# How do public buyers purchase the product, and what must be ready before the notice?

## Introduction

A company selling devices to European hospitals may have to win a public tender, whose scoring the buyer publishes when it launches the tender. A contracting authority is a public buyer bound by the European Union (EU) procurement rules. Where a hospital counts as one and buys at or above a value threshold, it must purchase through a procedure under Directive 2014/24/EU. Whether a hospital counts is decided hospital by hospital.

The buyer sets out how it will score tenders in the procurement documents, the tender papers, which are free to download from the day the contract notice announcing the tender is published. Evidence a buyer will score therefore has to exist before the notice appears. In the authors' observation, bid teams commonly first read the criteria while the bid window is running, when evidence that takes months to generate can no longer be produced.

Four illustrative products recur. The wearable cardiac monitor comes from a United States (US) company, which can rely on the same treatment as EU bidders only where an international agreement binding the EU covers the purchase. The triage software enabled by artificial intelligence (AI) comes from a European company. On our reading (a label that marks the authors' own interpretation), it may be bought through a procedure with negotiation, in which the buyer negotiates with invited bidders on their first offers.

The spinal implant, still certified under the former directive, is likely, on our reading, to be bought through framework agreements. These are agreements that fix the terms for a buyer's later orders and decide which suppliers can receive them. The near-patient cardiac troponin test, a blood test run near the patient in hospital emergency departments, comes from a Swiss company that sells through distributors. The sources were checked on 30 September 2026.

## In short

The Directive's procedures apply where a contracting authority buys at or above the threshold. From 1 January 2026, that is EUR 216 000 for supply and service contracts of sub-central authorities. That category covers any qualifying hospital the Directive does not list as central government. The value counted is the whole deal, including options and renewals set out in the procurement documents, so options and renewals can take a contract over the threshold. Whether a hospital is a contracting authority is decided hospital by hospital. The test is whether it serves a public-interest need of a non-commercial kind, has its own legal personality, and is mainly publicly funded or controlled. ([Directive 2014/24 Art. 2(1), 4(c), 5(1)][PD])

The buyer publishes the rules of the competition when it launches it. The minimum levels a company must meet to be admitted, for example on turnover or past contracts, appear in the contract notice. Where an advance announcement, called a prior information notice, opened the procedure, they appear instead in the buyer's invitation to confirm interest. The award criteria and their weighting appear in the procurement documents. With limited exceptions, those documents are free to download from the day the notice is published. Unless national law prohibits or restricts it, the buyer can still award the contract on price alone, in which case quality is not scored. ([Directive 2014/24 Art. 53(1), 58(5), 67(2), (5)][PD])

The award decision includes a summary of the reasons for it and states the standstill period, the pause during which the contract may not be signed. Seeking review means a formal challenge before a review body. A Member State may give losing bidders as little as 10 calendar days to seek it, counted from the day after the decision is sent electronically. That period keeps running while a bidder waits for the buyer's reply to a written request for further information. On our reading, where the decision gives no reasons, or reasons too thin to act on, the bidder needs to send that request and obtain advice on the day the decision arrives. ([Directive 89/665 Art. 2a(2), 2c][RD]; [Directive 2014/24 Art. 55(2)][PD])

## 1. Which rules govern a public purchase?

Directive 2014/24/EU on public procurement, called here the Procurement Directive, is law. Buyers apply national procedures adjusted to conform with it. Council Directive 89/665/EEC, the Remedies Directive, provides for review of decisions that infringed Union procurement law or the national rules transposing it. ([Directive 2014/24 Art. 26(1) to (3)][PD]; [Directive 89/665 Art. 1(1)][RD])

The Commission's evaluation of the directives and the European Court of Auditors (ECA) give measured figures on how procurement works in practice. The figures describe procurement in general, with one figure specific to medical equipment, and they create no legal rule.

## 2. Does a purchase fall under the Procurement Directive?

### Is the hospital a contracting authority?

Contracting authorities are the State, regional or local authorities, bodies governed by public law, and associations formed by them. A body governed by public law has all three of the following characteristics. ([Directive 2014/24 Art. 2(1), points (1) and (4)][PD])

| Characteristic | What it requires |
|---|---|
| Purpose | Established for the specific purpose of meeting needs in the general interest, not having an industrial or commercial character |
| Legal personality | It has legal personality |
| Public control | Financed for the most part by public authorities, or subject to their management supervision, or with a board more than half of whose members they appoint; any one alternative meets it |

The definition does not name hospitals. Whether a given hospital qualifies is decided hospital by hospital, against these characteristics as transposed nationally. Our reading is that for a privately owned hospital with public funding, the first and third characteristics are the ones to test.

Central government authorities are those listed in Annex I, and every other contracting authority is sub-central. A hospital that qualifies and is not listed in Annex I is therefore sub-central. ([Directive 2014/24 Art. 2(1), points (2) and (3)][PD])

### What value brings the purchase in?

The Directive's procedures apply where the estimated value, net of value added tax (VAT), is equal to or greater than a threshold. A public supply contract covers the purchase, lease, rental or hire-purchase of products, with or without an option to buy. Delegated Regulation (EU) 2025/2152 set the supply and service thresholds from 1 January 2026. They are EUR 216 000 for sub-central authorities and EUR 140 000 for central government authorities. ([Directive 2014/24 Art. 2(1), point (8), 4(b), (c)][PD]; [Delegated Regulation 2025/2152 Art. 1(1), 2][DR 2025/2152])

Each threshold is set in euros. For Member States outside the euro, the Commission publishes the national-currency equivalent every two years. It also checks the thresholds against those of the World Trade Organisation Agreement on Government Procurement (GPA) every two years and revises them where necessary. The consolidated text of the Directive, listed in the Sources, carries the figures in force. ([Directive 2014/24 Art. 6(1), (3), (4)][PD])

The estimated value is the total payable, net of VAT, as the buyer estimates it:

| Arrangement | How the value is counted |
|---|---|
| Any contract | Includes any option and any renewal explicitly set out in the procurement documents |
| Moment of valuation | When the call for competition, normally the contract notice, is sent; with none, when the buyer starts the procurement, for example by contacting operators |
| Framework agreement | The maximum value of all the contracts envisaged over its term |
| Regular supplies | The preceding 12 months or financial year, or the 12 months after first delivery |
| Lease with no fixed term | The monthly value multiplied by 48 |
| Lots of similar supplies | All lots together; if the total reaches the threshold, the Directive applies to each lot |
| Small lots | Lots under EUR 80 000 each may be awarded without the Directive's procedures, provided together they stay within 20 % of the value of all the lots |

([Directive 2014/24 Art. 5(1), (4), (5), (9) to (12), 26(5)][PD])

The method used to calculate the estimated value may not be chosen with the intention of keeping a purchase outside the Directive. A procurement may not be subdivided to that effect unless objective reasons justify it. Below the threshold, the procedures do not apply. ([Directive 2014/24 Art. 4, 5(3)][PD])

Articles 7 to 17 carry exclusions, such as contracts between entities within the public sector (Article 12). Member States may also allow a negotiated procedure without prior publication, in the cases Article 32 lists. Article 32 is an exception to the rule that a procedure opens with a call for competition. ([Directive 2014/24 Art. 7 to 17, 26(1), 32(1), (2)][PD])

**Figure 15.1. Whether a public purchase falls under the Procurement Directive.**

![Figure 15.1: three tests, on the buyer, the value and the lots](figures/figure-15-1-does-the-directive-apply.svg)



### Can a company from outside the Union tender on equal terms?

Buyers give operators and supplies from GPA signatories, and from parties to other agreements binding the Union, treatment no less favourable than they give Union operators and supplies. That applies only in so far as the Union's GPA annexes and those agreements cover the purchase. Article 25 says nothing about operators from countries outside those agreements. ([Directive 2014/24 Art. 6(1), 25][PD])

Implementing Regulation (EU) 2025/1197 excludes tenders from all operators originating in China from Union procedures for medical devices worth EUR 5 000 000 or more net of VAT. It defines those devices by codes 33100000-1 to 33199000-1 of the Common Procurement Vocabulary (CPV), the Union's single classification system for public procurement. The buyer determines the origin of devices under customs rules. ([Implementing Regulation 2025/1197 Art. 1, 2(2)][IPI 2025/1197]; [CPV Regulation Art. 1][CPV])

In those procedures, the successful tenderer may not subcontract more than 50 % of the contract value to operators originating in China. In a supply contract, goods or services originating there may make up no more than 50 % of the value. Breach of either carries a charge of 10 to 30 % of the contract value. A buyer may exceptionally disapply the measure, for example for overriding reasons of public health. On a Member State's justified request, the Commission may also exempt some small local authorities. ([Regulation 2022/1031 Art. 7(1), 8(1), 9(1)][IPI])

The measure covers procedures launched from its entry into force, which our computation from its publication date puts at 30 June 2025, and expires five years later unless extended. The procurement documents state when it applies. Any extension follows a review the Commission opens by a notice in the Official Journal no later than nine months before expiry. ([Regulation 2022/1031 Art. 1(4), 6(11)][IPI])

## 3. Which procedure will the buyer use, and how long does it give to bid?

Buyers may use open and restricted procedures, among others. A competitive procedure with negotiation, in which the buyer negotiates on initial tenders, may be used only where one of four criteria is met. Examples are needs that cannot be met without adapting readily available solutions, and requirements that include design or innovative solutions. It is also available where an open or restricted procedure drew only irregular or unacceptable tenders. ([Directive 2014/24 Art. 26(1) to (4), 29(2)][PD])

| Procedure | Who may tender | Minimum time for tenders | Main reductions |
|---|---|---|---|
| Open | Any interested economic operator | 35 days from the date the contract notice was sent | 15 days after a qualifying prior information notice, or not less than 15 in a duly substantiated urgency; five days off for electronic submission |
| Restricted | Operators the buyer invites after assessing their information | 30 days to request to participate, then 30 days from the invitation to tender | Tender period cut to 10 days after a qualifying prior information notice; a sub-central buyer may set the tender period by agreement with the candidates where the Member State allows, and without agreement it is at least 10 days; five days off for electronic submission; in urgency, not less than 15 days to request to participate and 10 days for tenders |
| Competitive procedure with negotiation | Operators the buyer invites after assessing their requests to participate | 30 days to request to participate, then 30 days from the invitation for initial tenders | As for the restricted procedure |

([Directive 2014/24 Art. 27 to 29][PD])

A prior information notice qualifies for these reductions if it was sent for publication between 35 days and 12 months before the contract notice and contained the information then available. All the limits are minimums. The buyer takes account of the complexity of the contract and the time needed to draw up tenders. ([Directive 2014/24 Art. 27(2), 47(1)][PD])

### Where is the notice published?

The call for competition is normally a contract notice, and a sub-central buyer may instead use a prior information notice where Article 48(2) allows it. The contract notice carries the information in Annex V, Part C, in a standard form. The Publications Office of the European Union publishes it within five days of sending, at the Union's cost. ([Directive 2014/24 Art. 26(5), 48(2), 49, 51][PD])

Implementing Regulation (EU) 2019/1780 sets the standard forms, called eForms. Tenders Electronic Daily (TED) is the Supplement to the Official Journal of the European Union. ([Implementing Regulation 2019/1780 Art. 1][eForms]; [SWD(2025) 332, footnote 11][SWD 332])

The CPV Regulation lists codes by product type, such as 33100000-1, "Medical equipments", and does not say which code fits a given product. Our reading is that a company searching for notices should cover the most specific code that plausibly fits its product and the parent codes above it, plus any code that a past notice for the same category used. Below the threshold, advertising follows national rules. On our reading, a notice for such a purchase may not appear on TED. ([CPV Regulation Annex I][CPV])

### How are the days counted, and what happens to questions?

Recital 106 recalls that Regulation 1182/71 applies to the Directive's time limits. A period includes public holidays, Saturdays and Sundays, and the day of the triggering event does not count. A period ending on one of those days runs to the close of the next working day. That rule does not apply to a period counted back from a given date or event. The Remedies Directive states its periods in calendar days. ([Directive 2014/24 recital 106][PD OJ]; [Regulation 1182/71 Art. 3(1), (3), (4)][Reg 1182/71]; [Directive 89/665 Art. 2a(2)][RD])

Provided a request was made in good time, the buyer supplies additional information to all tenderers no later than six days before the tender deadline. In an accelerated procedure, one shortened for urgency, the period is four days. ([Directive 2014/24 Art. 53(2)][PD])

The buyer must extend the deadline where that information was late, or where it makes significant changes to the documents. No extension is required where the request came late or the information is insignificant. ([Directive 2014/24 Art. 47(3)][PD])

The Directive does not define "in good time". Our reading is that a question sent shortly before the six-day limit risks receiving neither an answer nor an extension of the deadline. On the same reading, the tender deadline is the date and time the notice states.

## 4. How do framework agreements shut a supplier in or out?

In the Directive, a framework agreement is an agreement between one or more contracting authorities and one or more economic operators. Its purpose is to establish the terms governing contracts to be awarded during a given period, in particular with regard to price and, where appropriate, the quantity envisaged. Its term may not exceed four years, save in exceptional cases duly justified. Contracts under it may be awarded only between the buyers identified in the call for competition and the operators party to it. They may not substantially modify its terms. ([Directive 2014/24 Art. 33(1), (2)][PD])

| Framework | How contracts are awarded under it |
|---|---|
| Single operator | Within the agreement's terms; the buyer may ask the operator in writing to supplement its tender |
| Several operators, all terms set | On its own terms, without reopening competition, where it also sets the objective conditions for choosing the operator |
| Several operators, mixed | Partly with and partly without reopening competition, where the documents stipulate this and set objective criteria |
| Several operators, terms open | By reopening competition: the buyer consults in writing the operators capable of performing, fixes a time limit long enough to tender, and awards on the framework's criteria |

([Directive 2014/24 Art. 33(3) to (5)][PD])

The Commission's evaluation, citing Da Rosa and others, reports that the average framework term rose from 33.06 months to 33.72 months after the 2014 directives. ([SWD(2025) 332, footnote 85][SWD 332])

Our reading is that a company left out when a framework is concluded cannot be awarded contracts under it for its term. Whether the buyer also buys the category outside it, or runs a competition for a successor framework, depends on the buyer.


## 5. What can happen before the notice?

A buyer may announce a planned procurement in a prior information notice. The Publications Office publishes it, or the buyer does on its buyer profile, its own internet page for notices. Before launching a procedure, the buyer may conduct market consultations. It may seek advice from independent experts, authorities or market participants, provided the advice does not distort competition. ([Directive 2014/24 Art. 40, 48(1); Annex VIII][PD])

Where a candidate has advised the buyer or helped prepare the procedure, the buyer takes appropriate measures to prevent distortion. Those include telling the other candidates the information exchanged, and fixing adequate time limits. The candidate is excluded only where no other means ensure equal treatment. It first has a chance to prove that its involvement cannot distort competition. ([Directive 2014/24 Art. 41][PD])

Our reading is that anything a company tells a buyer in consultation may reach its competitors.

### What may the technical specifications require?

The specifications in the procurement documents lay down the characteristics required of the supply. They must give operators equal access without unjustified obstacles to competition. A procurement may not be designed to unduly favour or disadvantage certain operators. ([Directive 2014/24 Art. 18(1), 42(1), (2)][PD])

| Rule | What it provides |
|---|---|
| Form | Performance or functional requirements, or reference to standards, or a mix; each reference is followed by "or equivalent" |
| Brand names | No reference to a make, trade mark or patent that would favour or eliminate certain undertakings or products, unless the subject-matter justifies it, or exceptionally, with "or equivalent", where no precise description is possible |
| Equivalence | A tender that proves by any appropriate means that it meets the requirement in an equivalent manner may not be rejected |
| Performance requirement | A tender complying with a relevant standard may not be rejected, if the tenderer proves the standard meets the requirement |

([Directive 2014/24 Art. 42(3) to (6)][PD])

Our reading is that a consultation is the moment to explain which clinical outcomes and performance levels matter. A specification written in terms of performance can admit a device that a specification copied from a competitor's data sheet may exclude.

## 6. What will the buyer test about the company and the device?

Selection criteria may cover suitability to pursue the professional activity, economic and financial standing, and technical and professional ability. They must be related and proportionate to the subject-matter. The buyer states any minimum levels and the means of proof in the contract notice or in the invitation to confirm interest. That invitation goes to the operators that expressed interest where a prior information notice was the call for competition. ([Directive 2014/24 Art. 54(1), 58(1), (5)][PD])

| Criterion | What the Directive allows |
|---|---|
| Turnover | A minimum yearly turnover of no more than two times the estimated contract value, except in duly justified cases; per lot where the contract is divided; under a framework with reopened competition, based on the expected maximum size of contracts running at once or, where that is not known, the framework's estimated value |
| Experience | Suitable references from past contracts, with no number fixed; the list of deliveries covers at most the past three years, unless the buyer accepts older ones to ensure enough competition |
| Capacities of others | Reliance on other entities for financial standing and for technical and professional ability, proved for example by a commitment; for financial standing, the buyer may require joint liability |

([Directive 2014/24 Art. 58(3), (4), 60(4), 63(1); Annex XII][PD])

Buyers must accept the European Single Procurement Document (ESPD), a self-declaration used as preliminary evidence of meeting the selection criteria and of the absence of exclusion grounds. They may require no means of proof beyond those in Articles 60 and 62. ([Directive 2014/24 Art. 59(1), 60(1)][PD])

### What proof of conformity can a tender ask for?

The Medical Device Regulation (MDR) and the In Vitro Diagnostic Medical Device Regulation (IVDR) govern conformity. A device considered to be in conformity bears the CE marking, affixed before it is placed on the market. The exceptions are custom-made and investigational devices under the MDR, and devices for performance studies under the IVDR. ([MDR Art. 20(1), (4)][MDR]; [IVDR Art. 18(1), (4)][IVDR])

The EU declaration of conformity is translated into the language or languages each Member State of sale requires. Certificates from notified bodies, the conformity assessment bodies designated under each regulation, are valid for the period they indicate, up to five years. ([MDR Art. 19(1), 56(2)][MDR]; [IVDR Art. 17(1), 51(2)][IVDR])

A buyer may also ask for a test report or certificate from an accredited conformity assessment body. Our reading is that the company already holds the conformity evidence the MDR or the IVDR requires. On the same reading, a test report against the buyer's own specification may have to be produced from scratch. ([Directive 2014/24 Art. 44(1); Annex VII, point (1)(b)][PD])

An operator may have no access to a required certificate or test report in time, for reasons not attributable to it. It may then use other appropriate means of proof, such as a technical dossier, if those show its supplies meet the requirements. ([Directive 2014/24 Art. 44(2)][PD])

## 7. How will the tender be scored?

Buyers award on the most economically advantageous tender, often shortened to MEAT, without prejudice to national rules on the price of certain supplies. That tender is identified on price or cost, using what the Directive calls "a cost-effectiveness approach, such as life-cycle costing". That assessment may include the best price-quality ratio. ([Directive 2014/24 Art. 67(1), (2)][PD])

The Directive's examples of quality criteria include technical merit and functional characteristics. They also include staff experience where it significantly affects performance, and after-sales service, technical assistance and delivery conditions.

The cost element may be a fixed price, with competition on quality alone. Member States may prohibit price or cost as the sole award criterion, or restrict its use. Our reading is that, where a Member State has not done so, the text leaves an award on price alone available. ([Directive 2014/24 Art. 67(2)][PD])

| Member State | What the source reports |
|---|---|
| Croatia | A Commission-hosted fact sheet of January 2017 reports that, from 1 July 2017, contracting authorities cannot use price only or cost only as the sole award criterion |
| Italy | The Court of Justice held on 18 December 2025 that Article 67(2) does not preclude Italian legislation barring price as the sole criterion for services with standardised characteristics where labour costs are at least half the contract value |

([Croatia fact sheet, Public Procurement Act][HR fact sheet]; [Case C-769/23, para. 72][CJEU C-769/23])

No complete official list of the Member States that have used the option was found.

Criteria are linked to the subject-matter where they relate to the supplies in any respect and at any stage of their life cycle. They may not give the buyer an unrestricted freedom of choice, and must allow tenderers' information to be verified. ([Directive 2014/24 Art. 67(3), (4)][PD])

The weighting is specified in the procurement documents, except for an award on price alone. It may be a range. Where weighting is impossible for objective reasons, the criteria are listed in decreasing order of importance. The Directive fixes no split between price and quality. ([Directive 2014/24 Art. 67(5)][PD])

Our reading is that a published weighting may leave open how the buyer converts each submission into points. Our observation, a label for what the authors have seen in practice, is that bid teams commonly read the criteria for the first time after the notice, while the bid window is running. By then it is too late to produce evidence that takes months to generate.

### What does life-cycle costing count?

Life-cycle costing covers, to the extent relevant, costs borne by the buyer or other users for acquisition, use, maintenance and end of life. It can also cover environmental externalities whose monetary value can be determined and verified. It applies to a product, a service or works. ([Directive 2014/24 Art. 68(1)][PD])

A buyer using it states in the documents the data tenderers must provide and its method for reaching the costs. ([Directive 2014/24 Art. 68(2)][PD])

Our reading is that the data a buyer asks tenderers to provide for life-cycle costing is evidence the company needs to hold before the notice is published.

### What does the record show about price and competition?

The Commission's evaluation cites the Court of Auditors' finding that lowest-price awards increased over 2011 to 2021. It reports that contracts awarded on MEAT criteria declined from 70 % in 2006 to 2010 to 63 % in 2017 to 2024. ([SWD(2025) 332, section on award criteria][SWD 332])

The Court reports that lowest-bid awards still account for the bulk of awards in all Member States. The Court measures the share of lowest-bid awards and the Commission the share of awards on MEAT criteria, and neither report reconciles its figure with the other's. The share of procedures with a single bidder rose from 23.5 % in 2011 to 41.8 % in 2021. For medical equipment, it rose from 29 % to 46 %. ([ECA Special report 28/2023, paras. 36, 39 and 60, Figure 7][ECA])

Our reading is that by 2021 nearly half of the medical equipment procedures the Court measured drew a single tender. Neither report gives an award weighting for purchases of devices or in vitro diagnostic medical devices (IVDs).

## 8. What may a hospital ask for on cybersecurity?

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union repeals the directive on the security of network and information systems (NIS). Its title calls it the NIS 2 Directive. NIS 2 lists healthcare providers among its sectors of high criticality. It lists manufacturers of devices and IVDs among its other critical sectors. It applies in general to such entities that are at least medium-sized. Article 2(2) adds some regardless of size, such as one whose disruption could significantly affect public health. For a significant incident, covered entities send an early warning within 24 hours of becoming aware of it and a notification within 72 hours. ([NIS 2, title, Annexes I and II, Art. 2(1), (2), 23(4)][NIS 2])

The European Union Agency for Cybersecurity (ENISA) published procurement guidelines for hospitals in July 2026. Their legal notice says the publication represents ENISA's views, is for information purposes only, and does not endorse a regulatory obligation under Regulation (EU) 2019/881. It states that NIS 2 does not directly impose requirements on suppliers of information and communication technology, and takes effect through national law. ([ENISA publication page][ENISA page]; [ENISA guidelines, legal notice and s. 1.2][ENISA])

Our reading is that the guidance describes what a well-advised hospital may ask for, and binds neither the hospital nor the supplier.

ENISA marks each measure as recommended, which it calls essential cyber hygiene, or nice-to-have, for each type of procurement, and lists SOURCE-01 and SOURCE-06 as recommended for devices and IVDs. ([ENISA guidelines, s. 3][ENISA])

| Measure | What ENISA describes |
|---|---|
| SOURCE-01 | Healthcare providers, when feasible, must prioritise suppliers who demonstrate certified compliance with relevant security standards and regulations, including the MDR, the IVDR and the European Health Data Space Regulation. Its guidance under the measure is to evaluate the supplier's incident response plan against the 24-hour and 72-hour deadlines |
| SOURCE-06 | A contract clause obliging the supplier to notify security issues in its products and deliver patches promptly |

([ENISA guidelines, SOURCE-01 and SOURCE-06][ENISA])

The word "must" is ENISA's, in a document that disclaims any regulatory obligation. The Cyber Resilience Act does not apply to products to which the MDR or the IVDR applies. ([ENISA guidelines, legal notice][ENISA]; [Cyber Resilience Act Art. 2(2)][CRA])

Our reading is that a hospital can place a security measure in a specification, a selection requirement, an award criterion or a contract performance condition. The rules for whichever of these the hospital uses then apply to the measure. ENISA's patching clause fits as a contract performance condition. A measure used as an award criterion needs a link to the subject-matter. ([Directive 2014/24 Art. 67(3), 70][PD])

## 9. How long does a procedure take in practice?

The Commission's evaluation cites Ecorys estimates of the median days for the submission of offers. They fell from 48 in 2006 to 2010 to 30 in 2017 to 2024. For open procedures, the median days from the submission deadline to the award rose from 53 to 59. ([SWD(2025) 332, sections on procedures and time limits and on cost-benefit findings][SWD 332])

Articles 27 to 29 and 55 set no maximum time for evaluating tenders. The buyer informs each tenderer of its decision as soon as possible. The Ecorys figures describe the procedures in the study as a whole and do not forecast the length of any single procedure. Neither report gives a duration for purchases of devices or IVDs. ([Directive 2014/24 Art. 55(1)][PD])

Our computation gives one planning scenario for an open procedure: a 30-day bid window, 59 days to the award, and a 10-day standstill, 99 days in all. The window assumes five days off the 35-day minimum for electronic submission. ([Directive 2014/24 Art. 27(1), (4)][PD])

The evaluation does not say whether its median ends at the award decision or at the contract, so the scenario may count the standstill twice. The evaluation also does not state how its medians count days. The scenario sets no legal date, and leaves out work before the notice and any extension or review.

**Figure 15.2. The stages of an open procedure, the minimum the rules set on each, and the measured record.**

![Figure 15.2: the clock and the record](figures/figure-15-2-the-clock-and-the-record.svg)



## 10. What does an unsuccessful tenderer receive, and which clocks run?

A contract covered by the Procurement Directive may not be concluded before a standstill period has run. It is at least 10 calendar days from the day after the award decision is sent electronically. By other means, it is at least 15 calendar days from the day after sending, or 10 from the day after receipt. The decision carries a summary of the Article 55(2) reasons, subject to the grounds on which information may be withheld. It also states the exact standstill period national law applies. ([Directive 89/665 Art. 2a(2)][RD])

Member States may disapply the standstill where no prior publication in the Official Journal was required. They may also do so where the only tenderer concerned won and there are no candidates concerned. The third case in which they may disapply it is a contract under a framework agreement or a dynamic purchasing system, an open electronic arrangement for commonly used purchases. ([Directive 89/665 Art. 2b][RD]; [Directive 2014/24 Art. 34(1)][PD])

On a written request, the buyer replies as quickly as possible, and within 15 calendar days of receipt. An unsuccessful tenderer learns why its tender was rejected. One with an admissible tender learns the winner's name, the characteristics and relative advantages of its tender, and the conduct and progress of any negotiation or dialogue. ([Directive 2014/24 Art. 55(2)][PD]; [Regulation 1182/71 Art. 3(3)][Reg 1182/71])

The buyer may withhold information whose release would impede law enforcement, be contrary to the public interest, prejudice an operator's legitimate commercial interests, or prejudice fair competition. Our reading is that the reply describes the winning tender and is unlikely to include its prices or its score sheet. ([Directive 2014/24 Art. 55(3)][PD])

| Record after the award | What the Directive provides |
|---|---|
| Contract award notice | Sent within 30 days after concluding the contract, with the Annex V, Part D information; information may be withheld on similar grounds |
| Contracts under a framework | No notice needed for each; a Member State may require quarterly grouping |
| Procurement report | Names the successful tenderer and the reasons for selection; the article gives tenderers no right to receive it |

([Directive 2014/24 Art. 50(1), (2), (4), 84(1)][PD])

### How does review work?

Review is available at least to a person interested in the contract who has been or risks being harmed by an alleged infringement. A Member State may require it first to notify the buyer, or first to seek review with it. Review bodies can take interim measures and award damages. They can set aside unlawful decisions, including discriminatory specifications. ([Directive 89/665 Art. 1(3) to (5), 2(1)][RD])

A Member State that sets a review period makes it at least 10 calendar days from the day after an electronic decision is sent. By other means, it is at least 15 days from the day after sending, or 10 from the day after receipt. ([Directive 89/665 Art. 2c][RD])

Our reading is that the review period runs from the decision. It does not wait for the reply to a written request, which may take up to 15 calendar days. Where the decision gives no reasons, or reasons too thin to act on, the tenderer needs to send the written request and obtain advice on the day the decision arrives.

A review body must consider a contract ineffective where it was awarded without a contract notice in the Official Journal and the Directive did not permit that. The rule does not apply where the buyer considered direct award permissible and published a notice of its intention in the Official Journal. The buyer must also have waited at least 10 calendar days from the day after that notice was published before concluding. ([Directive 89/665 Art. 2d(1), (4)][RD])

A Member State may limit the time for seeking ineffectiveness to 30 calendar days after a justified award notice. It may apply the same limit from the day the buyer tells tenderers that the contract has been concluded and gives the reasons. In any case, the Member State may set an outer limit of at least six months from conclusion. National law sets the consequences of ineffectiveness and the effect of a review on a concluded contract. ([Directive 89/665 Art. 2d(2), 2f(1), 2(7)][RD])

Our reading is that a company should act as soon as a notice of intention to award directly is published, since the 10 days run from its publication. Where a purchase the Directive covers is ordered without a procedure, the contract is open to review.

**Figure 15.3. What an unsuccessful tenderer receives after the award decision, and the clocks that run.**

![Figure 15.3: after the award decision](figures/figure-15-3-after-the-award-decision.svg)



## 11. What would the proposed Regulation change?

Proposal COM(2026) 590, dated 9 September 2026, would replace the Procurement Directive with a Regulation. It would keep EUR 216 000 as the sub-central supply and service threshold. ([COM(2026) 590, cover page and Art. 2(1)][COM 590])

| Proposed change | What the proposal says |
|---|---|
| Award basis | Best price-quality ratio, with quality carrying at least 30 % of the points, or 50 % where the subject-matter is labour-intensive |
| Publication | Criteria and weighting stated in a public summary of competition |
| Derogation | Departure from the minimum quality share allowed where specifications, performance conditions or a combination with quality-based criteria can ensure quality, stated in that summary |
| Market consultation | Participation would stop counting as preparation of the procedure |
| Application | Two years after entry into force |

([COM(2026) 590 Art. 95, 98, 149][COM 590])

The Procurement Directive governs until the proposal applies. The European Parliament's Legislative Train page for the proposal tracks its stage. ([Legislative Train, Public Procurement Act][EP train])

## 12. How the answer is reached

1. **The buyer's status**: contracting authority or not, against the three characteristics as transposed nationally, and central or sub-central. ([Directive 2014/24 Art. 2(1)][PD])
2. **The value** of the whole arrangement, with options, renewals and lots, against that buyer's threshold, in national currency outside the euro area. ([Directive 2014/24 Art. 4 to 6][PD])
3. **The tenderer's position**, from Article 25 and any agreement covering the purchase, and from the CPV codes and value that make Implementing Regulation 2025/1197 apply. ([Directive 2014/24 Art. 25][PD]; [Implementing Regulation 2025/1197 Art. 1][IPI 2025/1197])
4. **The procedure**, which sets the minimum time limits, and any framework agreement, which decides who can win contracts for its term. ([Directive 2014/24 Art. 27 to 29, 33][PD])
5. **The period before the notice**, when consultations shape specifications and the evidence file is assembled. For a device certified under the former directives, the file includes the evidence that Article 120 of the MDR keeps that certificate valid. ([Directive 2014/24 Art. 40 to 42][PD]; [MDR Art. 120(2)][MDR])
6. **The documents** published with the notice, which give the selection minimums, criteria, weighting and any life-cycle costing data. ([Directive 2014/24 Art. 53(1), 58(5), 67(5), 68(2)][PD])
7. **The award decision**, which starts the standstill and any review period, while the reply to a written request and the contract award notice add information the decision left out. ([Directive 89/665 Art. 2a(2), 2c][RD]; [Directive 2014/24 Art. 50(1), 55(2)][PD])

## 13. The four running cases

### The monitor: a wearable cardiac monitor from a US company

Chapter 1 classes the hardware as IIa under Rule 10, on its reading, and the application separately. The application is class IIa if it only records for later review, which is the planning assumption, and class IIb if it analyses the rhythm. On our reading, neither class changes the answers below. As illustrative assumptions, a pilot order is worth EUR 60 000. A hospital then buys forty units a year at EUR 2 000 each, with licence and support, for three years with a two-year extension option.

| Question | Answer | Basis |
|---|---|---|
| Does the pilot fall under the Directive? | No: in a euro Member State, EUR 60 000 is below the sub-central threshold | [Directive 2014/24 Art. 4(c)][PD] |
| What is the main arrangement worth? | EUR 400 000 over five years counting the option, EUR 240 000 for three (our computation); both clear the threshold | [Directive 2014/24 Art. 5(1)][PD] |
| Which route applies? | The Directive's procedures, if the hospital is a contracting authority and no exclusion or Article 32 case applies; open or restricted, on our reading | [Directive 2014/24 Art. 2(1), 4, 26, 32][PD] |
| What turnover can be required? | At most EUR 800 000, two times the value (our computation), unless justified; a Union partner's capacities can be relied on | [Directive 2014/24 Art. 58(3), 63(1)][PD] |
| Which CPV codes? | 33123210-3, "Cardiac-monitoring devices", beneath 33123200-0 and 33123000-8 | [CPV Regulation Annex I][CPV] |
| Equal treatment? | Only where the GPA or another agreement binding the Union covers the purchase | [Directive 2014/24 Art. 25][PD] |
| Does the China measure reach it? | 33123210-3 lies within its range, on our reading; at EUR 5 000 000 or more, which a framework for many hospitals could reach, goods originating in China may make up no more than 50 % of the value | [Implementing Regulation 2025/1197 Art. 1, 2(2)][IPI 2025/1197] |

Our reading is that a pilot with no call for competition is valued when the buyer starts the procurement. That moment can be the buyer's first approach to the company. On our reading, a pilot bought as the first slice of the later requirement risks being treated as a subdivision. ([Directive 2014/24 Art. 5(1), (3), (4)][PD])

An importer is a person established in the Union that places a device from a third country on the Union market. Our reading is that if the company tenders and supplies in its own name, the distributor may no longer be the importer. Which party acts as importer is settled with the authorised representative before bidding, as chapter 1 describes. ([MDR Art. 2(33)][MDR])

### The triage tool: AI-enabled software from a European company

Chapter 1 finds classes IIa to III all arguable for the triage tool under Rule 11, and plans it as class IIb.

| Question | Answer | Basis |
|---|---|---|
| Does supply or service matter? | No: supply and service contracts share the same thresholds, so it makes no difference whether a licence counts as one or the other | [Directive 2014/24 Art. 4(b), (c)][PD] |
| Which procedure? | Possibly a competitive procedure with negotiation, on our reading, where the buyer adapts the tool to its own triage workflow; 30 days to request to participate, then 30 for initial tenders | [Directive 2014/24 Art. 26(4), 29(1)][PD] |
| Which CPV codes? | 48180000-3, "Medical software package", and 48814000-7, "Medical information systems", with their parents; outside the China measure's range, on our reading | [CPV Regulation Annex I][CPV] |
| What can be scored on cost? | On our reading, integration work and running costs, if the buyer specifies them for life-cycle costing, which covers services; scored information must be verifiable | [Directive 2014/24 Art. 67(4), 68][PD] |
| What may a hospital ask on cybersecurity? | Following ENISA, certified compliance, an incident response plan against the 24-hour and 72-hour deadlines, and a patching clause | [ENISA guidelines, SOURCE-01 and SOURCE-06][ENISA] |
| Is the company itself in NIS 2? | That depends on its size, the Article 2(2) cases and national law | [NIS 2 Art. 2(1), (2)][NIS 2] |

### The implant: a spinal implant from a European company with a directive certificate

Chapter 1 classes the system by component. The cage is class III, screws and plates class IIb, and hooks class IIb on the classification guidance's reading, while rods, wires and pins are open. The company is seeking its first MDR certificate. Its offer includes instrument sets, sterilisation, consignment stock and surgeon training.

| Question | Answer | Basis |
|---|---|---|
| Which route? | Framework agreements, on our reading, of up to four years save in justified exceptional cases | [Directive 2014/24 Art. 33(1)][PD] |
| What if the company misses one? | It is shut out of that framework's contracts for its term, on our reading; the reported average term is 33.72 months | [Directive 2014/24 Art. 33(2)][PD]; [SWD(2025) 332, footnote 85][SWD 332] |
| Which CPV codes? | 33183100-7, "Orthopaedic implants", and 33183300-9, "Osteosynthesis devices", beneath 33183000-6; within the China measure's range, on our reading, for frameworks of EUR 5 000 000 or more | [CPV Regulation Annex I][CPV]; [Implementing Regulation 2025/1197 Art. 1][IPI 2025/1197] |
| How are service elements scored? | On our reading, instrument maintenance and sterilisation are life-cycle costs of use and maintenance, and training and consignment fit after-sales service and technical assistance | [Directive 2014/24 Art. 67(2), 68(1)][PD] |
| Can price alone decide? | Yes, where national law does not prohibit or restrict it | [Directive 2014/24 Art. 67(2)][PD] |

Our reading is that quantified life-cycle inputs are scored where the buyer uses life-cycle costing, and support the commercial case where it does not. ([Directive 2014/24 Art. 68(2)][PD])

A directive certificate issued from 25 May 2017, valid on 26 May 2021 and not withdrawn, stays valid beyond its printed date. It stays valid until a date that Article 120(3a) sets by risk class. The implant may be placed on the market until then only if the Article 120(3c) conditions are met. ([MDR Art. 120(2), (3c)][MDR])

A certificate that expired before 20 March 2023 is treated as still valid only if a notified-body agreement was signed before expiry, or an authority acted under Article 59(1) or 97(1). ([MDR Art. 120(2)][MDR])

Our reading is that a buyer checking the printed date may treat the certificate as expired. The evidence file therefore shows the Article 120 conditions, which chapter 1 sets out.

### The near-patient test: a cardiac troponin test from a Swiss company

The Swiss company has no Union entity. As chapter 1's illustrative assumptions, it supplies the analyser that reads the test and already sells the test through distributors in Germany, the Netherlands, Belgium and Austria. The test is planned as class C, and is on the Union market under a declaration drawn up under Directive 98/79/EC before 26 May 2022, with no notified body. As further illustrative assumptions, a hospital group buys cartridges worth EUR 15 000 a month and rents analysers at EUR 1 000 a month with no fixed term.

| Question | Answer | Basis |
|---|---|---|
| Who can tender? | The distributor, or the company and the distributor as a group, since an economic operator includes a temporary association; either can rely on the other's capacities | [Directive 2014/24 Art. 2(1), point (10), 63(1)][PD] |
| Equal treatment? | Where no agreement covers the purchase, Article 25 gives no guarantee, on our reading | [Directive 2014/24 Art. 25][PD] |
| Cartridges on an annual contract? | EUR 180 000 for the preceding 12 months | [Directive 2014/24 Art. 5(11)][PD] |
| The rental? | EUR 48 000 with no fixed term; EUR 12 000 for a 12-month rental | [Directive 2014/24 Art. 5(12)][PD] |
| Together? | EUR 228 000, above the threshold though each is below it; whether cartridges and rental form one procurement is for the buyer to decide in its estimate | [Directive 2014/24 Art. 4(c), 5(1)][PD] |
| On a three-year framework? | EUR 540 000 for the cartridges alone (our computation), so the procedures apply to a contracting authority however the analyser rental is valued | [Directive 2014/24 Art. 5(5)][PD] |
| Which CPV codes? | 33696200-7, "Blood-testing reagents", 33124130-5, "Diagnostic supplies", 33127000-6, "Immuno-analysis devices", and 38434000-6, "Analysers"; the middle two lie within the China measure's range, on our reading | [CPV Regulation Annex I][CPV] |

Our reading is that offering cartridges and rental as one package makes aggregation likely. On the same reading, recurring cartridge supply suits a framework with reopened competition. ([Directive 2014/24 Art. 33(4), (5)][PD])

The IVDR defines the importer as the MDR does. Our reading is that, as for the monitor, a direct bid can move the importer role from the distributor. ([IVDR Art. 2(26)][IVDR])

## 14. When specialist help is worth paying for

- **A buyer's status is unclear**, since it is decided hospital by hospital. ([Directive 2014/24 Art. 2(1), point (4)][PD])
- **A deal would rely on an exclusion or on Article 32.** ([Directive 2014/24 Art. 7 to 17, 32][PD])
- **The company advised the buyer before the procedure**, since the rule on prior involvement can, as a last resort, lead to the company's exclusion. ([Directive 2014/24 Art. 41][PD])
- **A tenderer from outside the Union needs to know which agreement covers the purchase.** ([Directive 2014/24 Art. 25][PD])
- **A decision is to be challenged.** A review period can be 10 calendar days, and notice to the buyer may come first. The period for challenging a direct award can be as short as 30 calendar days from a justified award notice. ([Directive 89/665 Art. 1(4), 2c, 2f(1)][RD])
- **The company will tender with a partner**, since a buyer may require joint liability where the company relies on the partner's financial standing. ([Directive 2014/24 Art. 63(1)][PD])

## Conclusion

Whether the Procurement Directive, Directive 2014/24/EU, can apply depends first on whether the buyer is a contracting authority, a public buyer bound by the EU procurement rules, which is decided hospital by hospital. The threshold depends on whether the Directive's Annex I lists the buyer as a central government authority. A qualifying hospital that is not listed takes the higher, sub-central threshold. The value of the whole arrangement, counted with options, renewals and lots, decides whether the purchase must go through the Directive's procedures.

The procedure the buyer chooses sets the minimum time companies have to bid. Where the buyer uses a framework agreement, which fixes the terms for its later orders, only the suppliers party to it can win those orders for its term, up to four years save in exceptional cases. The criteria, their weighting and any data the buyer wants for life-cycle costing, its count of whole-life costs, appear in the documents published with the notice. The evidence the buyer will score therefore has to be ready before the notice appears.

The award decision starts the standstill period, during which the contract may not be signed, and any period for seeking review, a formal challenge. The review period runs without waiting for the buyer's reply to a written request for further information. On our reading, where the decision gives no reasons, or reasons too thin to act on, the company sends that request and obtains advice on the day the decision arrives.

For the wearable heart monitor from a US company, the illustrative EUR 60 000 pilot is below the sub-central threshold in a euro Member State, so on its own it falls outside the Directive. On our reading, a pilot bought as the first slice of the later requirement risks being treated as an unlawful split of the larger purchase. The main arrangement, worth EUR 400 000 counting the extension option, clears the threshold and goes to tender if the hospital is a contracting authority and no exception applies. The AI triage software from a European company may, on our reading, be bought through a competitive procedure with negotiation, where the buyer adapts the tool to its own triage workflow. The buyer then negotiates on first offers. The hospital may also ask for the cybersecurity evidence that the EU cybersecurity agency, ENISA, describes in guidance that binds neither side, on our reading.

On our reading, the spinal implant, still certified under the former directive, is likely to be bought through framework agreements, and a company that misses one cannot win contracts under it for its term. For the near-patient cardiac troponin test from a Swiss company, cartridges and analyser rental come to EUR 228 000 if the buyer counts them together. That exceeds the threshold, though each is below it. A three-year framework for the cartridges alone is worth EUR 540 000, so the Directive's procedures apply to a contracting authority however the rental is valued.

Chapter 10 covers the company's own cybersecurity duties, and chapter 13 the national route for each country. Chapter 14 covers the economic evidence life-cycle costing may draw on, and chapter 16 partners, distributors and price.

## Sources

The last column gives the latest date on which a statement was checked against the version shown.

| Source | Version used | Date of that version | Link | Checked |
|---|---|---|---|---|
| Directive 2014/24/EU on public procurement (Procurement Directive), consolidated text | CELEX 02014L0024-20260101, consolidation 006.001, last amendment M6, Delegated Regulation (EU) 2025/2152. Directive (EU) 2026/806, which adds Article 10(k) from 12 May 2028, is not in it and is not relied on | 1 January 2026 | [Publications Office][PD] | 30 September 2026 |
| Directive 2014/24/EU as published, for recital 106 (the consolidated text omits recitals) | CELEX 32014L0024, Official Journal L 94, p. 65 | 28 March 2014 | [Publications Office][PD OJ] | 30 September 2026 |
| Council Directive 89/665/EEC (Remedies Directive), consolidated text | CELEX 01989L0665-20140417, consolidation 003.001, last amendment M4, Directive 2014/23/EU | 17 April 2014 | [Publications Office][RD] | 30 September 2026 |
| Commission Delegated Regulation (EU) 2025/2152, thresholds for 2026 and 2027 | CELEX 32025R2152, as published | 23 October 2025 | [Publications Office][DR 2025/2152] | 30 September 2026 |
| Commission Implementing Regulation (EU) 2019/1780, standard forms (eForms), consolidated text | CELEX 02019R1780-20241101, consolidation 003.001 | 1 November 2024 | [Publications Office][eForms] | 30 September 2026 |
| Regulation (EC) No 2195/2002, Common Procurement Vocabulary (CPV Regulation), consolidated text | CELEX 02002R2195-20220710, consolidation 004.001 | 10 July 2022 | [Publications Office][CPV] | 30 September 2026 |
| Regulation (EU) 2022/1031 (IPI Regulation), International Procurement Instrument | CELEX 32022R1031, as published, Official Journal L 173; no consolidation or amendment | 30 June 2022 | [Publications Office][IPI] | 30 September 2026 |
| Commission Implementing Regulation (EU) 2025/1197, IPI measure on medical devices | CELEX 32025R1197, as published; no consolidation or amendment | 20 June 2025 | [Publications Office][IPI 2025/1197] | 30 September 2026 |
| Regulation (EEC, Euratom) No 1182/71, periods, dates and time limits | CELEX 31971R1182, as published, Official Journal L 124; no amendment | 8 June 1971 | [Publications Office][Reg 1182/71] | 30 September 2026 |
| Directive (EU) 2022/2555 (NIS 2) | CELEX 32022L2555, as published, Official Journal L 333 | 27 December 2022 | [Publications Office][NIS 2] | 30 September 2026 |
| Regulation (EU) 2017/745 (MDR), consolidated text | CELEX 02017R0745-20260719, consolidation 007.001 | 19 July 2026 | [Publications Office][MDR] | 30 September 2026 |
| Regulation (EU) 2024/2847 (Cyber Resilience Act), as published | CELEX 32024R2847, Official Journal L, 2024/2847, 20 November 2024; amended by Regulation (EU) 2025/327, which does not amend Article 2 | 23 October 2024 | [Publications Office][CRA] | 30 September 2026 |
| Regulation (EU) 2017/746 (IVDR), consolidated text | CELEX 02017R0746-20250110, consolidation 005.001 | 10 January 2025 | [Publications Office][IVDR] | 30 September 2026 |
| Proposal COM(2026) 590 final, Regulation on public contracts and concessions (proposal, not law) | 2026/0265 (COD), as published | 9 September 2026 | [European Commission][COM 590] | 30 September 2026 |
| European Parliament, Legislative Train entry, Public Procurement Act | Page as read; status "Announced", last updated 1 August 2026, before the proposal | 1 August 2026 | [European Parliament][EP train] | 30 September 2026 |
| Commission Staff Working Document SWD(2025) 332, evaluation of the procurement directives | SWD(2025) 332 final | 14 October 2025 | [Publications Office][SWD 332] | 30 September 2026 |
| European Court of Auditors, Special report 28/2023, *Public procurement in the EU* | Special report 28/2023 | 2023 (exact date not recorded) | [European Court of Auditors][ECA] | 30 September 2026 |
| ENISA, *Procurement guidelines for the cybersecurity of hospitals and healthcare providers* (guidance) | July 2026 edition | 22 July 2026 | [ENISA][ENISA]; [publication page][ENISA page] | 30 September 2026 |
| European Construction Sector Observatory, policy measure fact sheet on Croatia's Public Procurement Act (Commission-hosted; reports the position in January 2017, not current law) | Fact sheet, Thematic Objective 4 | January 2017 | [European Commission][HR fact sheet] | 30 September 2026 |
| Court of Justice, judgment in Case C-769/23, *Mara v Ministero della Difesa* | ECLI:EU:C:2025:984, Third Chamber | 18 December 2025 | [Publications Office][CJEU C-769/23] | 30 September 2026 |

[PD]: http://publications.europa.eu/resource/cellar/385cb957-f086-11f0-8d3c-01aa75ed71a1.0007.03/DOC_1
[PD OJ]: http://publications.europa.eu/resource/cellar/aa61f069-b654-11e3-86f9-01aa75ed71a1.0006.01/DOC_1
[IPI]: http://publications.europa.eu/resource/cellar/99914a10-f83a-11ec-b94a-01aa75ed71a1.0006.01/DOC_1
[IPI 2025/1197]: http://publications.europa.eu/resource/cellar/8ba716b7-4d6e-11f0-a9d0-01aa75ed71a1.0006.01/DOC_1
[Reg 1182/71]: http://publications.europa.eu/resource/cellar/062fba91-9703-427a-8b77-f7fe0bcbd8b4.0008.01/DOC_1
[RD]: http://publications.europa.eu/resource/cellar/a6982287-7298-4880-8b42-dfea5d008a8d.0020.03/DOC_1
[DR 2025/2152]: http://publications.europa.eu/resource/cellar/ed53995b-afac-11f0-b37f-01aa75ed71a1.0006.01/DOC_1
[eForms]: http://publications.europa.eu/resource/cellar/9b50dcde-b727-11ef-91ed-01aa75ed71a1.0007.03/DOC_1
[CPV]: http://publications.europa.eu/resource/cellar/3309a7b7-1d85-11ed-8fa0-01aa75ed71a1.0002.03/DOC_1
[NIS 2]: http://publications.europa.eu/resource/cellar/9b84d482-85bd-11ed-9887-01aa75ed71a1.0006.01/DOC_1
[MDR]: http://publications.europa.eu/resource/cellar/e56fc708-95ab-11f1-9262-01aa75ed71a1.0004.03/DOC_1
[CRA]: http://publications.europa.eu/resource/cellar/21b7d4eb-a6e2-11ef-85f0-01aa75ed71a1.0006.01/DOC_1
[IVDR]: http://publications.europa.eu/resource/cellar/bb7d3f94-cd06-11ef-be2a-01aa75ed71a1.0007.03/DOC_1
[COM 590]: https://single-market-economy.ec.europa.eu/document/download/59557310-3af0-426d-b6b6-0357b650065f_en?filename=Proposal%20for%20a%20Regulation%20-%20Public%20Procurement%20Act.pdf
[EP train]: https://www.europarl.europa.eu/legislative-train/theme-a-new-plan-for-europe-s-sustainable-prosperity-and-competitiveness/file-public-procurement-act
[SWD 332]: http://publications.europa.eu/resource/cellar/774c1c10-a911-11f0-89c6-01aa75ed71a1.0001.02/DOC_1
[ECA]: https://www.eca.europa.eu/ECAPublications/SR-2023-28/SR-2023-28_EN.pdf
[ENISA]: https://www.enisa.europa.eu/sites/default/files/2026-07/Procurement%20guidelines%20for%20the%20cybersecurity%20of%20hospitals%20and%20healthcare%20providers.pdf
[ENISA page]: https://www.enisa.europa.eu/publications/procurement-guidelines-for-the-cybersecurity-of-hospitals-and-healthcare-providers
[HR fact sheet]: https://single-market-economy.ec.europa.eu/system/files/2021-03/ecso_pfs1_hr_ppa_v11_clean_0.pdf
[CJEU C-769/23]: http://publications.europa.eu/resource/cellar/595d1034-dbff-11f0-8da2-01aa75ed71a1.0010.04/DOC_1