Germany’s BSI puts AI into secure software procurement
Poland offers thin competition but hard qualification checks, while German cyber buyers draw crowded fields. Vendor movement shows where incumbents are exposed.
Germany’s Bundesamt für Sicherheit in der Informationstechnik appeared three times in this 14-day window, including a procurement for AI in the Secure Software Development Life Cycle. That puts secure-development capability, rather than perimeter protection alone, on the account plan for suppliers targeting the buyer.
Where this market is going
The coverage-neutral measure is moving in cybersecurity’s favour: its current share is 5.73%, a rise of 1.5 percentage points year on year. The monthly series began at 4.46% in September 2025, rose to 4.98% in October, then slipped to 4.4% in November and 4.25% in December.
Cybersecurity: share of all classified public IT tenders
Share, not volume. Monthly, last 12 complete months.
Where the tenders were published
Notices by buyer country, 14 days to 2026-09-20.
How hard the competition is
The blended average was 2.8 bids across 64 measured awards, but country contrast should determine the bid strategy. Germany drew 6 bids on average and Finland 5, making technical differentiation and evaluation quality decisive. Spain sat at 2.5, while Poland drew 1.9 and Czechia 1.8. In Poland and Czechia, the constraint is more likely to be qualification and delivery capacity than price alone; in Germany and Finland, shape the technical narrative before a crowded field does it for you.
How these contracts are awarded
Stated award criterion, for the tenders that declared one.
What is driving it
Poland’s uKSC is the active regulatory procurement signal. It was cited in 52 tenders in the current window, while its 30-day citation count moved to 282 from 218 in the preceding 30 days. The law’s staged requirements for risk-based security management, incident handling, reporting and audit make this both product procurement and compliance work. NIS2 was cited in 1 current tender and held at 3 citations in each of the two 30-day periods; its requirements for technical and organisational measures, management accountability and incident reporting similarly create both implementation and compliance demand.
Regulations named in live tenders
Tenders citing each framework, last 30 days.
The calendar ahead
| Date | Framework | Milestone | Where |
|---|---|---|---|
| 2027-01-29 | Solvency II Review (Directive 2025/2) | transposition deadline | EU |
| 2027-01-30 | Solvency II Review (Directive 2025/2) | applies from | EU |
| 2027-07-10 | Bank Account Registries + BARIS (AMLD6 2024/1640 art. 16) | applies from | EU |
| 2027-07-10 | EU AML Package (AMLR 2024/1624 + AMLA 2024/1620) | applies from | EU |
What shifted this week
Demand by type of work, against its own 12-week average
Percentage difference from the same vertical’s recent baseline.
Whose technology is being named
Fortinet appeared in 13 notices, 32% above its 12-week average. Palo Alto Networks appeared in 5, up 25%; Check Point also appeared in 5, up 11%; and Cisco appeared in 4, up 100%. Those are openings to establish whether specification language, incumbent estates or partner routes are creating repeatable access.
Vendors named in this window’s tenders
Notices naming each vendor, with movement against the same vertical’s 12-week average.
Who is buying repeatedly
| Tenders | Buyer | Country | Example |
|---|---|---|---|
| 4 | Територіальне управління Державної судової адміністрації України в Одеській області | UA | Послуги з забезпечення функціонування засобів криптографічного захисту інформації в місцевих загальних судах О |
| 3 | Iarnród Eireann-Irish Rail | IE | Ireland – IT services: consulting, software development, Internet and support – CIE Group Penetration Testing |
| 3 | Bundesamt für Sicherheit in der Informationstechnik | DE | Germany – IT services: consulting, software development, Internet and support – KI im Secure Software Developm |
| 3 | PRZEDSIĘBIORSTWO USŁUG KOMUNALNYCH SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ | PL | Dostawa, wdrożenie zintegrowanego systemu bezpieczeństwa informacji i infrastruktury IT oraz OT dla Przedsiębi |
| 3 | Nemocnice Dačice, a.s. | CZ | Czechia – Servers – Modernizace ICT pro zvýšení úrovně kybernetické bezpečnosti Nemocnice Dačice, a.s. II. |
| 3 | Zakład Gospodarki Komunalnej Czernica Sp. z o. o. | PL | Dostawa i wdrożenie infrastruktury IT/OT oraz systemów cyberbezpieczeństwa w ramach projektu „Cyberbezpieczne |
| 3 | GMINA POTOK GÓRNY | PL | Zakup sprzętu IT wraz z oprogramowaniem w ramach projektu Zwiększenie cyberbezpieczeństwa Gminy Potok Górny |
| 2 | Hansel Oy | FI | Finland – Computer audit and testing services – Palkeet - Tietoturvallisuuden arviointilaitosten arviointipalv |
An organisation running several tenders in one window is usually working through a programme rather than buying once.
The biggest tenders
All monetary values here cover only the 108 of 367 notices that published a value in EUR, not the size of the market. Espoon kaupunki’s €1.61 million access-control system and associated-services procurement fits its stated municipal information-security and digitalisation agenda. Iarnród Eireann-Irish Rail is buying a €1.4 million ransomware containment solution; GRAD ZAGREB has a €1 million procurement for devices protecting data traffic, described as a firewall; SM Manche Numérique is buying €1 million of security services for its information system, members and central purchasing body; and Alcaldia del Ayuntamiento de San Fernando has published €994,770.68 for managed technical assistance across municipal IT, systems, communications and security infrastructure.
Values as published by the buyer, for the 108 of 367 tenders in this window that stated one in EUR.
Deadlines worth watching
Who won
Suppliers with the most awards this window
Awards published in the window, by named winner.
Sources consulted
Pages the writer read for context while drafting this column. The figures above come from the notices, not from these.
Watch the next Polish scopes for a shift from compliance-led asset buying into implementation and managed-service packages, while engaging German and Finnish buyers early enough to influence a crowded technical evaluation.
Method
Built from 367 public procurement notices published between 2026-09-06 and 2026-09-20, classified into the Cybersecurity vertical. Every figure on this page is computed from those notices; the commentary is written around them. Sources: bzp, doe, ted, prozorro, worldbank. Tenders featured in earlier editions of this column are excluded from the named lists above.
Frequently Asked Questions
What is the current cybersecurity share of procurement notices?
5.73%, up 1.5 percentage points year on year.
How does competition differ across reported countries?
Germany averages 6 bids, Finland 5, Spain 2.5, Poland 1.9 and Czechia 1.8.
Which vendor movements stand out?
Fortinet has 13 notices and is up 32%; Cisco has 4 and is up 100%; Microsoft has 3 and is down 36%.
