, Policy and Regulation’ edited by Prof Geo Quinot (Stellenbosch). Like my other recent (and closely connected) paper, this contribution also has an exploratory approach to identifying areas for future research in relation to AI procurement and the rollout of AI in procurement.

Full abstract below. Comments most welcome!

Procurement is the gateway for public sector AI adoption, as well as an area of active experimentation with AI. Both ‘AI procurement’ and ‘AI in procurement’ are giving rise to emerging regulatory and governance strategies and practices that shed light on the challenges and constraints of current approaches to ‘digital transformation’. This contribution explores emerging trends and identifies areas for future research, with a specific focus on the promotion of responsible and trustworthy AI adoption. In relation to AI procurement, it discusses ‘contract-based’ and ‘standard-based’ approaches to its governance, as well as the emerging pivot towards prescriptive AI procurement legislation. In relation to AI in procurement, it explores the emergence of safe harbours and persistent challenges for AI use by public buyers, and maps some of the challenges arising from bidders’ (improper) AI use. It concludes by bringing together themes from the two related issues of procuring AI and using AI in procurement.

Competition implications of artificial intelligence in public procurement

Image: Lone Thomasky & Bits&Bäume / https://lnkd.in/ePHsgTDV / https://lnkd.in/eCuDtiJR.

In the new working paper “Competition implications of artificial intelligence in public procurement”, I explore how competition can be affected by emerging trends in the procurement of AI and in the deployment of AI to manage public procurement processes.

The paper is intended for a Research Agenda for Competition Law and has an exploratory approach to identifying areas for future research in relation to the competition implications of the current rollout of AI in procurement (see this OECD report for a recent snapshot) and in the quickly accelerating procurement of AI for use across the public sector (see this other OECD report for an overview).

Full abstract below. Comments most welcome!

Artificial intelligence (AI) has two primary interactions with public procurement. First, procurement is the gateway for the still largely unregulated process of public sector AI adoption. Second, AI is being deployed to ‘streamline’ procurement itself. This contribution explores the competition implications of these interactions between AI and procurement, as well as the knock-on effects that AI-supported procurement can have on upstream markets. In particular, it considers competition implications of new procurement approaches concerning: the setting of technical and governance requirements; reliance on third party capabilities; unregulated AI audit and assurance mechanisms; unregulated practices such as the free embedding of AI solutions into contracted cloud or software solutions (or ‘AI creep’); as well as the risks of new forms of data bias, organisational conflicts of interest and centralisation forces arising from the deployment of AI solutions in procurement management (including ‘AI agents’). The contribution highlights emerging issues and trends, and identifies areas for future research.

Struggling for meaning and motivation

Friends and readers of the blog will have noticed that, three months later, the summer hiatus is yet to be brought to an end. This is not a procurement-related post and the hiatus on content on EU/UK economic and digital law will go on for longer. As of now, I am not sure how much longer, but probably well into 2026, or even beyond. In this rather personal post, I just offload/share the reasons for this extended, and for now indefinite, pause. I am doing this because I think we do not speak about the sort of challenges I am facing often enough. Maybe reading this will be helpful to someone else. Maybe not.

This was the hardest summer of my life. My mother was admitted to hospital at the end of July with an acute, systemic health crisis derived from her alcoholism. Things looked very bad, then slightly better, then worse. She was referred across four hospitals and received levels of treatment that were to me mindboggling, and scores of nurses and doctors deserve recognition and praise for all they did for her. Unfortunately, she reached a point were nothing else could be done. After a short stay in a palliative care facility, she passed away just over six weeks ago. Just like that, she was gone. The long, harrowing process that led to her departure did not make it feel less sudden or devastating. The way her wake and funeral evidenced how broken my extended family is, and how uprooted I am from the place and people I once called home, did not provide any solace either.

I did my best to be by her side and support her through it, despite the very mixed emotions this stirred up in me. I’ll spare the details, but that complex mix of emotions kept evolving and has now further combined with grief, which is in itself a much more amorphous, sneaky and destabilising emotion than I ever imagined. When someone asks me how I am doing, I am genuinely at a loss for what to say. ‘I am ok’ feels both right and wrong.

Living in a different country and having a young family made my unplanned, frequent trips back to Spain quite hard, both logistically and emotionally, for all of us. I thought I usually have to juggle a few things (work/life balance …), but this required an altogether different level of juggling commitments and responsibilities, for months. I constantly felt bad because I was never in the right place, as I was constantly letting someone down, and because wherever I was and whatever I was doing, someone else was picking up a lot of care work — whether my mum’s or my children’s. I also felt bad about all the cancelled plans and about my difficulties being present for those that weren’t.

I was lucky to have the sort of job that provides flexibility and, by pure chance, to have almost no teaching this fall term—which made it easier to physically be intermittently away from work. I did my best to keep the work commitments I thought I could complete (and I hope I managed to do so professionally), rejected many interesting opportunities and new projects, and delayed or cancelled more research collaborations than I ever thought I could. I received nothing but compassion, understanding and support from colleagues and contacts I was clearly letting down or disappointing. Although I knew these reactions to be genuine and that pairing work back to the bare minimum was the only realistic option, I felt bad about this, and also worried about the longer term impact some of the foregone opportunities may have on my professional development and career.

All of this has left me exhausted and struggling for meaning and motivation, mostly at work. Maybe I just need some time to process, mourn, grieve and get used to the new normal of such an absence in my life. Maybe this is just the ‘identity crisis’ side of the grief process. But I have the hunch that this may not be the whole story. My personal circumstances have piled on top of very bad trends and circumstances in academia, especially in the UK, where things have been looking grim for way too long now. Somehow I find myself wondering what is the purpose or many of the things I do or aspire to do, what can I achieve with my professional interactions, and whether that is worth the effort. I keep asking myself ‘why’ and ‘so what’, and drawing a blank. Until I find good answers to that, I will probably just keep doing what needs to be done and no more, as self-motivation was a driver of most of my work. And maybe this is ok. Or at least ok for now.

Summer hiatus -- back in September 2025

Wishing you all a good and restorative summer break. I hope to see you back here in September.

UN WG on business and human rights' report on AI procurement -- key findings and recommendations

Last week, the UN working group on business and human rights officially presented its thematic report on the procurement and deployment of artificial intelligence systems by States and businesses (A/HRC/59/53, 14 May 2025 — note there is also an executive summary infographic).

The report focuses on actions to be taken to facilitate alignment of AI procurement and deployment with the UN’s Guiding Principles on Business and Human Rights and addresses organisations procuring rather than developing AI. The report approaches procurement in broad terms by encompassing both public and private procurement, and by taking into account the position and responsibilities of States, business and stakeholders. The report contains a series of findings and recommendations.

findings on the Regulatory landscape

One of the report’s key findings is that ‘States are increasingly shifting from voluntary guidelines to binding legislation on AI and human rights, such as through the European Union AI Act and Council of Europe AI Convention. However, there are significant gaps in terms of rights-respecting procurement and deployment of AI systems, including a lack of a human rights-based approach, no consensus on key definitions, insufficient integration of the perspective of the Global South, the provision of broad exceptions and limited involvement of civil society. Further, enforcement gaps and loopholes are weakening human rights protections in existing legislation on AI and human rights.’ This requires a closer look.

The report highlights that ‘Globally, there are over 1,000 AI-related standards and over 50 AI governance initiatives based on ethics, responsibility or safety principles’. Although unsurprising, I find this interesting and speaks to fragmentation and duplication of regulatory efforts that create a complex landscape. Given the repeated recognition that AI challenges transcend borders and the calls for international collaboration (eg here and here), there is clearly a gap still to be addressed.

In that regard, the report stresses that ‘The lack of consensus on key concepts such as “AI” and “ethics” is leading to inconsistencies in the regulation of AI systems and is particularly problematic given the transnational nature of AI’, and highlights UNESCO’s Recommendation on the Ethics of Artificial Intelligence as the sort of document that could be used as a blueprint to promote policy coherence across jurisdictions.

Although the report identifies a recent shift from voluntary guidelines to legally binding rules for AI systems, such as the EU AI Act or the Council of Europe Framework Convention on AI, it also highlights that ‘there is still uncertainty regarding how to address certain loopholes in the EU AI Act’ and that the Framework Convention creates similar challenges in relation to the significant exemptions it contains, and the way it gives signatory States discretion to set its scope of application. Although the report does not take an explicit position on this, I think it takes a small step to conclude that legislative action needs to be far more decisive if the challenge of upholding human rights and fundamental values in AI deployment is to be met.

Another key finding of the report is that ‘States are largely procuring and deploying AI systems without adequate safeguards, such as conducting human rights impact assessments as part of human rights due diligence (HRDD), leading to human rights impacts across the public sector, including in relation to healthcare, social protection, financial services, taxation, and others.’ This results from the limited emerging approaches to AI procurement.

Indeed, focusing on the regulation of AI public procurement, the report highlights a series of approaches to developing legally binding general requirements for AI procurement and deployment, such as in Korea, Chile, California, Lithuania or Rwanda, as well as efforts in other jurisdictions to tackle specific aspects of AI deployment. However, the report also stresses that those regimes tend to have exemptions in relation to the most controversial and potentially harmful areas for AI deployment (such as defence and intelligence), and that the practical implementation of those regimes still hinges on the limited development of commonly understood standards and guardrails and, crucially, on public sector digital skills.

On the latter, the report clearly puts it that ‘Currently, there is an imbalance in knowledge and expertise between States and the private sector around what AI is, how it works and what outcomes it produces. There is also little space and time for procurers to engage critically with the claims made by AI vendors or suppliers, including as they relate to potential and actual human rights impacts.’ Again, this is unsurprising, but this renewed call for investment in capacity-building should make it abundantly clear that with insufficient state capacity there can be no effective regulation of AI procurement or deployment across the public sector (because, ultimately, as we have recently argued procurement is the infrastructure on which this regulatory approach rests).

The report then covers in detail business responsibility in relation to AI procurement and deployment and covers issues of relevance even in contexts of light-touch self-regulation, such as due diligence, contextual impact assessments, or stakeholder involvement. Similarly, the report finds that ‘Businesses are largerly procuring and deploying AI systems without conducting HRDD, risking adverse human rights impacts such as biased decision making, exploitative worker surveillance, or manipulation of consumer behavior.’

The final part of the report covers access to remedies and, in another of its key findings, stresses that ‘Courts are increasingly recognizing the human rights-related concerns of AI procurement and deployment, highlighting the urgent need for transparency and public disclosure for public and private sector procurement and deployment of AI systems, and the fact that existing remedy mechanisms lack resources and enforcement power, leaving communities without effective recourse for AI-related human rights abuses. Stronger legal frameworks, public reporting obligations, and independent oversight bodies are needed to ensure transparency, accountability and redress.’

The report thus makes the primary point that much increased transparency on AI deployment is required, so that existing remedies can be effectively used by those affected and concerned. It also highlights how existing remedies may be insufficient and, in particular, new ‘mechanisms will also need to be set up, creating integrated approaches that recognize the intersectional nature of AI-related harms and their disproportionate impact on at-risk groups. Effective redress for AI-related harms requires both strong institutional frameworks and deep understanding of how technology intersects with existing patterns of human rights violation and abuses, both of which are currently missing’ (this largely chimes with my view that we need a dedicated authority to oversee public sector AI use, and that preventative approaches need to be explored given the risks of mass harms arising from AI deployment).

recommendations

In order to address the unsatisfactory state of affairs document in the report, the working group formulates a log list of recommendations to States, businesses and other actors. In the executive summary, the following are highlighted as key recommendations to States.

1. Establish robust legal, regulatory and policy frameworks on AI: Develop and implement AI regulations following a human rights-based approach that are aligned with international human rights law, ensuring transparency and accountability in AI procurement and deployment and legal certainty for all.

2. Mandate HRDD: Require public disclosure, HRDD, and safeguards for AI systems procured and deployed by private and public sector actors, including AI systems used in high-risk sectors like law enforcement, migration management, and social protection.

3. Prohibit Harmful AI Systems: Ban AI technologies incompatible with human rights, like mass surveillance, remote real-time facial recognition, social scoring and predictive policing.

4. Ensure Access to Remedy: Strengthen judicial and non-judicial mechanisms to address AI-related human rights abuses, shifting the burden of proof to businesses and authorities, and ensuring adequate resources.

5. Promote AI Governance Collaboration: Build global cooperation to establish common AI standards, fostering interoperability and ensuring the representation of Global South perspectives.

However, it is worth bringing up other recommendations included in the much longer list in the report, as some of them are directly relevant to the specific task of AI procurement. In that regard, the report also recommends that, with regard to AI procurement and deployment, States:

• Provide specific guidance to public sector procurement actors on a human-rights based approach to the procurement of AI systems; including specific limitations, guidance and safeguards for AI systems procured and deployed in high-risk sectors and areas such as justice, law enforcement, migration, border control, social protection and financial services, and in conflict-affected areas;

• Provide capacity-building for all stakeholders to understand the technical and human rights dimensions of AI, and ensure accessible, explainable and understandable information about the procurement and deployment of AI systems, including by mandating public registration of AI systems deployed by both public and private entities;

• Ensure independent oversight of AI systems and require the provision of clear documentation on AI system capabilities, limitations and data provenance;

• Promote meaningful stakeholder consultation and participation in decision-making processes around AI procurement and deployment;

These recommendations will resonate with the maim requirements (in principle) applicable under eg the EU AI Act, or proposals for best practice AI procurement.

Final comment

The report helpfully highlights the current state of affairs in the regulation of AI procurement and deployment across the public and private sectors. The issues it raises are well-known and many of them involve complex governance challenges, including the need for levels of public investment commensurate to the socio-technical challenges brought by the digitalisation of the public sector and key private market services.

The report also highlights that, in the absence of adequate regulatory interventions, States (and businesses) are creating a significant stack of AI deployments that are simply not assured for relevant risks and, consequently, are creating an installed base of potentially problematic AI embeddings across the public sector and business. If anything, I think this should be a call for a renewed emphasis on slowing down AI adoption to allow for the development of the required governance instruments.

Procurement as Infrastructure

In a new paper co-authored with Nathan Davies (Oxford Internet Institute), we revisit the theoretical conceptualisation of procurement and make the claim that it is infrastructure.

We argue for a fundamental shift in how public procurement is understood: not just as a regulatory or transactional tool, but as a foundational form of infrastructure that shapes state capacity and digital transformation.

This is very much a work in progress — we welcome comments, critiques, and collaboration as we develop it further!

The abstract is as follows:

Public procurement constitutes a fundamental governance mechanism through which states interact with markets. It is a vast and consequential function of government, accounting for approximately one-third of public expenditure in most economies. Existing public management scholarship has predominantly conceptualised procurement through legal-regulatory, economic, or administrative perspectives. Whilst valuable, these approaches insufficiently theorise procurement's role in structuring governance possibilities and enabling or hindering state capacity. This paper advances a novel theoretical intervention by reconceptualizing procurement itself as infrastructure rather than merely as a mechanism for acquiring or outsourcing it. Drawing on Susan Leigh Star's influential work in infrastructure studies (Star, 1999), we systematically analyse how procurement systems—comprising legal frameworks, administrative routines, professional practices, and technological platforms—function as embedded socio-technical infrastructures that enable and constrain governance. Supported by an examination of illustrative UK cases, including the Carillion collapse, Post Office scandal and COVID-19 PPE procurement failures, we argue that these are not isolated implementation failures but manifestations of infrastructural breakdown resulting from systemic overload coupled with maintenance neglect. This reconceptualization bridges public management scholarship with anthropological and socio-legal perspectives and outlines avenues for future research. For policymakers, our analysis emphasises that procurement requires sustained investment and attention, and appropriate use, rather than superficial regulatory adjustments that neglect its foundational capacity to structure governance outcomes.

The full paper is freely downloadable on SSRN: Davies, Nathan and Sanchez-Graells, Albert, Procurement as Infrastructure (June 16, 2025): https://ssrn.com/abstract=5297077.

Image credits: Elise Racine & The Bigger Picture / https://betterimagesofai.org / https://creativecommons.org/licenses/by/4.0/.

GenAI in the public sector: two interesting default prohibitions (Ireland and the Netherlands)

Nadia Piet & Archival Images of AI + AIxDESIGN / https://betterimagesofai.org / https://creativecommons.org/licenses/by/4.0/. A red-toned illustration shows a man's head surrounded by swirling AI icons, with small, mischievous witch-like figures flying around him. The man's expression appears disoriented and fatigued, symbolizing the mental overload caused by the overwhelming flood of AI tools and news. The witches represent the chaotic, cackling nature of rapid AI developments, adding to the sense of dizziness and confusion.

We are getting so used to the hype around generative AI (GenAI) that it may seem like we are on the verge of it being used for all purposes, everywhere, all the time. There is significant pressure on public sector organisations, in particular, not to miss the opportunity to reap its (expected, presumed) benefits.

However, GenAI comes with many challenges and risks, especially when we talk about free to use, generally available GenAI models. This is not sufficiently understood or recognised and most of the conversations I have on GenAI use with public sector leaders and procurement officials tend to quickly reach an awkward moment where I pop the bubble by stressing those risks and ranting about why I think GenAI should not just be used as is offered off the shelf (or at all, for public sector activities that need to comply with strict requirements of good administration and factuality).

In the context of public sector AI adoption, the widespread availability of these tools poses a significant governance challenge and I think we are just a bad decision away from a potentially very significant scandal / problem. The challenge comes from many directions, but especially through the embedding (or slipstreaming) of AI tools into existing systems and software packages (AI creep) and access by civil servants and public sector employees through free to use platforms (shadow AI).

Given this, I have been glad to see that two recent pieces of guidance on public sector AI use have clearly formulated the default position that non-contracted / generally available GenAI should not be used in the public sector and that exceptional use should follow a careful assessment and many interventions to ensure compliance with rightly demanding standards and benchmarks.

The Irish Guidelines for the Responsible Use of AI in the Public Service (updated 12 May 2025), building on an earlier 2023 recommendation of the Irish National Cyber Security Centre recommend “that access is restricted by default to GenAI tools and platforms and allowed only as an exception based on an appropriate approved business case and needs. It is also recommended that its use by any staff should not be permitted until such time as Departments have conducted the relevant risk assessments, have appropriate usage policies in place and staff awareness on safe usage has been implemented” (p 39).

In very similar terms, but perhaps based on a different set of concerns, the Dutch Ministry of Infrastructure and Water Management’s AI Impact Assessment Guidance (updated 31 Dec 2024) has also stated that the provisional position for central government organisations is that GenAI use is in principle not permitted: “The provisional position on the use of generative AI in central government organisations currently sets strict requirements for the use of LLMS in central government: “Non-contracted generative AI applications, such as ChatGPT, Bard and Midjourney, do not generally comply demonstrably with the relevant privacy and copyright legislation. Because of this, their use by (or on behalf of) central government organisations is in principle not permitted in those cases where there is a risk of the law being broken unless the provider and the user demonstrably comply with relevant laws and regulations.”” (p 41).

I think that these are good examples of responsible default positions. Of course, monitoring and enforcement a general prohibition like this will be difficult and more needs to be done to ensure that organisations put in place governance and technical measures to seek to minimise the risks arising from unauthorised use. This is also a helpful default because it will force organisations that purposefully want to explore GenAI adoption to go through the necessary processes of impact assessment and careful and structured consideration, as well as place a focus on the adoption (whether via procurement or not) of GenAI solutions that have appropriate safeguards and are adequately tailored and fine-tuned to the specific use case (if that is possible, which remains to be seen).

Bordering the irresponsible: Commission's Q&A on third country access to EU procurement post-Kolin/Qingdao

Hanna Barakat & Archival Images of AI + AIxDESIGN / https://betterimagesofai.org / https://creativecommons.org/licenses/by/4.0/. The image depicts a series of stone-like hands, fractured and cracked, reaching out in various directions from a chaotic mass of tangled wires. Some hands display broken fingers, while archival tags on others suggest anonymity and erasure. The juxtaposition of human forms and technological wires evokes themes of labor, exploitation, and the often unseen physical work behind the tech industry.

In the aftermath of the CJEU’s Judgments in Kolin (C-652/22, EU:C:2024:910) and Qingdao (C-266/22, EU:C:2025:178), there was much anticipation about a guidance document being prepared by the European Commission to address some of the many, complex, consequential issues left open by the Court (see comment here).

The Q&A-type guidance document was published by the Commission late last week. The document has already been the object of analysis and deserved criticism, eg by Marko Turudić and Pedro Telles. They both comment on most aspects of the document in detail, and make good points.

In this post, I focus on two issues arising from the document and link them to first principles of procurement, as well as the broader layers of regulation beyond the EU.

two Extremely problematic assertions

In the Q&A document, the Commission makes two extremely problematic assertions. First, on the level of transparency to be afforded to decisions on participation and, if applicable, differential treatment of third country operators. Second, on the ‘severability’ of EU, national (and international) principles-based requirements.

Transparency requirements

The Q&A document states as follows:

Contracting authorities may indicate in advance in the tender documents their decision to accept or not participation of non-covered third country economic operators and, if they admit them, the arrangements applicable to their tenders.

They may also decide not to make this known in advance. In the absence of any reference to this matter in the contract notice / tender specifications, the contracting authority / entity still has the possibility to accept or to reject a tender from an economic operator from a non-covered country at any moment during the procurement process (answer to Q5.3, emphasis added).

‘Severability’ of legal principles by their ‘origin’

The Q&A document also states that:

Economic operators from non-covered countries do not enjoy any rights deriving from EU public procurement law, including requirements for transparency and proportionality enshrined in EU law and transposed into the national legal order. It is open to competent national authorities to identify other national provisions (not transposing EU public procurement law) on which such economic operators might rely (answer to Q6.2).

And that, in ensuring compliance with the principle of the rule of law ‘Contracting authorities/ entities may base themselves on national legislation that does not transpose EU law’ (answer to Q6.4) and, further, that ‘any possible issue of compliance with the ECHR would concern national law only and would be unrelated to any instance of implementation of EU law by a Member State’ (answer to Q6.5, emphasis added).

Overall position

Combined, this sets out the combined position that (i) contracting authorities can make decisions based on undisclosed criteria at any point in the procurement process and that (ii) any transparency, etc requirements in relation to those criteria or those decisions can only stem from domestic legislation not transposing EU public procurement law / unrelated to any instance of implementation of EU law.

The CJEU benchmark

A first issue is that, in my view, the Commission’s assertions only partially follow from the Kolin and Qingdao judgments. It is thus worth recalling what the CJEU said. In Kolin, the Court established that:

‘While it is conceivable that the arrangements for treatment of such operators should comply with certain requirements, such as transparency or proportionality, an action by one of those operators seeking to complain that the contracting entity has infringed such requirements can be examined only in the light of national law and not of EU law’ (C-652/22, para 66).

In Qingdao, the Court stated that:

‘While it is conceivable that those treatment arrangements should comply with certain principles and requirements, such as the principle of protection of legitimate expectations and of legal certainty, an action raising a complaint that the contracting authority has infringed those principles can be examined only in the light of national law and not of EU law’ (C-266/22, para 66).

an alternative (less questionable?) interpretation

As we can see, the CJEU did not establish any hard boundary on the relationship between the national and EU law rules containing reference to the principles of protection of legitimate expectations and of legal certainty, or (the requirements) of transparency and proportionality. The CJEU said that the principles as enshrined in EU law could not be relied on. An alternative, domestic source would be needed. The CJEU was (almost) clear in accepting that (it is conceivable that) arrangements for the treatment of third country economic operators had to comply with transparency, proportionality etc requirement, but not as a matter of EU law.

A modestly and sensibly creative interpretation of the CJEU judgments would thus seek not to exclude protection afforded by homonymous principles and requirements, whether they are enshrined in the exact same domestic rules or not, as long as the applicability of the principles had a justification in a legal source other than EU law. This is not the same as demanding that an entirely separate (formulation of the) principle (to the same effect) exists. It simply requires that there is an alternative source of the requirement to abide by the given principle or requirement.

And there are at least two such general sources. First, the United Nations’ Convention Against Corruption (UNCAC) offers one such source in requiring that ‘Each State Party …, in accordance with the fundamental principles of its legal system, take[s] the necessary steps to establish appropriate systems of procurement, based on transparency, competition and objective criteria in decision-making, that are effective, inter alia, in preventing corruption’, with a requirement for such systems to explicitly address issues of transparency, establishment in advance of conditions for participation, and access to an effective system of domestic review’ (Art 9.1). Second, the ECHR provides the right to fair trial (Art 6).

Such an approach would have allowed some space for Member States to continue complying with basic requirements of administrative law and procurement regulation while the mess created by the Kolin and Qingdao judgments gets sorted out through EU procurement legislation. Any arguments that such course of action would detract from the effet utile of EU law would seem destined to fail, given that the CJEU had already accepted that participation by third country operators was possible and that equal treatment was also possible—just not as a matter of EU law. The Kolin/Qingdao could have been bracketed as an issue of competence and the true effectiveness of the case law been pushed to the reform of the directives in a much less disruptive manner.

Conversely, the Commission’s extreme interpretation seeks to wipe out such space for manoeuvre in requiring that the source of law demanding certainty, protection of legitimate expectations, transparency or proportionality has nothing to do and is entirely unrelated with the transposition of EU law. This is an impossible threshold to cross, as there will be no jurisdiction that has a set of procurement legislation to implement EU law, another one to comply with UNCAC, another one to comply with the ECHR, etc.

In fact, as EU procurement law is itself adjusted to those international standards and requirements, the transposition of the EU directives has been the mechanism to ensure compliance with all these layers of procurement regulation. This is a situation that is simply impossible to unbundle. Suggesting otherwise verges on the irresponsible, as it places contracting authorities in a position to breach a wide array of international and domestic rules, as well as creating significant corruption risks.

Corruption risks

Setting issue of legal interpretation aside for a moment, perhaps the most problematic part of the Q&A document is the second paragraph of the answer to question 5.3, where the Commission indicates that contracting authorities may ‘decide not to make [their decision to accept or not participation of non-covered third country economic operators and, if they admit them, the arrangements applicable to their tenders] known in advance. In the absence of any reference to this matter in the contract notice / tender specifications, the contracting authority / entity still has the possibility to accept or to reject a tender from an economic operator from a non-covered country at any moment during the procurement process‘. Crucially, the European Commission forgot to open (or close) the sentence with the all important caveat that this is (at best) the position solely for the purposes of EU law.

In my view, there is no question that a contracting authority that decided to operate in this manner would be in breach of UNCAC and a variety of constitutional level provisions (regardless of the specific EU jurisdiction we want to focus on).

And, more importantly, a contracting authority that decided to behave in this manner would be exposing itself to potentially significant corruption risks. Lack of transparency and not formulating the criteria to be applied in procurement decision-making at the point of launching the procedure not only reserves the contracting authority unlimited discretion and thus triggers the risk of arbitrariness in decision-making. More problematically, it exposes key decision-makers to pressure and to risks of corruption — either by the ‘covered’ entities seeking to persuade it to exclude the tender/s by the third country operator/s, or by the latter seeking the opposite, or both.

the bigger picture

Ultimately, the Kolin/Qingdao saga and this Q&A show that we are at risk of losing sight of the bigger picture. Procurement rules are not only, or even primarily, about trade liberalisation. They are essential tools of good governance and a source of discipline and integrity in the expenditure of public funds. Given their importance, multiple layers of procurement regulation are overlaid and, while they vary in their details, they all share the same core principles and fundamentals. Seeking to deviate from these, or to limit them to one and only one of those layers of regulation can simply not work.

It should also be clear that, as a matter of bigger picture, the inconvenience that sometimes comes from complying with the rule of law and other constitutional-level guarantees should possibly create constraints and difficulties in the implementation and rollout of EU (common) policy, as it does at national level. The Kolin/Qingdao saga and this Q&A can only be read as a prioritisation of the common commercial policy over good administration and rule of law considerations. It does not paint a pretty picture and it does not signal a particularly strong commitment to one of the fundamental values of the Union, to be frank.

The bigger picture is too that the CJEU had (at least) two ways of addressing these issues. One would be to impose a full ban on participation by non-covered third country operators. The other would be to have been more accepting of the limitations of ‘policy-making by judgment’ and to have openly stated that, once a third country operator has not been excluded, legal protections follow. By setting such shaky foundations as the Kolin/Qingdao case law, the CJEU enables the European Commission to make unhelpful interventions such as this one. The other part of the bigger picture is, as well, that the European Commission is willing to take exactly zero risks and that, in this extreme risk aversion, it can come to exacerbate problems arising from the case law.

Lucky dip from a mixed bag? Summary results of the consultation on the evaluation of EU Procurement rules

Janet Turra & Cambridge Diversity Fund / https://betterimagesofai.org / https://creativecommons.org/licenses/by/4.0/. The image features a silver meat grinder. Going into the grinder at the top are various culturally symbolic, historical, and fun icons – such as emojis, old statutes, a computer, newspapers, an aeroplane. At the other end of the meat grinder, coming out is a sea of blue and grey icons representing chat bot responses like 'Let me know if this aligns with your vision' in a grey chat bot message symbol.

The European Commission has published a Factual Summary report on the public consultation on Evaluation of the Public Procurement Directives (the Summary). While we await for the Commission’s fuller analysis of the responses to the consultation (which officials have publicly acknowledged to be processing with AI tools, at least in part) after the summer, it is worth taking a look at the numbers on their face value.

And even before that, it is worth reflecting on the value of a consultation that largely seeks input on the ‘lived experience’ of procurement but sidesteps the critical issue that respondents will provide views based on the specific implementation of the EU rules in their jurisdiction. Barring ‘pure copy-paste’ approaches (such as the good old UK approach), this already creates a significant methodological and analytical hurdle because the underlying reasons for any views expressed cannot without more be attributed to the EU directives—but are rather by necessity mediated by domestic implementation decisions, as well as by domestic procurement culture, legal context and technical infrastructure. The latter is perhaps the easier to grasp. Questions around e-procurement will elicit very different responses depending on the level of functionality, reliability, and sophistication (costs, etc) of e-procurement systems put in place in each of the Member States. Given the broad variation in that regard, it is hard to meaningfully extrapolate the feedback and attribute it to the minimalistic rules on e-procurement in the directives. The same applies across the piece.

Moreover, even setting that aside and taking the statistical summary as provided by the Commission, it is hard to know what to make of it. In short, in my view, the picture that emerges is very much a mixed bag. This further supports the emerging (?) view that the priority should not be the reform of the legal framework, but rather the much more complicated (and expensive) but potentially more impactful work on ensuring procurement practice maximizes use of the flexibility within the existing framework (as discussed in the recent conference held at the University of Copenhagen by Professor Carina Risvig Hamer — see the key conclusions here). Here is why.

(small) majority and (large) minority views

Let’s take a few headline figures and statements:

• 49% of respondents believe that the Directives did not make the public procurement system flexible enough and 54% think that they did not establish simpler rules for the public procurement system.

• most of respondents (48%) think that the rules aiming at increasing procedural flexibility (e. g. the choice of available procedures, time limits for submitting offers, contract modifications) are no longer relevant and adequate.

• the same percentage of respondents (48%) consider the Directives’ rules on transparency (e.g. EU-wide publication via Tenders Electronic Daily 'TED') to be still relevant and adequate.

• most respondents (53%) believe that the Directives ensure the equal treatment of bidders from other EU countries in all stages of the process and the objective evaluation of tenders.

• almost half of respondents (49%) consider that the rules on eProcurement are still relevant and adequate to facilitate market access.

• there is some agreement that the Directives’ rules that aim for environmentally friendly procurement (e.g. quality assurance standards and environmental management standards) and for socially responsible procurement (e.g. reserved contracts, requirements on accessibility for people with disabilities and design for all users) are still relevant and adequate. 39% and 43% of respondents say so, respectively.

• Most respondents (39%) believe that the objectives of the three Public Procurement Directives are coherent with each other. However, EU legislation relating to public procurement (e.g. sectoral rules such as the Net Zero Industry Act or Clean Vehicles Directive) are not thought to be coherent with the Directives by the largest part of respondents (37% vs 11% who think that sectoral files are coherent).

• Most respondents (49%) disagree that the Directives are fit for purpose to contribute to the EU’s strategic autonomy (including the security of EU supply chains). 42% think that the Directives are not fit for purpose in urgent situations. 44% consider that they are not fit for purpose in case of major supply shortages (e.g. supply-chain disruptions during a health, energy or security crisis). 38% think that the Directives do not ensure that security considerations are properly addressed by the contracting authorities.

The figures above, even if phrased in terms of majority of respondents, hardly show a clear majority view on any of those issues. At best, the majoritarian view reaches a figure just above the 50% threshold and, in most instances, the majoritarian view is in reality a large minority view (and sometimes not even that large at all). Constructing the figures to reflect ‘truly’ majority views to potentially influence the direction of reform proposals would require ‘appropriating’ the neutral space (which hovers between 15-28%, depending on the issue in the list above). This raises some questions on methodology itself (should neutral answers be allowed at all?), as well as on ways of treating data that stems from a non-representative and tiny sample (given the figures around number of public buyers, companies tendering for public contracts, and other stakeholders across the EU).

‘Consultation assessment by numbers’ is clearly not going to work. This should push our hopes to the qualitative analysis of the responses, which however raises no smaller questions on the relevance and reliability of the insights provided by this approach to public consultation. Moreover, it can be concerning that the qualitative analysis is being supported by AI tools, as this creates all sort of risks — from technical issues (such as confabulation and the simple making up of ‘insights’) to methodological issues (especially, if the AI is seeking to extract trends, which then largely replicates the problem of ‘assessment by numbers’). It would be very important for the Commission to publish a methodological annex in the future report explaining how AI was used, so that we can have a good sense of whether the qualitative analysis is robust or (use)less.

expert (?) views

To put it mildly, some trends in the Summary run directly against expert insights on the operation (and shortcomings) of the Directives.

This is perhaps most starkly shown in the responses around transparency. There is to my mind no question whatsoever that the expert community considers that there is insufficient procurement transparency and that the TED system is unfit to enable for the collection, publication and facilitation of re-use of procurement data in ways that lead to helpful data insights and, potentially, AI deployment. However, 48% of respondents have said otherwise. What to make of this? What is the point of asking this sort of question in an open consultation? Will this be used as a justification (aham, excuse) not to decidedly revisit the issue of procurement data in a way that promotes the development of an adequate data infrastructure fit for current policy challenges, as the expert community keeps advocating for?

Similarly, though 53% of respondents consider there is no issue of equal treatment of non-domestic bidders, what is the evidence for that? Given how relatively little cross-border tendering there is, on what grounds is this view formed? If the answers are based on a point of principle, what weight (if any) should be given to this set of answers? How does this square up with expert insights (and the Court of Justice’s occasional reminder) that fragmentation of requirements can create de facto unequal treatment (eg where domestic tenderers are more familiar with requirements arising from a broad array of administrative law provisions)?

Jarringly, the outcome of the consultation on the trends in competition for public contracts reflect that: ‘No significant conclusion could be drawn on whether competition had increased, remained the same or decreased over the last 8 years: 25% of respondents think that it decreased, 21% that it remained the same, and 25% that it increased’. However, from the European Court of Auditors’ report, we know that (by available metrics) competition has been on a constant reduction over the last decade. What was the point of asking this question and what to make of this outcome?

sectoral bias

Moreover, the qualitative analysis will require taking into account the specific position (and agenda) of respondents. Clearly, for example, the (declared) perception of aspects of the procurement system will be massively different depending on which side of the policy table respondents sit at.

This is most starkly shown around strategic procurement, where the public/private sector split is clear: ‘Public authorities agree that the Directives have encouraged contracting authorities to buy works, goods and services which are environmentally friendly (56%), socially responsible (55%), and innovative (45%). However, all other respondent groups are less positive. For instance, companies/businesses disagree that the Directives have encouraged contracting authorities to buy works, goods and services which are environmentally friendly (46%), socially responsible (50%), and innovative (54%).’ However, more importantly, and even with problems in the data, we know that uptake of green, social and innovation procurement is woefully low. Again, the European Court of Auditors has clearly documented this. What was the point of asking this question and, more importantly, how will this sort of outcome help inform policy going forward?

What next?

It will be interesting to see what comes out of the fuller analysis of the responses to the public consultation. However, it seems to me that this piece of information gathering will result in a relatively wide variety of views and thus likely have very little meaningful value in informing the direction of travel for the formulation of a proposal for revised rules. More importantly, I think this exercise shows the limited value in trying to obtain this sort of general views on high level questions around issues that are by definition complex, multi-layered, and in some cases politically contested.

As the conclusions to the Copenhagen conference show, there was broad general agreement (in that context) that three elements need to be at the core of the process of review of the EU rules: digitalisation, a clarification of the purpose/s of EU procurement rules, and practical simplification of legal requirements. Given the push to reform, we can hope that the Commission will take a path along those lines going forward. However, the Commission’s own statement of priorities included digitalisation, simplification and EU preference/strategic procurement. That is in itself showing a potentially big clash in approaches and the likely impossibility of achieving a set of goals that cut across each other.

Moreover, I think it is not too late to stop and reconsider whether we are falling in a legocentric trap. During the conference, ‘an element raised several times … was whether it was the procurement rules or the procurement practices that needed to change?’. I think there is a lot value in considering this in detail. We should not delude ourselves thinking that just because something is written in the procurement Directive, reality follows… It would also be helpful to consider whether it is possible to take a staged approach and truly prioritise efforts, so that we can move forward in relation to a single priority (which in my view should be digitalisation) before attempting the more complex and contested aspects of a reform.

Some thoughts on (mostly) not flying to conferences 6 years on

6 years ago I pledged to minimise conference travel and, basically, not to fly. This prompted a productive debate at the time but it quickly petered out. I tended to get the occasional raised eyebrow (or, less frequently, a thumbs up) when I declined invitations for in-person participation and asked to join online. Initially, not flying simply meant missing out. It was frustrating, but understandable.

Then, the pandemic happened and everyone was on ‘no-fly’ mode and just too happy to organise online spaces to have some sense of continuity in intellectual life and belonging to a community of peers in such a topsy-turvy world, but things quickly returned to ‘normal’ once frontiers reopened.

The ‘digital pivot’ did not sufficiently stick and we have been in a ‘hybrid’ space for the last three years or so. In this period, not flying has still meant missing out sometimes, but it has mostly been possible for me to participate in quite a few academic activities from my desk (with different levels of interactive possibility).

Other occasions have required long train journeys instead — which tend to be quite expensive and thus require not only the time commitment (mine, and my better half’s, as the kids need taking care of in the meantime!), but for organisers and funders to be willing to support a commitment not to fly (which is not always the case). Those occasions have been quite joyous and the possibility to see again friends and academic collaborators in person, and to meet new people, felt particularly valuable given the effort and cost that went into making it happen.

All in all, and unless I have (conveniently) forgotten something. I think that, over the past six years, I have only flown to an academic conference or similar event (such as a PhD examination, or a training event building on my academic research) on three occasions (all of them involving short-haul flights). I think it is a track record I can be proud of.

It is however true that, once the first exception was made, it has become increasingly tempting to make further exceptions. In the end, there is always a good reason (to be found) for it and, to be frank, once you make exceptions *for someone*, there are others that take declined invitations less positively. It is very hard to explain the guilt trips that some casual conversations about it can trigger.

It is also true that, perhaps inadvertently or gradually, my own experience of flying to conferences has changed and that breaching my pledge makes me feel bad and now detracts from the joy of academic comradery and intellectual stimulation. As I write this — waiting for a flight to return to the UK from Copenhagen — I feel I cheated myself and others, and this casts a long shadow on the valuable ideas, (re)connections and moments of simple fun I carry back with me.

I can see that I am in a bit of a slippery slope, and I can hear an internal voice expressing its discontent, so I thought this would be a good time to take stock and reflect—and recommit to continuing to minimise conference travel and, where I make an exception (which I will have to in coming months because it has been all too easy to make promises I’ll have to keep), to pack enough in the trip to spread the environmental damage as thinly as possible.

So, if you see me in a place that does not seem easily reachable from Bristol, do me a favour. Let’s please talk about it. If I went the long-way, I hope this will rekindle the productive conversation on trying to ‘make academic knowledge exchange more sustainable’. If I didn’t, please do not hesitate to give me a stern look (you may have anyway), and to ask what I else I am doing while there to justify the damage to the planet. I will appreciate it and it will help keep me in check (or at least honest about not sticking to the pledge).

Simplifying the aim and goals of procurement law

Thanks to Prof Carina Risvig Hamer, I had the opportunity to participate in the conference ‘EU Public Procurement anno 2025 - Are the rules fit for purpose?’ at the University of Copenhagen.

This was an interesting couple of days with plenty food for thought — but also worryingly reminiscent of discussions already had back in 2011 during the previous round of review of the EU directives (plus ça change).

I think there was a fair amount of support in the room for the position that the issues with the (in)effectiveness of EU procurement law do not stem from the rulebook, but rather from challenges in implementation and organisational and capacity shortcomings. However, this did not pre-empt discussions on how the rulebook could be improved.

My topic was, perhaps unsurprisingly, the need to simplify the aims and goals of competition law (my presentation is available here). This gave me an opportunity to revisit the (old and newer) arguments for stripping procurement of regulatory gatekeeping functions by offloading market-shaping rules and norms to general legislation, not procurement-specific mandatory requirements (eg on sustainability, see also Halonen (2021)).

In short, my conclusions / main points were that, in relation to the increasing use of procurement as a policy delivery tool:

• Simplification can only be achieved in a pro-competitive manner if the regulatory burden is placed elsewhere (EU-level legislation applicable across the economy)

• Explicitly changing goal/s and principles is likely to only have a marginal effect

• Only investment in capacity and development of active market intelligence strategies can start to make a difference in practice

Expanding the Scope of EU Public Procurement Law

The annual meeting of the European Procurement Law Group a few weeks ago was a good excuse to find focused time to think about the ongoing process of review of the EU public procurement rules—as we are working on an edited book with a series of recommendations and reform proposals. My draft chapter focuses on the scope of application of EU procurement law.

In the draft, I argue that the cornerstone of procurement regulation--what actually constitutes a 'public contract'--is not clear, despite decades of ECJ case law. This undermines the coherence and effectiveness of EU internal market law.

Against the background of the ongoing review, I focus on the scope of application of Directive 2014/24/EU to highlight some aspects of the interaction between the EU procurement rules and other instruments of EU internal market law, including new and proposed tools seeking to (further) leverage procurement as a policy delivery instrument—such as the International Procurement Instrument or the Foreign Subsidies Regulation, as well as the increasing range of mandatory (sustainability) requirements focused on procurement.

After a review of recent trends in the interpretation (and narrowing) of the scope of application of Directive 2014/24/EU, I sketch an alternative functional approach that, in my view, would provide conceptual consolidation, realign EU procurement rules with their internal market logic, and potentially improve their fit as a policy delivery instrument.

I make two key reform proposals:

• New definition of 'procurement' to step back from current focus on 'acquisition' and 'choice' by the contracting authority, and to include preparatory activities with potential negative impacts on the internal market

• New definition of 'public contract' to eliminate the requirement of 'pecuniary interest'

As always, I would be very interested in any feedback.

The draft can be freely downloaded from SSRN: Sanchez-Graells, Albert, Expanding the Scope of EU Public Procurement Law -- Realigning the Procurement Directive with Its Internal Market Logic while Improving Its Fit with Strategic Procurement? (April 11, 2025). Available at SSRN: https://ssrn.com/abstract=5213497.

Procurement in the EU's AI Continent Action Plan

The EU has published its ‘AI Continent Action Plan’ (COM(2025)165).

The Plan aims to enhance the EU’s AI capabilities by promoting initiatives around five key areas. One of those key areas concerns the promotion of AI in strategic sectors and, in particular, in the public sector and healthcare.

The Plan includes some high level initiatives that are, however, not new.

• The Plan refreshes the expectation for the public sector to provide a source of funding and experimentation for AI development: ‘EU public procurement, accounting for over 15% of our GDP, could create an enormous market for innovative products and services.’ This has been a long-standing aspiration (eg Fostering a European approach to Artificial Intelligence, COM(2021)205).

• In that regard, the Plan reiterates the goal of the Competitiveness Compass to promote ‘European preference in public procurement for critical sectors and technologies in the context of the forthcoming review of the EU rules’, and clearly places AI amongst them. We will have to wait for details, but the compatibility of an EU preference with international procurement law escapes me.

• The Plan also refers to the upcoming ‘Apply AI Strategy’ which should ‘address adoption by the public sector, where AI in areas like healthcare can bring transformative benefits to wellbeing’.

  The Plan also includes a reference to:

• a call for funding of up to four pilot projects aimed at accelerating the deployment of European generative AI solutions in public administrations; and

• the fact that the ‘GovTech Incubator initiative will, over the period 2025-2029, support 21 GovTech actors from 16 countries to co-pilot and develop, as a first step, AI solutions for public procurement, evidence processing and accessibility assistants.’

  Overall, while it is interesting to see procurement being highlighted as part of the Plan, it seems that the Plan is not at the right scale to promote the sort of system-level change required for extensive adoption of AI in the public sector (at Member State level).

  What is more, without a clear strategy on how to address the issues of digital skills within the public sector, and without specific practical tools or guidance on how to procure AI (and the model EU clauses are definitely not an adequate tool, see here), it is hard to see how there can be much movement outside pilot projects. Perhaps the ‘Apply AI Strategy’ will provide some developments on those fronts.

New UK report on Use of AI in Government contains exportable lessons

The UK House of Commons Public Accounts Committee has published a new report on ‘Use of AI in Government’ (2024-25, HC 356).

The report focuses on the specific situation in the UK and addresses issues closely related to the UK Government’s current ambitions to quickly roll out AI across the public sector.

However, most recommendations target general obstacles and pitfalls for AI deployment, acquisition, and assurance, and will thus be of interest in other countries.

The key conclusions of the report — which I would bet are largely applicable to most countries — include:

• Out–of–date legacy technology and poor data quality and data–sharing is putting AI adoption in the public sector at risk.

• Public trust is being jeopardised by slow progress on embedding transparency and establishing robust standards for AI adoption in the public sector.

• There are persistent digital skills shortages in the public sector and current plans to address the skills gap may not be enough.

• There is no systematic mechanism for bringing together learning from (failed) pilots and there are few examples of successful at–scale adoption across government.

• There is a a long way to go to strengthen government’s approach to digital procurement to ensure value for money and a thriving AI supplier market.

• Realising the benefits of AI across the public sector will require strong leadership.

The key recommendations in the report focus on the need to:

• Deal with legacy technology and ICT systems before AI is overlaid on it.

• Address the risks resulting from barriers to data–sharing and poor data quality.

• Boost compliance with algorithmic transparency and disclosure requirements.

• Strengthen spend controls for high–risk AI use cases to support safe and ethical roll–out.

• Put effective plans in place to boost public sector digital skills sustainably.

• Set up a mechanism for systematically gathering and disseminating intelligence on pilots and their evaluation.

• Set out how to will identify common and scalable AI products and support their development and roll–out at scale.

• Develop an effective procurement strategy that leverages buying power to the possible extent.

• Ensure those taking procurement decisions across government have access to the right digital skills and knowledge.

• Develop effective governance, leadership and ownership within central government.

Somehow, I am glad to see that these recommendations directly map onto the same areas of concern I have been highlighting in my recent research (eg here, here and here) and talks about these issues. The big question now is whether the (UK) government will find ways to meaningfully address (and fund!) the changes required if AI readiness in a real, practical sense is to be brought closer to the aspirations surrounding public sector AI use.