MD-IT's hospital AI framework tests cyber bid discipline
A German hospital-AI framework and thin Polish fields show where qualification matters more than price, while Cisco and Microsoft accelerate in named notices.
MD-IT GmbH has put an €88 million framework to market for AI supporting hospital billing review, with compliance, information security and technical security testing in the scope. It is a useful warning against treating the week's cyber demand as a run of firewall replacements: buyers are attaching security controls to operational AI deployment, and the framework form makes route-to-market and admissibility as important as the product stack.
The largest listed procurement is the Slovak investment and regional development ministry's €124.5 million central purchase of operating-system, office-suite, server-access and related licences. The ministry is associated with work to strengthen government CSIRT capabilities under Program Slovensko, making the licence estate and the security operating model harder to separate in an account plan.
Where this market is going
Cybersecurity's current share of classified notices is 7.72%, a coverage-neutral rise of 0.15 points. The monthly line is lumpy rather than steady: 7.02% in 2025-11 fell to 6.31% in 2025-12 and 4.27% in 2026-01; it then moved through 4.59% in 2026-02, 4.58% in 2026-03, 4.91% in 2026-04, 5.7% in 2026-05 and 5.92% in 2026-06. It softened again to 5.55% in 2026-07, reached 5.73% in 2026-08, eased to 5.56% in 2026-09, then jumped to 7.24% in 2026-10.
That late movement matters more than the raw notice count because the collection base changes. The immediate implication is to treat the current 320 notices as a target-account signal, not a market-growth claim: the recent lift is concentrated enough to warrant active qualification, but the path does not yet support a smooth-demand assumption.
Cybersecurity: share of all classified public IT tenders
Share, not volume. Monthly, last 12 complete months.
Where the tenders were published
Notices by buyer country, 7 days to 2026-11-02.
How hard the competition is
The average is 3 bids across 102 measured awards, but country contrast is the commercial fact. France averages 6 bids and Germany 5.4, against Spain at 3.2 and Czechia at 2.6. Poland, which accounts for 93 notices, averages 2.1 bids; Ukraine averages 1 bid across 41 notices.
In France and Germany, assume the field will test technical differentiation, evidence and quality rather than price alone. In Poland and Ukraine, the thinner fields change the risk: qualification, local delivery capacity and a credible mobilisation plan are the constraint, not simply an aggressive price. SMEs account for 61% of the measured bid outcome, while 31% are single-bid outcomes, so a well-qualified specialist has a materially different route in thin markets than in the crowded western European contests.
How these contracts are awarded
Stated award criterion, for the tenders that declared one.
What is driving it
KRITIS-Dachgesetz is cited in 1 commercial tender and Poland's uKSC in 1 government tender. The German act creates a cross-sector critical-infrastructure resilience framework, which points principally to compliance work with associated security-control procurement. Poland's amended uKSC implements NIS2 risk-management requirements for essential and important entities, making it both a compliance trigger and a product opportunity where buyers must evidence proportionate controls.
The wider citation pulse is mixed: NIS2 has 4 tenders in the latest 30-day period against 3 previously; BSI IT-Grundschutz has 3 against 1; KSeF has 4 against 2; and the digital euro has 2 against 0. eIDAS 2 moves the other way, with 3 against 12. The Solvency II Review requires insurance supervisors and insurers to adapt reporting and risk frameworks, with transposition due on 2027-01-29 and application from 2027-01-30. For suppliers, that is chiefly compliance work, but it can pull through security products where reporting, risk and access controls need remediation.
Regulations named in live tenders
Tenders citing each framework, last 30 days.
The calendar ahead
| Date | Framework | Milestone | Where |
|---|---|---|---|
| 2027-01-29 | Solvency II Review (Directive 2025/2) | transposition deadline | EU |
| 2027-01-30 | Solvency II Review (Directive 2025/2) | applies from | EU |
| 2027-03-26 | European Health Data Space (Regulation 2025/327) | applies from | EU |
| 2027-07-10 | Bank Account Registries + BARIS (AMLD6 2024/1640 art. 16) | applies from | EU |
| 2027-07-10 | Bank Account Registries + BARIS (AMLD6 2024/1640 art. 16) | transposition deadline | EU |
| 2027-07-10 | EU AML Package (AMLR 2024/1624 + AMLA 2024/1620) | applies from | EU |
What shifted this week
Demand by type of work, against its own 12-week average
Percentage difference from the same vertical’s recent baseline.
Whose technology is being named
Cisco is the sharpest named acceleration, with 9 notices, 157% above its 12-week average of 3.5. Microsoft has 12 notices, up 106% against 5.8, while Fortinet has 13, up 56% against 8.3; Palo Alto Networks has 6, up 53% against 3.9. These are openings for competitors and channel partners because the named stack is appearing above its recent baseline, particularly where support and maintenance has 67 notices, 174% above its 12-week average of 24.4, and licences and SaaS has 104 notices, 121% above 47.1.
The contrary signal is Check Point: 3 notices, a fall of 3% against its 12-week average of 3.1. That is a potential displacement story, albeit a small one. Sophos has 3 notices, F5 3, IBM Cloud 3, Oracle 3 and Forcepoint 2; no delta is reported for those vendors. Fortinet's 13 named notices make CONSIP SPA's €30.24 million security-software framework a procurement to qualify for, but the tender record does not identify a supplier, so it is not evidence of Fortinet participation. Cisco's pattern is more directly visible at ČD - Telematika, which has a Cisco network-security support tender among its 2 notices; Národní agentura pro komunikační a informační technologie has 5 tenders, including DCeGOV Anti-DDoS.
Vendors named in this window’s tenders
Notices naming each vendor, with movement against the same vertical’s 12-week average.
Who is buying repeatedly
| Tenders | Buyer | Country | Example |
|---|---|---|---|
| 5 | Národní agentura pro komunikační a informační technologie, s. p. | CZ | Czechia – Information technology services – DCeGOV - Anti-DDoS |
| 4 | Bank Gospodarstwa Krajowego | PL | Poland – Computer equipment and supplies – Dostawa, wdrożenie i konfiguracja infrastruktury firewall typu Next |
| 3 | Dirección General de Racionalización y Centralización de la Contratación-Junta de Contratación Centralizada | ES | Spain – Computer equipment and supplies – 2026/Sp02002001/00001648E - Adquisición De Equipos De Infraestructur |
| 3 | European Cybersecurity Industrial, Technology and Research Competence Centre | RO | Romania, Belgium – Software programming and consultancy services – ENSOC Cross border SOCs platform |
| 2 | ČD - Telematika a.s. | CZ | Czechia – Maintenance and repair of data network equipment – Zajištění servisní podpory pro síťová bezpečnostn |
| 2 | Державний центр кіберзахисту Державної служби спеціального зв’язку та захисту інформації України | UA | Послуги з реєстрації індивідуальних цифрових підписів Wildcard SSL сертифікатів з валідацією домену |
| 2 | ZAKŁAD GOSPODARKI KOMUNALNEJ | PL | Poland – Servers – Dostawa i wdrożenie oprogramowania wraz ze sprzętem w ramach realizacji projektu "Cyberbezp |
| 2 | Zakład Usług Komunalnych Sp. z o.o. | PL | „Dostawa sprzętu i oprogramowania w ramach projektu „Cyberbezpieczne Wodociągi” |
An organisation running several tenders in one window is usually working through a programme rather than buying once.
The biggest tenders
The listed deal values cover only the 125 notices that published a value in EUR, not the size of the market. Beyond the Slovak ministry's €124.5 million licence procurement and MD-IT's €88 million hospital-AI framework, CONSIP SPA has a €30.24 million framework for protection and resilience of networks and information systems for Italian public administrations. EirGrid plc is listed twice at €18 million for a telecoms consultancy, network support, asset-management and devices framework that supports its offshore digital systems and data platforms. These are account-led pursuits: each buyer is buying an operating environment and associated services, not merely a product catalogue.
Values as published by the buyer, for the 125 of 320 tenders in this window that stated one in EUR.
Deadlines worth watching
Who won
Suppliers with the most awards this window
Awards published in the window, by named winner.
Sources consulted
Pages the writer read for context while drafting this column. The figures above come from the notices, not from these.
Prioritise Polish qualification routes and the German quality case now, while mapping named-stack displacement around Check Point and the framework entry points at MD-IT, CONSIP and EirGrid before the current share uplift becomes a crowded pursuit.
Method
Built from 320 public procurement notices published between 2026-10-26 and 2026-11-02, classified into the Cybersecurity vertical. Every figure on this page is computed from those notices; the commentary is written around them. Sources: bzp, doe, ted, iub_lv, cvpis_lt, prozorro, sicap_ro. Tenders featured in earlier editions of this column are excluded from the named lists above.
Frequently Asked Questions
How active was the cybersecurity procurement window?
320 notices, 278 buyers, 30 countries and 173 notices with an open deadline.
What is cybersecurity's current procurement share?
7.72%, with a coverage-neutral change of 0.15 points.
Where is bid competition highest and lowest?
France averages 6 bids, Germany 5.4, Poland 2.1 and Ukraine 1.
