Framework Conditions: Procurement Law, IT Security Act & More

Energy suppliers are usually public or sector contracting authorities and are therefore fully anchored in public procurement law. Tenders above a threshold value of around €430,000 must be carried out throughout the EU – completely electronically, audit-proof and transparent.

In addition, there are requirements from the IT Security Act 2.0 (IT-SiG), the General Data Protection Regulation (GDPR), the German Energy Industry Act (EnWG), the German Supply Chain Duty of Care Act (Lieferkettensorgfaltspflichtengesetz) and industry-specific security standards (e.g. ISO/IEC 27001).

Consequence for purchasing:
Only certified, trustworthy providers are considered. Compliance is an obligation, but also an opportunity – for more standardization and risk minimization.

Best Practices from the Industry

Proven approaches for smart IT purchasing

In view of the hurdles posed by public procurement law and the like, energy companies need well thought-out strategies in order to organize their IT purchasing effectively. The following approaches have proven themselves in practice:

Central procurement offices and cooperations:

Instead of letting each specialist department or subsidiary handle procurement on its own, it makes sense to pool purchasing expertise. By doing so, organizations can reduce redundancy and increase efficiency. As a result, many utilities have established central IT purchasing teams. These teams manage tenders professionally and consolidate knowledge related to procurement law.

Alternatively, several municipal utilities can join forces to form purchasing cooperatives. A well-known example is the Thüga network. In such cooperatives, members gain greater market power and can promote standardization more effectively.

Ideally, framework agreements for hardware, software, or IT services are negotiated centrally. Once established, these agreements can be accessed by all participants. This approach significantly reduces administrative effort. It also avoids duplication of work and ensures that all contracts remain legally compliant.

Moreover, the Thüga example demonstrates another key benefit: when technical requirements are standardized—such as through uniform specifications for network technology—joint tenders become much easier to conduct. This leads to smoother collaboration and better outcomes across the board.

Use of framework agreements and new forms of awarding contracts:

Framework agreements are explicitly allowed under public procurement law. They have also proven to be highly effective in IT sourcing. For example, energy providers can enter into long-term EVB-IT framework agreements with IT service providers. These agreements can cover a wide range of services or licenses.

The main advantage is clear: individual orders can be placed under this agreement without launching a new tender process. To ensure maximum flexibility, the framework should be designed broadly. It should include modules for software, hardware, cloud services, and other relevant components. Furthermore, an EU-wide tender process helps maintain competitive fairness while ensuring compliance with legal requirements.

In addition to these traditional frameworks, newer procurement models are gaining importance. One such model is the Dynamic Purchasing System (DPS). This is an electronic vendor list used for recurring purchases. It is especially useful for standardized goods and services, as it simplifies supplier access and speeds up ordering.

However, for more complex IT projects—where solutions are developed jointly with vendors—the Competitive Dialogue procedure is often more appropriate. It allows for more interaction between buyer and supplier. Regulated buyers should therefore assess whether such approaches offer more agility. This is particularly relevant in innovation-driven fields like smart grids, IoT, or AI applications.

In such cases, the Innovation Partnership model might be a suitable option. It allows buyers and suppliers to collaboratively develop tailored solutions from the ground up. This helps foster innovation while maintaining legal safeguards.

Despite the formal structure of procurement law, there is still room for strategic flexibility. For instance, contracting authorities in the utility sectors—such as energy, water, or transport—may, under certain conditions, use negotiated procedures more frequently. As a result, they gain the ability to refine requirements during the process and better respond to new or changing needs.

Streamlining Procurement with Built-In Compliance

An efficient procurement function also means keeping internal workflows lean while maintaining full compliance. In IT procurement, Lean Procurement can take the form of early demand planning and bundling, automated approval workflows, and the use of standardized templates. For example, Stadtwerke Köln (Cologne’s municipal utility) has set internal procurement principles that strictly require all tenders to follow applicable laws (such as GWB, SektVO, and VgV). These rules are reinforced by clearly defined workflows and checklists.

Successful organizations embed a compliance loop directly into the procurement process—for instance, using automated checks to prevent purchases without an approved budget or a valid contract.

Training is also essential: procurement staff and internal requesters need to be well-versed in procurement law and IT security. Some energy providers offer regular training sessions or turn to external support resources, such as KOINNO (the German Competence Center for Innovative Procurement).

Thüga, a leading network of municipal utilities, takes things a step further with its “Sustainable Procurement Network”— a modular workshop format designed to help partner companies translate legal and sustainability requirements into practice, including adapting to new procurement regulations.

In short: Built-in compliance is the foundation of next-generation IT sourcing for utilities—ensuring legal certainty and digital efficiency from day one.

Engaging IT and Business Stakeholders Early

Strategically successful IT procurement means working on an interdisciplinary basis. IT managers, specialist departments and procurement should work closely together to ensure that requirements are clear and realistic. Agile companies integrate procurement right from the planning phase of IT projects (“early procurement involvement”).

In this way, security requirements or data protection clauses, for example, can be incorporated directly into the service description. Procurement errors can also be avoided (e.g. tendering without market requirements).

In practice, it is worth forming product or product group-specific teams (category management): For the “Software & Licenses” area, for example, there is then a core team consisting of a purchaser, IT architect, lawyer and specialist user who jointly prepare tenders and select suppliers. Such models ensure that economic, technical and legal aspects are considered simultaneously – and increase the quality of the award decision.

These examples impressively demonstrate how smart IT procurement works in practice in the energy sector – efficient, compliant and future-proof.

Use of technology: the future is digital

Digital platforms and AI-supported solutions are key components for smart IT procurement in the energy sector – especially for complex tenders.

E-tendering platforms
DTVP or cosinex are both an obligation and an opportunity. They enable transparent, end-to-end digital tendering procedures.

Source-to-contract and P2P systems
SAP Ariba, Ivalua & Co. automate everything from the notification of requirements to payment – with ERP integration, auditability and spend analytics.

Compliance tools
New tools such as the digital EVB-IT contract module or automatic sanctions list checks make everyday life easier and minimize risks.

Artificial intelligence and RPA
AI identifies suitable suppliers, automates routine tasks and supports risk assessment. Chatbots and digital assistants relieve the burden on buyers.

Agility in purchasing – here’s how it works

The IT departments of many energy suppliers are already working with agile methods (DevOps, scrum teams, etc.), but purchasing has long lagged behind . Rigid purchasing processes – with detailed specifications, long decision-making processes and complex contractual conditions – often no longer fit in with dynamic IT projects.

The result: delays, higher costs and missed opportunities for innovation. A cultural change is needed to transform procurement from a bottleneck to an enabler. Here are some recommendations on how agile procurement can also succeed in traditional structures:

Agile mindset and team setup:

Agility starts in the mind. Buyers should be prepared to leave old paths and managers must give their teams more trust and decision-making freedom. Rigid hierarchies are being replaced by small, self-organized teams with clear responsibilities. One example is the introduction of Scrum in purchasing: purchasing teams define short-term goals in sprints (e.g. complete market analysis and RFP draft in 2 weeks) and meet briefly every day to compare notes. This iterative approach promotes the ability to react to changes.

It is important that all relevant departments (IT, specialist department, purchasing) work closely together in the project – ideally, an interdisciplinary team sits at one table. This requires trust in the employees: “Trust in your own employees is a key factor. Employees who are allowed to organize themselves independently are important for agility in procurement.”

The same applies: Keep it short and simple (KISS) – processes and communication in procurement should be kept as simple as possible. Unnecessary bureaucracy is poison for agility.

Focus on skills instead of specifications:

Traditional procurement procedures often specify in great detail what exactly needs to be delivered. In contrast, agile procurement turns this approach on its head: it begins with the question, “What problem do we want to solve, and what skills or solutions do we need to solve it?” Rather than throwing a fully specified requirement document over the fence, needs are instead defined progressively and iteratively.

In this context, a two-stage approach often proves beneficial. First, it is important to identify a partner who brings the necessary expertise—such as cloud proficiency or cybersecurity know-how. Then, in close collaboration with this partner, the exact solution is jointly developed. As Kienbaum puts it, instead of purchasing predefined end products, the focus is increasingly on “purchasing the right skills.”

In practical terms, this means, for example, entering into a framework agreement with a software development service provider that supports agile development. This approach avoids the need to define a finished software product from the outset. Consequently, the solution can be shaped flexibly during the course of the project, without triggering new tenders.

Iterative tendering and contract models:

Agile approaches can also be implemented within the framework of procurement law. For example, milestones can be integrated into contracts and then reprioritized after the completion of each milestone. In this way, agile principles can be aligned with legal requirements.

Moreover, for larger IT projects—such as the introduction of an ERP system—individual parts of the project can be awarded as separate lots or phases. This allows for the option to proceed with subsequent phases only after the successful completion of the initial phase. As a result, risk can be reduced, while still maintaining strategic control over the broader project.

Public sector clients, in particular, are increasingly relying on framework contracts to enable this type of agile procurement. Typically, this involves first selecting a service provider through a competitive process and then issuing successive agile work packages as needed. In doing so, they remain compliant with the legal structure required by procurement law, while simultaneously gaining a much higher degree of flexibility in implementation.

In addition, it is crucial to manage expectations internally. Agile procurement implies that requirements may evolve during the course of the project. Therefore, close coordination with controlling and management is essential. Change management also plays a critical role in this context: the organization must gradually learn to cope with a certain degree of uncertainty in exchange for enhanced innovative capacity. By doing so, it creates the conditions necessary for adaptive and forward-looking project work.

Quick decisions and short feedback cycles:

In agile projects, procurement must be able to react quickly – be it renegotiating the scope of a contract or approving the budget for an additional sprint. It is therefore helpful to delegate decision-making powers.

For example, the IT purchasing manager can be given limited powers to approve additional services up to X amount within a framework contract without having to contact the management board every time. At the same time, suppliers should receive regular feedback. Daily or weekly coordination between purchasing and suppliers (possibly in the form of stand-up meetings) ensures clarity and quick problem-solving.

Agile purchasing measures its success not only by the amount of savings, but also by the satisfaction of internal customers (specialist departments). Short surveys at the end of a procurement project (“Was the delivered system fit for purpose? How do the users rate the process?”) help to continuously improve.

Experimentation and further training:

Agility inherently requires a certain amount of trial and error. Therefore, energy companies can begin by defining pilot projects specifically designed to explore agile procurement. For instance, they might initially test the procurement of new software using a simplified, dialogue-oriented procedure. This experimental approach allows them to gather valuable lessons learned, which can then be applied to inform broader, more complex market engagements.

At the same time, it is equally important to ensure that procurement teams are well-prepared for this shift. Accordingly, buyers should receive training in relevant methodologies—such as design thinking, agile project management, and advanced negotiation techniques—in order to navigate the new setup with confidence and competence.

Furthermore, exchanging experiences with peers is crucial for generating fresh insights. Participating in industry conferences or specialized formats such as KOINNO workshops, for example, can offer valuable perspectives and inspiration. In Switzerland, for instance, ongoing discussions are exploring the extent to which “agile procurement of agile projects” is feasible under the revised procurement legislation. Such external impulses can, in turn, help organizations to better understand and expand their own room for maneuver within the legal framework.

Conclusion: How IT purchasing becomes a success factor