Procurement Law for Security Robots: 2026 Guide

Public contracting authorities will procure security robots in double-digit numbers per year from 2026. [Insert source] The procedures fail repeatedly at three points: wrong procurement regime, product-specific specifications, and inadmissible eligibility thresholds. This article sets out the legal framework and provides an operational grid for procurement offices.

Procurement Law for Security Robots: Legal Framework 2026

Part Four of the GWB (§§97 ff.) applies to security services from an estimated contract value of EUR 221,000 net (EU threshold 2024/2025). Below this threshold, the federal states' UVgO applies, with §8 UVgO governing the procedure for national procurements. Municipal pilot projects with a twelve-month term typically range between EUR 60,000 and EUR 180,000, hence below the threshold. [Insert source]

A widespread misconception: VOB/A does not apply. Security robots are a service, not a construction work. The relevant rules are GWB, VgV and (for national procedures) UVgO. VOL/B provides model contracts for the service component.

§14 VgV permits the negotiated procedure with prior call for competition where the service is technically complex or requires prior adaptation. Autonomous patrol robots with thermal, LiDAR and drone detection sensors regularly meet this criterion. The open procedure remains admissible but is rarely appropriate.

The contract type under §103 GWB is decisive. A Robotics-as-a-Service model is a service contract, not a supply contract. The contracting authority does not acquire hardware but an availability service. This changes the threshold calculation, the contract term and the termination rules. The KRITIS Umbrella Act (KRITIS-Dachgesetz) extends the obligations of operators of critical infrastructure from 2026. These obligations flow indirectly into tender documents.

Next step: KRITIS-Dachgesetz checklist 2026.

Specifications: What the Tender Must Contain

Specifications for security robots that comply with procurement law describe function, not product. §31 VgV prohibits references to specific manufacturers or types unless there is objective justification.

Minimum entries in the specifications:

• Patrol area in square metres (e.g. 42,000 m² outer perimeter).
• Perimeter length in running metres (e.g. 1,840 m fence line).
• Number of critical nodes: gates, transformer stations, transfer points.
• Minimum sensor requirements: thermal camera from 384x288 pixels, person detection at 50 m distance, IP65 protection rating or higher.
• 24/7 availability with defined SLA, maximum response time to alarm events in minutes.
• Interfaces to the existing control centre: ONVIF Profile S/T, BACnet/IP, MQTT 5.0 as mandatory requirements.

The data protection impact assessment under GDPR Art. 35 is a tender document, not a downstream step. It is submitted and evaluated before award. No DPIA, no evaluable bid.

The QR-2 specification for 24/7 outdoor perimeters and the QR-3 with LiDAR and drone detection can be used as technical references in the specifications without naming brands. The correct approach: describe functions that two or more providers can meet.

Eligibility Criteria for RaaS Providers

§122 GWB regulates eligibility criteria. They must be linked to the subject matter of the contract and be proportionate. For security robots, the following minimum requirements have become established:

• Conformity with EN ISO 13482, which defines safety requirements for personal care and service robots. The standard is applied to mobile service robots in non-industrial environments.
• Three productive reference projects with a minimum term of 12 months. More than three references is regularly inadmissible (see §122 para. 4 GWB, proportionality).
• Declaration of conformity under the EU Machinery Regulation 2023/1230. The regulation replaces Machinery Directive 2006/42/EC from 20 January 2027 and expressly covers autonomous systems.
• Professional liability: EUR 5 million flat for personal injury and property damage, EUR 2 million for financial loss. [Insert source]
• BDSW membership or equivalent industry qualification for the human guard component under §34a GewO.

The eligibility threshold for references is the most frequent pitfall. A contracting authority that demands 10 references excludes the entire provider segment not lawfully but unlawfully. Robotics providers are a young market segment. The procurement chambers of the federal government and Saxony have overturned disproportionate reference requirements in several decisions in 2023/2024.

Award Criteria Beyond the Lowest Price

§127 GWB requires the most economically advantageous bid, not the cheapest. In practice this means: price may receive at most 70% of the weighting. [Insert source] For technically complex security solutions, the usual ratio is 50% price to 50% quality. [Insert source]

§59 VgV permits life-cycle costs as a basis for evaluation. For RaaS this means: 24-month TCO instead of monthly rent. The calculation covers installation, training, maintenance, updates and dismantling. A detailed TCO comparison of guard service vs. robotics belongs in the procurement file.

Evaluable quality criteria:

• False alarm rate per 1,000 patrol hours (evidence from reference projects).
• Detection range under defined lighting conditions.
• Autonomous runtime between two charging cycles in minutes.
• Energy consumption in kWh per patrol kilometre as a sustainability criterion.
• Service response time: 48-hour replacement of a defective unit as an evaluable feature.

Every sub-criterion needs a measurable scale. "Functionally new" or "forward-looking" are not award criteria. They lead to a challenge.

Procedure Types: Open, Negotiated or Innovation Partnership

The choice of procedure is the most important preliminary decision under procurement law. Four options are available:

The open procedure suits standardised indoor patrols without KRITIS sensors. Low effort, zero scope for negotiation. Errors in the specifications risk cancellation.

The negotiated procedure with prior call for competition (§17 VgV) is the standard case for QR-2 and QR-3 classes with thermal and LiDAR sensors. The contracting authority can negotiate after the first round of bids, adapt technical solutions and refine prices. Precondition: technical complexity is documented in the procurement file.

The innovation partnership under §19 VgV is theoretically possible for initial deployments with drone detection but rarely justified in practice. It requires that the solution is not yet available on the market. For security robots with drone detection, this precondition is generally no longer met from 2026.

The competitive dialogue under §18 VgV addresses unclear technical solutions. Rarely required for security robots, since the market has three to five competing providers with comparable solution approaches.

Direct award is only possible below EUR 25,000 net (state law, in part EUR 50,000). With a typical 24-month RaaS contract, this threshold is virtually always exceeded.

KRITIS Procurement: Specifics Under the Umbrella Act

KRITIS operators are subject to additional requirements under §8a BSIG and the KritisV, which defines thresholds for critical facilities across sectors. These obligations apply cumulatively to general procurement law.

Practically relevant additions in KRITIS tenders:

• Security clearance under SÜG for the provider's deployed personnel, where access to security-sensitive areas exists.
• Supply chain transparency: the origin of robotics hardware (component level) is subject to documentation requirements. Providers identify the countries of origin of critical components.
• NIS-2 conformity of the provider becomes binding for critical sectors from October 2026. [Insert source] The NIS-2 Directive obliges operators of essential services to carry out supply chain checks under Art. 21 para. 2 lit. d.
• Data residency within the EU as a mandatory exclusion criterion for all cloud components. Third-country transfers under Art. 44 ff. GDPR are practically excluded in the KRITIS context.

The requirements for KRITIS operators must be coordinated with the competent sector supervisor before tender documents are dispatched. This applies equally to BNetzA, BSI and BaFin. Without this coordination, cancellation in the review procedure looms.

Common Errors in Tender Practice

From 47 evaluated procurement procedures for security robots in the period 2022 to 2025 [insert source], five recurring errors can be identified:

First: product-specific description. A specification that maps the functions of only one manufacturer violates §31 para. 6 VgV. Indicator: pixel-accurate sensor resolutions without technical justification.

Second: unrealistic eligibility thresholds. Ten references, five years' market presence, EUR 50 million minimum annual turnover. Such requirements unlawfully exclude young robotics providers and are regularly subject to challenge.

Third: missing evaluation matrix. If the award criteria are not quantified in advance, the evaluation is contestable. The procurement chambers require an evaluation methodology documented before the opening of bids.

Fourth: mixing human guard services and robotics in one lot. The question of lot separation under §97 para. 4 GWB must be carefully examined. Mid-sized guard companies can rarely offer robotics, robotics providers rarely provide §34a personnel. Mixed lots restrict competition.

Fifth: forgetting the GDPR impact assessment as a tender document. Security robots with person detection are subject to a DPIA under Art. 35 para. 3 lit. c GDPR. No DPIA, no contract conclusion.

Practice Guide: From Demand Notice to Award

A realistic schedule for an EU-wide negotiated procedure with prior call for competition covers 20 weeks:

Weeks 1-2: needs assessment. Plant manager, security manager and data protection officer define patrol area, risk profile and interfaces. Result: needs document with measurable requirements.

Weeks 3-6: market exploration under §28 VgV. Written enquiries to three to five RaaS providers. Goal: realistic price range, technical feasibility, threshold estimate. The market exploration is documented in the procurement file.

Weeks 7-10: drafting of specifications, contract value estimate under §3 VgV, choice of procedure type. Selection of eligibility and award criteria. Coordination with audit and data protection officer.

Weeks 11-16: notice in the EU Official Journal and call for competition. Dispatch of tender documents to suitable applicants, then first and second negotiation rounds.

Weeks 17-20: award decision, information of unsuccessful bidders under §134 GWB, 10-day standstill period, contract conclusion. In the event of a challenge, the period is extended by the duration of the review procedure. Before the procurement chamber, that is typically 4 to 8 weeks.

For sub-threshold procedures under UVgO, the overall flow shortens to 10 to 14 weeks. The notice obligation remains, the standstill period does not apply.

For anyone planning a procurement procedure for security robots in the next twelve months: filing a market exploration request under §28 VgV delivers reliable price indications for the threshold estimate.