You are the procurement lead at a German municipal IT department. On 1 July 2026, your next major tender — a €2.3 million citizen-portal replacement — will be the first one your office writes under the new §58 VgV Nummer 4. The clause is now law: Aspekte der digitalen Souveränität is an explicit award criterion in German public procurement. Your office’s tender-template library has not yet been updated. The legal department has asked you for a draft by Friday.

What you write into that tender, and how you justify it in the procurement file, will determine whether the clause does any work for your municipality — or whether the first Vergabekammer ruling against you sets the precedent every other procurement officer in Germany then has to read.

This article is the operational guide. What the amendment actually requires, what the legislative history says it means, what the early case law will be looking for, and the specific tender language that survives challenge in 2027.

What the amendment actually says

The change is one bullet point. Inserted by the Committee on Economy and Energy into §58 Absatz 2 Satz 2 of the VgV as a new Nummer 4, the bullet reads, in full: Aspekte der digitalen Souveränität. That is the statutory text. The work happens in the committee report.

In Bundestag-Drucksache 21/5525 of 22 April 2026, the committee enumerates what digitale Souveränität covers as an award criterion: interoperable and open IT systems or software; the traceability and control of data processing; special requirements for personnel handling data; security measures; the localisation of data; and “legal, organisational and technical immunity against unwanted access or availability restrictions.” The Berichterstatter — Dr. Andreas Lenz (CSU) and Georg Schroeter (AfD) — signed the report the day before the floor vote.

The Bundestag adopted it the following afternoon. Bundesrat assent followed on 8 May. The law enters into force on 1 July 2026. Inside an administrative-simplification statute, German procurement law had quietly acquired its first explicit sovereignty criterion.

A parallel change in the same statute is worth flagging for procurement files that touch security: it clarifies that procurement involving cybersecurity or digital sovereignty falls within the “wesentliche Sicherheitsinteressen” of Article 346(1) TFEU. Article 346 exempts procurement protecting essential security interests from full EU competitive-bidding rules. Read together: sovereignty became an explicit award criterion in ordinary tenders, and sovereignty became a recognised security ground that can carve specific procurement out of EU-wide competition entirely.

What the early Vergabekammer cases will be reading for

The committee’s enumeration is not statutory text. It is the explanatory annex. A Vergabekammer reviewing a future challenge will read §58 Absatz 2 Satz 2 Nummer 4 through the explanation, but the explanation is not directly binding. The case law gap between statute and explanation is what your tender’s procurement file has to fill in writing.

There are three failure modes the early cases will sort out. Each maps to a specific way your tender file can be built — or not.

The vague-citation failure mode. A tender that cites “digitale Souveränität” as criterion without specifying which of the committee-listed sub-criteria are being invoked is the easy target. The Vergabekammer will read the tender, find that the bidder cannot tell from the text which property the procurement is rewarding, and rule the criterion insufficiently determinate under §127 GWB. The first ruling along these lines will, by procurement-law convention, be cited in every subsequent challenge until a higher court overturns it.

The unbalanced-weighting failure mode. A tender that lists multiple criteria — price, quality, environmental, sovereignty — without disclosing the weighting, or with a sovereignty weighting that demonstrably narrows the bidder pool to a single politically preferred vendor, will be challenged on Section 127(4) GWB grounds. Disproportionate weighting against the procurement purpose is the standard challenge ground; the new sovereignty criterion adds a layer the Vergabekammer will examine carefully.

The pretextual-criterion failure mode. A tender whose sovereignty criterion is framed in ways that map onto exactly the offering of one preferred German vendor (Bundesnetzagentur favourites, Schwarz Digits’ StackIT, ITZBund’s KIPITZ) will be challenged on disguised-discrimination grounds under the GWB and the underlying EU directives. The early cases will set the line between “sovereignty as architectural property” and “sovereignty as vendor preference.”

The procurement files that survive these three failure modes have something specific in writing. The next section is what that something is.

The tender language that survives challenge

A tender citing §58 Absatz 2 Satz 2 Nummer 4 VgV that survives the first round of challenges will look, structurally, like the following four-part construction.

One: explicit enumeration of which committee sub-criteria are being invoked. Not “digital sovereignty” but “interoperability and openness of the IT system (BT-Drs 21/5525, p. X) and traceability and control of data processing (same, p. Y), excluding the personnel and data-localisation criteria as not applicable to this procurement.” The exclusion is as important as the inclusion: it signals to the Vergabekammer that the procurement officer considered the full criteria list and made a deliberate selection.

Two: per-criterion measurable property. For each invoked sub-criterion, the tender names the measurable property the bidder must demonstrate. For interoperability: support for ODF and CSV exports of all stored data, machine-readable APIs documented under OpenAPI 3.x, no use of proprietary file formats for citizen-portal data. For traceability: an audit log retention of at least 36 months covering all data-processing events, accessible to municipal auditors on request. For security: BSI C5 or equivalent — named criteria, not vague claim.

Three: stated weighting with reasoning. The weighting of the sovereignty criterion against price and quality is disclosed in the tender document, with a one-paragraph justification connecting the weighting to the specific procurement purpose. A weighting of 20-30 per cent on a citizen-portal procurement, with reasoning tied to data-localisation requirements and the political sensitivity of citizen-data processing, will read as defensible. A weighting of 60 per cent that effectively excludes all bidders except one named alternative will not.

Four: a documented criteria-selection rationale in the procurement file. Behind every tender citing §58 Nr. 4, the procurement file should contain a memorandum explaining why the specific sub-criteria were chosen, why they are proportionate to the procurement purpose, and how alternative tenders considered the criteria. This memorandum is not part of the tender visible to bidders. It is the document the Vergabekammer will request if the criterion is challenged. Tender offices that build this memorandum routinely will outperform those that build it under challenge pressure.

The EVB-IT contract templates published by Bitkom and the federal digital ministry BMDS on 20 March support this construction. The EVB-IT open-source-compliant templates supply the contract-language layer that operationalises the criteria the tender invokes. A tender citing §58 Nr. 4 with reference to the EVB-IT open-source contract terms reads as a coherent procurement instrument rather than an ad-hoc sovereignty claim.

What the amendment does not do

The criteria are permissive. They are not mandatory. A public buyer who wants to award to Microsoft can still do so, as long as the procurement process itself is procedurally clean. The law removes a legal weapon from challengers; it does not require buyers to use the new criteria. The practical effect therefore depends on whether public buyers actually exercise the new discretion. The variable is the thousands of municipal IT departments that procure independently and have institutional reasons to default to “what we know, which is Microsoft.”

There is a quieter objection from outside Germany. The criteria are written in ways that German cloud providers find easier to satisfy than competing European providers. “Localisation of data” defaults to “German hosting” in practice. “Traceability and control of data processing” favours open-source stacks that the German ecosystem has invested more heavily in than French or Dutch ones. A French or Dutch challenger to a German municipal tender now faces a criteria set that subtly favours German offerings. The statute is European in framing. It is German in operation. This is a feature, not a bug, of how procurement law is supposed to work — but it should be acknowledged by procurement officers who do not want to receive Vergabekammer challenges from non-German EU bidders on indirect-discrimination grounds.

What this article is not

Anyone reading this analysis as a claim that §58 Nr. 4 is empty or that it solves the procurement problem on its own has missed the point — the textual change is small, but the legal consequence is real, and a federal statute does not, on its own, drive municipal procurement decisions. The analysis operates one layer deeper: at the operational language a procurement file must contain so that the criterion holds in front of a Vergabekammer in 2027. Predictions about how individual challenge cases will be decided are outside the scope of the investigation, as is the question whether the criterion is protectionist in effect — such effects are a normal feature of procurement law. For procurement officers writing a tender under the new §58, this analysis does not substitute for procurement-law advice.

The municipal case that decides this

The story will be settled by one specific kind of event: a municipal tender that explicitly cites §58 Absatz 2 Satz 2 Nummer 4 VgV to refuse a Microsoft or AWS bid, that is challenged by the rejected bidder before the regional Vergabekammer, and that survives the challenge. If that happens within twelve months of the law entering into force, the procurement-law specialists will cite the case in every subsequent memo. The criteria move from text to instrument.

For your €2.3 million citizen-portal tender: build the four-part construction, document the criteria-selection memorandum, weight the sovereignty criterion proportionately. If your tender becomes the first ruling either way, the next two years of German municipal procurement will be reading the file you wrote this Friday.

Sources

Topic overview: Digital Sovereignty in Europe Related articles: The vendor wrote the test, What the veto changes