Kybernetická bezpečnost může ospravedlnit přísnější zadávací podmínky

The Chairman of the Office for the Protection of Competition (ÚOHS) upheld decision No. ÚOHS-S1002/2025/VZ, according to which stricter conditions in public procurement procedures do not necessarily constitute an unlawful restriction of competition, provided they are based on legitimate security grounds. The case concerned a public contract of the Czech Statistical Office for backbone switches. The contracting authority required, inter alia, the delivery of new and original hardware intended directly for it as the end user, the supplier’s involvement in the manufacturer’s authorized distribution chain, and the provision of long-term service support guaranteed by the manufacturer or its authorized service partner.

ÚOHS considered these requirements proportionate, particularly in light of the new cybersecurity legislation effective from November 2025. The contracting authority operates critical information systems and, as a provider of regulated services subject to a higher level of obligations, must actively manage supply chain security. In this context, it is, according to ÚOHS, legitimate to require greater control over the origin of equipment, the range of suppliers, and the provision of support throughout the product life cycle.

The decision also confirms an important practical conclusion that the mere limitation of the number of potential suppliers does not in itself constitute a breach of the law. The key question is whether the contracting authority has objective and sufficiently strong reasons for such limitation and whether the measures are proportionate to the pursued objective. In this case, ÚOHS stated that the contracting authority did not restrict competition to a specific manufacturer, but only to suppliers involved in official distribution networks. ÚOHS assessed this restriction as a proportionate limitation of competition.

The relationship to earlier case law, which criticized requirements dependent solely on confirmation by the manufacturer, is also noteworthy. ÚOHS explained that the current case differs from such precedents. It does not concern proof of a factual situation without alternatives, but rather the establishment of a controllable supply chain in an environment of increased security risks. The shift in both regulatory requirements and actual cyber threats thus plays a significant role.

For contracting authorities, the decision implies that, if properly justified, they may set relatively strict technical or contractual conditions reflecting their specific obligations and risks. Conversely, suppliers should take into account that general arguments regarding restriction of competition, without demonstrating a specific impact on their position, will typically no longer be sufficient.

These conclusions may also be relevant for other contracting authorities subject to the Act on the Resilience of Critical Infrastructure Entities.

Authors:

Jan Turek

Jonáš Kozák

Matěj Šimpach