E-procurement

In accordance with article 25, paragraph 1 of the Code, the Technical Regulations require compliance with the Model of Interoperability of Public Administrations (MoDI) and the Guidelines for the National Digital Public Administration Network (PDND). This is because the interaction between the Platforms and the services provided by ANAC for the BDNCP takes place via the PDND. The specifications for the use of the PDND test and production environments are set out in the INT-PDND document. In addition, the technical regulations specify certain aspects of interoperability or portability between Platforms, beyond the scope of the PDND, such as the ability to import and export the tender dossier. The scope of interoperability may be extended when the technical regulations are updated, considering the European reference framework.

The definitions in the Technical Regulations apply within the scope of the regulation themselves and are relevant to the product certification process and the declaration of conformity of the platform. The rules don't affect the internal organisation of the different actors developing, managing, and using the platforms, nor unrelated aspects, such as who owns the code. The Owner is the one who applies for certification of platform components and commits to keep them compliant. The Manager combines certified components into a platform and is responsible for its operation. The Manager also ensures that any updates to the platform instance do not violate the requirements of the Declaration of Conformity. If the owner and manager are the same, there must be an internal separation of duties. Best practice is to follow the ISO/IEC 27002 controls for organisational and technological separation, in particular the separation of development, test and production environments. Except in cases where the Owner and Manager are the same legal entity, only the Manager can join the PDND. As stated in the INT-PDND document, the Owner must appoint a Manager for Class 3 software testing in accordance with the PDND.

Article 25(1) of the Code states that "digital procurement platforms consist of a set of interconnected and interoperable services and computer systems used by contracting authorities and entities to carry out one or more of the activities referred to in Article 21(1)". This article states that "the digital lifecycle of public contracts typically includes their planning, design, publication, award and execution". Therefore, there are no strict boundaries linked to phases, but rather to activities, and any platform falls under the definition of Article 25 and is subject to certification, even if it manages only one activity of the digital lifecycle of public contracts (which does not necessarily correspond to an entire phase). Certifications follow this principle, and the checklist indicates where requirements are not applicable, similar to the Applicability Statement required for ISO/IEC 27001 certification. The certifications include the requirements corresponding to the activities effectively supported by the platform, in line with the requirements of the Code. The certificate lists the supported requirements for each component and confirms that the verification has been successfully completed.

The Manager installs and combines certified components according to the owner's instructions, creating a platform instance. The Manager performs tests in the PDND test environment using ANAC's e-service tests. If the tests are successful, the Manager prepares, signs and submits a Declaration of Conformity to AGID in accordance with the procedures outlined in the Operational Scheme.