Short answer
EU procurement law permits social, climate, cybersecurity and resilience objectives, but the authority must translate the policy objective into a requirement connected to the contract. Selection conditions must concern the operator's capacity and be proportionate. Technical specifications must allow equal access and avoid unjustified obstacles. Award criteria must be linked to the contract's subject matter, disclosed with their weighting, objectively scorable and verifiable. Performance conditions must also be linked and announced in advance.
Requirements should describe the outcome or risk to be controlled—emissions, labour conditions for contract workers, recovery time, vulnerability handling, data access, delivery continuity—rather than favouring a local supplier, particular label, proprietary technology or general corporate policy. Equivalent evidence and solutions normally must be accepted.
Data localisation deserves special caution. The GDPR regulates international transfers but does not generally require personal data to remain in one Member State or the EU. For non-personal data, Regulation 2018/1807 generally prohibits Member State localisation requirements unless justified by public security and proportionate. A location restriction therefore needs a contract-specific legal basis and necessity assessment.
Start by choosing the correct procurement mechanism
Directive 2014/24/EU offers different legal tools for different purposes:
- exclusion addresses the grounds in Articles 57 and 18(2), including specified environmental, social or labour-law violations;
- selection criteria under Article 58 test professional suitability and technical, professional or financial capacity;
- technical specifications under Article 42 define the required work, service or product;
- award criteria under Article 67 compare the value of compliant tenders;
- life-cycle costing under Article 68 can price specified environmental externalities; and
- performance conditions under Article 70 regulate how the successful tenderer performs the contract.
Putting a policy in the wrong category creates risk. A buyer cannot score general environmental reputation as contract performance or use an award criterion as an undisclosed minimum. Mandatory conditions, scoring, weights and acceptable proof belong in the documents at the proper stage.
The common legal tests
Article 18 requires equal treatment, non-discrimination, transparency and proportionality. Article 42 adds that specifications must give equal access and must not create unjustified obstacles to competition. References to a particular make, source, origin or process are exceptional and normally require “or equivalent”.
Article 67 permits qualitative, environmental and social award criteria where they are linked to the subject matter. The link can concern any stage of the work's, service's or product's life cycle, even if the characteristic is not physically visible in the final item. The criterion cannot give unrestricted discretion; it must enable effective competition and effective verification.
In Concordia Bus, lower emissions and noise were lawful considerations for a bus-services contract. The Court's formulation remains a useful design test:
Environmental criteria must be linked, disclosed, non-discriminatory and leave no “unrestricted freedom of choice”. —
Social and labour requirements
Social objectives can concern accessibility, fair-trade production, employment of disadvantaged people, or conditions for workers performing the contract. Article 18(2) requires Member States to ensure compliance during performance with applicable environmental, social and labour obligations identified by EU, national, collective-agreement and Annex X international law.
In RegioPost, a disclosed obligation to pay a legally prescribed minimum wage to staff performing the public contract was a permissible social performance condition. The link to actual contract workers mattered. A demand that the supplier adopt an unrelated company-wide employment policy would ordinarily fall outside Article 70's subject-matter link.
The documents should identify the workers, supply-chain stage, applicable obligation, evidence and proportionate consequence of breach. Local-law conditions cannot be extended extraterritorially without support in the applicable EU labour framework.
Climate and environmental criteria
Authorities may specify emissions limits, energy efficiency, recycled content, repairability, renewable electricity, pollution controls or life-cycle greenhouse-gas cost. They should use measurable functional outcomes and a disclosed methodology. Article 68 requires objective, non-discriminatory, accessible and verifiable life-cycle data methods.
In EVN and Wienstrom, renewable electricity could carry significant award weight, but the criterion failed where the information was not effectively verifiable and rewarded supply capacity beyond the contract's expected consumption.
An award criterion without requirements allowing effective verification is contrary to EU procurement principles. —
The criterion should measure the tendered delivery, not unrelated sales or the bidder's entire business.
Labels and certifications are evidence, not a closed club
Article 43 permits a label where its requirements concern the contract, rest on objectively verifiable and non-discriminatory criteria, were adopted transparently, are accessible, and were set by an independent body. The authority must accept labels proving equivalent requirements and, in defined circumstances, other appropriate evidence.
Commission v Netherlands (Max Havelaar) illustrates the distinction. A buyer may pursue organic or fair-trade characteristics, but it cannot merely award points for named labels without publishing their underlying criteria and accepting proof by appropriate means. The same logic applies to social audits, carbon labels and cybersecurity certificates.
Cybersecurity requirements should follow the actual risk
A public buyer can require access control, encryption, patching, vulnerability handling, logging, incident reporting, continuity, recovery or secure-development evidence. Assurance should match the service's sensitivity and criticality.
NIS2 Article 21 supplies a useful risk-management baseline where the authority or service is within scope, including continuity, supply-chain security, secure development and access control. It is not a licence to copy every control into every tender.
The Cybersecurity Act, amended by Regulation 2025/37, provides European certification schemes and basic, substantial and high assurance levels. Certification remains voluntary unless applicable law makes it mandatory. A named certificate must respect Article 43 and equivalent-proof requirements; its assurance level must match risk.
Data location is not a shortcut for data security
The authority should separate four questions: where data is stored, from where it can be remotely accessed, which law governs the provider, and whether personal data is transferred internationally. These are not interchangeable.
GDPR Chapter V permits third-country transfers through adequacy decisions, appropriate safeguards or narrow derogations. It does not create a general EU-only storage rule. Article 4 of Regulation 2018/1807 separately prohibits public-sector localisation requirements for non-personal data unless proportionate on public-security grounds; for mixed datasets, that rule applies to the non-personal part. The Data Act requires data-processing providers to safeguard non-personal data against unlawful third-country governmental access, another reason not to equate security automatically with storage location.
If location remains necessary—for classified information, a sector rule or a demonstrated public-security risk—the documents should define the relevant data, locations, access paths and evidence precisely. The restriction must not extend to harmless data or processing stages without justification.
Supply-chain resilience requires objective triggers
Resilience can be protected through multi-sourcing, inventory, substitutability, delivery commitments, component transparency and contingency plans. For EU and treaty-covered bidders, a generic ownership or origin preference is not a substitute for objective controls.
Operators from third countries without reciprocal procurement agreements occupy a different position. In Kolin and Qingdao Sifang, the Court held that they have no Directive-based right to equal treatment; however, Member States cannot enact their own general access regime because common commercial policy is an exclusive EU competence. Buyers must therefore distinguish lawful contract-level treatment and applicable EU instruments from an improvised national origin policy.
Specific EU legislation may mandate origin-sensitive measures. Article 25 of the Net-Zero Industry Act requires sustainability conditions for covered net-zero procurements and, following Commission concentration determinations, resilience limits concerning supply from an identified third country. Implementing Regulation 2025/1178 identifies relevant products and components. For procedures launched from 30 June 2026, Implementing Regulation 2026/718 requires at least 70% recyclability for covered onshore and offshore wind-turbine blades. The regime preserves international commitments and includes technical-incompatibility and disproportionate-cost safeguards.
The authority should document whether the instrument applies, the relevant Commission determination, treaty coverage, component calculation and exception. It should not extend a sector-specific resilience rule to unrelated procurements by analogy.
A defensible design process
- Define the operational risk and connect each criterion to the procured output or life cycle.
- Choose selection, specification, award or performance treatment deliberately.
- State minimums, scoring, weights, proof and monitoring in advance.
- Accept equivalent solutions and evidence where EU law requires it.
- Record competitive effects, necessity and less restrictive alternatives.
- Apply sector-specific rules and enforce the disclosed verification consistently.
Conclusion
Strategic procurement is lawful when policy becomes a contract-specific, disclosed and verifiable requirement. It cannot disguise local preference, unverifiable aspiration or unrestricted discretion.
The safest design starts with the risk and desired performance, accepts equivalent ways to prove it, and preserves genuine competition. Data-location and origin restrictions require the strongest justification and should be used only where targeted controls or specific EU legislation do not provide a less restrictive answer.
Sources
- , and its
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.