Regulation 22 – Rules applicable to communication

Commentary

Regulation 22 deals with the rules applicable to communication and transposes the requirements of Article 22 of Directive 2014/24/EU. It introduces important novelties in terms of electronic communications and includes specific safeguards intended to prevent technological exclusion and gold-plating. 

In general, these new rules mandate the use of electronic procurement from end to end. The rules cover both communications and file standards, making them a lot more detailed and prescriptive than what could be found in Directive 2004/18/EC.

The adoption of end to end electronic procurement has the potential of reducing transaction costs for both contracting authorities and economic operators. The purpose of Regulation 22 is to level the playing field by reducing the disadvantage suffered by smaller operators and eventually enhancing the attractiveness of cross-border procurement.

General rules applicable to communication

Regulation 22(1) establishes that all communications shall be performed using electronic means of communication in accordance with the requirements of that regulation. 

However, this general rule is riddled with exceptions that allow contracting authorities not to require the use of electronic means of communication, such as:

1  Specific circumstances foreseen in Regulation 22(3), where it is accepted that the use of electronic means of communication would be either impracticable or counterproductive from a technical perspective, such as where : (a) due to the specialised nature of the procurement, the use of electronic means of communication would require specific tools, devices or file formats that are not generally available or supported by generally available applications; (b) the applications supporting file formats that are suitable for the description of the tenders use file formats that cannot be handled by any other open or generally available applications or are under a proprietary licensing scheme and cannot be made available for downloading or remote use by the contracting authority; (c) the use of electronic means of communication would require specialised office equipment that is not generally available to contracting authorities; or (d) the procurement documents require the submission of physical or scale models which cannot be transmitted using electronic means.

2 Specific circumstances established in Regulation 22(5), where the use of means of communication other than electronic means is necessary either (a) because of a breach of security of the electronic means of communication, or (b) for the protection of information of a particularly sensitive nature requiring such a high level of protection that it cannot be properly ensured by using electronic tools and devices that are either generally available to economic operators or can be made available to them by alternative means of access as set by Regulation 22(14).

In the first case, the exceptions under Regulation 22(3) are complemented with two additional rules. On the one hand, as per Regulation 22(6), where contracting authorities require other than electronic means of communication  in the submission process, they shall indicate in a Regulation 84(1) report the reasons for that requirement. This suggests that contracting authorities do not have a fully-free choice and, in any case, such decision is open to judicial review.

And, on the other hand, the exception must not be understood as an all or nothing concerning electronic means of communication, since Regulation 22(4) determines that where those are not used, communication shall be carried out by post or by other suitable carrier, or by a combination thereof. Consequently, under proportionality, the limitation of use of electronic communication means should only be completely excluded where they are absolutely unfit for a specific (and probably rather out of the ordinary) procurement process.

Regulation 22 establishes two general requirements in the management of electronic communications that are worth stressing. First, as per paragraph 11 contracting authorities shall ensure that the integrity of data and the confidentiality of tenders and requests to participate are preserved in all communication, exchange and storage of information. This should be put in relation to Regulation 21 on confidentiality. In our view, the difficulty with this rule is that it seems to impose an objective obligation on contracting authorities (“shall ensure“) rather than a best effort/reasonable means obligation, which can trigger important issues of liability in tort should the confidentiality of communications be jeopardised (or hacked) at any specific point in time. This appears to be a significant (if underplayed) risk for the contracting authority. In our view, a consequence of this paragraph (11) is that contracting authorities should refrain from using e-mail as a communication tool and should invest in more robust communication technologies directly connected to the platform used for managing the procedure.

Consequently, a clarification on the level of liability imposed on the contracting authorities would reduce their incentives to resort to the exceptions under Regulation 22(5). On that note, it is important to stress that, however, contracting authorities do not seem to have a fully-free choice, as Regulation 22(7) clearly sets out that they shall indicate in the report demanded by Regulation 84(1) the reasons why the use of means of communication other than electronic means has been considered necessary. Again we feel this decision is open to judicial review.

Secondly, in order to avoid an important issue of time advantages or time shifting, Regulation 22(12) clarifies that contracting authorities shall examine the content of tenders and requests to participate only after the time limit set for submitting them has expired. This will require the implementation of additional security measures that allow for a time-related (and manipulation-related) audit of the procurement process.

Regulation 22 imposes technical neutrality in order to avoid technological barriers derived from the use of electronic communications. Regulation 22(2) determines that the tools and devices to be used and their technical characteristics shall be non-discriminatory, generally available and interoperable with the information and communication technology products in general use and shall not restrict economic operators’ access to the procurement procedure. For some previous discussion, see M Varney, ‘E-Procurement—current law and future challenges’ (2011) 12(2) ERA Forum 185–204.

This comes to set a requirement of technical neutrality that must be welcome in general terms. The only exception to this rule  is established in Regulation 22(13), which allows contracting authorities to require the use of tools and devices which are not generally available provided they offer suitable alternative means of access.

Oral communications

Regulation 22(8) to (10) deal with the novelty of an (express) authorisation to engage in oral communications, which may have been particularly geared to accommodate the practical requirements of the conduct of negotiations. Paragraph (8) establishes the authorisation, which covers communications other than those concerning the essential elements of a procurement procedure, provided that the content of the oral communication is documented to a sufficient degree, something that may be difficult to achieve in practice. Regulation 22(9) then determines what is not an essential element of the procedure, or rectius, indicates that the essential elements of a procurement procedure include the procurement documents, requests to participate, confirmations of interest and tenders. Regulation 22(10) also makes the record-creation and record-keeping requirements more specific by stressing that oral communications with tenderers which could have a substantial impact on the content and assessment of the tenders shall be documented to a sufficient extent and by appropriate means, such as written or audio records or summaries of the main elements of the communication.

Looking at the provisions as a whole, we struggle to see how oral communications can actually be used properly. There are certain things that should not be done orally, such as providing clarification on the tender documents or requirements, or accepting clarifications on the documents or tenders submitted by bidders. Equally, it is hard to see how negotiation can be carried out orally when, under Regulation 22(9), the tenders themselves are an essential element of the procedure on which oral communications are not allowed. Of course, this does not square with the rule in paragraph 10, which aims to set a minimum threshold (or expectation) of record-creation when negotiations are conducted if they could have a substantial impact on the content and assessment of the tenders. All in all, we find this set of rules very confusing and internally contradictory, and strongly suggest contracting authorities from refraining to use oral communications.

Use of tools and devices not generally available

Regulation 22(13) to (15) deal with the issue of means of electronic communication not generally available and builds an exception to the general rule established by Regulation 22(2). In order to allow contracting authorities to require the use of tools and devices which are not generally available, the regulation demands that  the contracting authorities offer suitable alternative means of access.

Said alternative means are then further specified in paragraph 14, which offers three alternative ways of ensuring alternative access: (a) offer unrestricted and full direct access free of charge by electronic means to the tools and devices concerned from the date of publication of the call for competition or from the date when the invitation to confirm interest is sent, in which case the further rules of paragraph (15) need to be respected; (b) ensure that tenderers having no access to the tools and devices concerned, or no possibility of obtaining them within the relevant time limits, provided that the lack of access is not attributable to the tenderer concerned, may access the procurement procedure through the use of provisional tokens made available free of charge online; or (c) support an alternative channel for electronic submission of tenders.

Given that the last option is the only one likely not to impose a cost on the contracting authority and given that it avoids having to enter into the licences and authorisations that one would expect under options (a) and (b), our view is that most contracting authorities that insist on the use of means of communication not generally available will also end up supporting an alternative channel for electronic submission of tenders. This creates the same difficulties that we witnessed in the past (only?) regarding technical specifications set according to standards and the mandatory requirement to accept functionally equivalent solutions. Moreover, this creates significant issues of justification of the use of not generally available means of communication. If the alternative channels (supported or otherwise) work, what is the reason not to use them? Consequently, this is another area where the set of rules does not seem to make much internal sense and the availability of funds to sponsor use of not generally available means of communication (or its lack) may end up deactivating the provision in any case.

Technical requirements, security requirements and electronic signatures

Paragraphs (16) to (21) set out rather precise requirements concerning the technical and security-related features of the electronic means of communication to be used, as well as specific rules concerning the use of electronic signatures. It should be said that in this day and age of easy, accessible hacking, end-to-end encryption “advanced electronic signatures” should be mandatory. Any public procurement communication without them should fail all and every risk assessment although we do not see the point of having the assessment on the first place. All unencrypted communications immediately risk confidential information from tenderers being accessed by third parties. Regular email will simply not comply with most of the requirements set on these paragraphs (ie, restricted access, time-stamping and encryption, electronic signatures).

The final paragraph of Regulation 22 establishes the rules for electronic signatures, namely the need to comply with certain standards set out in Article 1(2) of Commission Decision 2011/130/EU and how contracting authorities much ensure economic operators can have generate the certificates that constitute the electronic signatures.

The technicalities may create implementation issues, but these requirements seem relatively uncomplicated from a purely legal perspective. It is worth stressing that in determining the security level applicable to the electronic communications, contracting authorities are required to consider the need for proportionality between the expected benefits of any particular security requirements and the costs, burdens and obligations which those requirements may impose on economic operators. This seems like a reasonable requirement but, once more, effectively putting it in practice may be complicated, particularly if judicial review of that type of decision is based on a formal assessment of the contracting authority’s decision.

Last modified: July 5, 2016 by Pedro Telles

General principles about the use of electronic and non-electronic means of communication

22.—(1) Subject to paragraphs (3), (5), (8) and (10), all communication and information exchange under this Part, including electronic submission, shall be performed using electronic means of communication in accordance with the requirements of this regulation.

(2) Subject to paragraph (13), the tools and devices to be used for communicating by electronic means, and their technical characteristics, shall be non-discriminatory, generally available and interoperable with the information and communication technology products in general use and shall not restrict economic operators’ access to the procurement procedure.

(3) Contracting authorities are not obliged to require electronic means of communication in the submission process in the following situations:—

(a) due to the specialised nature of the procurement, the use of electronic means of communication would require specific tools, devices or file formats that are not generally available or supported by generally available applications;

(b) the applications supporting file formats that are suitable for the description of the tenders use file formats that cannot be handled by any other open or generally available applications or are under a proprietary licensing scheme and cannot be made available for downloading or remote use by the contracting authority;

(c) the use of electronic means of communication would require specialised office equipment that is not generally available to contracting authorities; or

(d) the procurement documents require the submission of physical or scale models which cannot be transmitted using electronic means.

(4) Where, in accordance with paragraph (3), electronic means of communication are not used, communication shall be carried out—

(a) by post or by other suitable carrier, or

(b) by a combination of post or other suitable carrier and electronic means.

(5) Contracting authorities are not obliged to require electronic means of communication in the submission process to the extent that the use of means of communication other than electronic means is necessary either—

(a) because of a breach of security of the electronic means of communication, or

(b) for the protection of information of a particularly sensitive nature requiring such a high level of protection that it cannot be properly ensured by using electronic tools and devices that are either generally available to economic operators or can be made available to them by alternative means of access within the meaning of paragraph (14).

(6) Where contracting authorities require, in accordance with paragraph (3), means of communication other than electronic means in the submission process, they shall indicate in the report referred to in regulation 84(1) the reasons for that requirement.

(7) Where applicable, contracting authorities shall indicate in that report the reasons why use of means of communication other than electronic means has been considered necessary in accordance with paragraph (5).

(8) Oral communication may be used in respect of communications other than those concerning the essential elements of a procurement procedure, provided that the content of the oral communication is documented to a sufficient degree.

(9) For that purpose, the essential elements of a procurement procedure include the procurement documents, requests to participate, confirmations of interest and tenders.

(10) In particular, oral communications with tenderers which could have a substantial impact on the content and assessment of the tenders shall be documented to a sufficient extent and by appropriate means, such as written or audio records or summaries of the main elements of the communication.

(11) In all communication, exchange and storage of information, contracting authorities shall ensure that the integrity of data and the confidentiality of tenders and requests to participate are preserved.

(12) Contracting authorities shall examine the content of tenders and requests to participate only after the time limit set for submitting them has expired.

Use of tools and devices not generally available

(13) Contracting authorities may, where necessary, require the use of tools and devices which are not generally available, provided that the contracting authorities offer suitable alternative means of access.

(14) Contracting authorities shall be deemed to offer suitable alternative means of access where they do any of the following:—

(a) offer unrestricted and full direct access free of charge by electronic means to the tools and devices concerned from the date of publication of the call for competition or from the date when the invitation to confirm interest is sent;

(b) ensure that tenderers having no access to the tools and devices concerned, or no possibility of obtaining them within the relevant time limits, provided that the lack of access is not attributable to the tenderer concerned, may access the procurement procedure through the use of provisional tokens made available free of charge online; or

(c) support an alternative channel for electronic submission of tenders.

(15) For the purposes of paragraph (14)(a)—

(a) publication of the call for competition” means whichever of the following is relevant (and where both are relevant, the earliest of them):—

(i) its publication in the Official Journal after being sent in accordance with regulation 51;

(ii) its publication on a buyer profile in accordance with regulation 52; and

(b) the text of the call for competition notice or the invitation to confirm interest shall specify the internet address at which the tools and devices are accessible.

Technical etc requirements for tools and devices

(16) Tools and devices for the electronic receipt of tenders, requests to participate and, in design contests, plans and projects, must at least guarantee, through technical means and appropriate procedures, that—

(a) the exact time and date of the receipt of tenders, requests to participate and the submission of plans and projects can be determined precisely;

(b) it may be reasonably ensured that, before the time referred to in paragraph (12), no-one can have access to data transmitted under the requirements in this paragraph;

(c) only authorised persons may set or change the dates for opening data received;

(d) during the different stages of the procurement procedure, access to all data submitted, or to part of such data, must be possible only for authorised persons;

(e) only authorised persons may give access to data transmitted and only after the time referred to in paragraph (12);

(f) data received and opened in accordance with the requirements in sub-paragraphs (a) to (e) must remain accessible only to persons authorised to acquaint themselves with the data;

(g) it must be reasonably ensured that any infringement, or attempted infringement, of the access prohibitions or conditions referred to in sub-paragraphs (b) to (f) are clearly detectable.

(17) In addition to those requirements, the following rules apply to tools and devices for the electronic transmission and receipt of tenders and for the electronic receipt of requests to participate:—

(a) information on specifications for the electronic submission of tenders and requests to participate, including encryption and time-stamping, shall be available to interested parties;

(b) contracting authorities shall, acting in accordance with paragraphs (18) and (19), specify the level of security required for the electronic means of communication in the various stages of the specific procurement procedure, and that level shall be proportionate to the risks attached;

(c) where contracting authorities conclude that the level of risk, assessed in accordance with paragraphs (18) and (19), is such that advanced electronic signatures as defined by Directive 1999/93/EC of the European Parliament and of the Council(1) as amended from time to time are required, contracting authorities shall accept advanced electronic signatures supported by a qualified certificate, taking into account whether the certificate is provided by a certificate services provider which is on a trusted list provided for in Commission Decision 2009/767/EC(2) as amended from time to time, created with or without a secure signature creation device, subject to compliance with the following conditions:—

(i)

(aa) the contracting authorities shall establish the required advanced signature format on the basis of formats established in Commission Decision 2011/130/EU(3) as amended from time to time and put in place necessary measures to be able to process these formats technically;

(bb) in case a different format of electronic signature is used, the electronic signature or the electronic document carrier shall include information on existing validation possibilities;

(cc) the validation possibilities shall allow the contracting authority to validate online, free of charge and in a way that is understandable for non-native speakers, the received electronic signature as an advanced electronic signature supported by a qualified certificate;

(ii) where a tender is signed with the support of a qualified certificate that is included on a trusted list, contracting authorities must not apply additional requirements that may hinder the use of those signatures by tenderers.

Security requirements

(18) In deciding the level of security required at each stage of a procurement procedure, and in concluding whether the level of risk is such that advanced electronic signatures are required, contracting authorities shall assess the risks having regard to both the likelihood that particular risks will materialise and the potential adverse consequences if those risks materialise.

(19) In doing so, contracting authorities shall, in particular, have regard to such of the following matters as are relevant:—

(a) the risk to the proper functioning and integrity of the specific procurement process, including risks of breach of this Part;

(b) risks to national security;

(c) the risk of inadvertent or unauthorised disclosure of, or access to, any economic operator’s confidential information;

(d) the risk of inadvertent or unauthorised disclosure of, or access to, information held by the contracting authority including information relating to the specific procurement;

(e) the risk that use of electronic communications could provide opportunity for malicious attacks on the electronic systems of, or data held by, the authority, any economic operator or any other person, including introduction of malware or denial of service attacks;

(f) other material risks relating to the procurement procedure in question;

(g) the need for consistency as between similar procurements performed by the same contracting authority;

(h) the need for proportionality between, on the one hand the expected benefits of any particular security requirements (in terms of eliminating or reducing any of the risks referred to in sub-paragraphs (a) to (g)), and on the other hand the costs, burdens and obligations which those requirements may impose on economic operators.

Electronic signatures

(20) Paragraph (21) applies where—

(a) a competent authority of the United Kingdom located in England and Wales or Northern Ireland, or

(b) another issuing entity so located, signs and issues a document for use in a procurement procedure within the scope of the Public Contracts Directive, whether the procedure is under this Part or under the law of any member State.

(21) The competent authority or issuing entity may establish the required advanced signature format in accordance with the requirements set out in Article 1(2) of Commission Decision 2011/130/EU and, where it does so—

(a) it shall put in place the necessary measures to be able to process that format technically by including the information required for the purpose of processing the signature in the document concerned; and

(b) the document shall contain in the electronic signature or in the electronic document carrier information on existing validation possibilities that allow the validation of the received electronic signature online, free of charge and in a way that is understandable for non-native speakers.