guides4 in this area
selling to regulated and public buyers.
When the buyer is a public authority or a regulated company, a law decides parts of the process: how the specification is written, what can be tested, and which questions a supplier has to answer. These guides cover what the rules say and how to sell inside them. They are not legal advice.
- 01you sell to a Polish public buyer2 guides
- 02the buyer is under NIS2 or DORA2 guides
- 03the buyer wants a test first1 guide
The reasoning behind this order: trust transfer, the thesis behind the site.
read them in this order.
you sell to a Polish public buyer
- 01why a vendor with the better product loses a Polish tenderIn a Polish public tender the decision is made months before the bids, in the specification. After publication, the better product is the one that fits the specification at the lowest price. How the system works, what the numbers say, and where a vendor can still act.
- 02below the tender threshold: how Polish public buyers purchase under PLN 170,000, and when to bid at allBelow PLN 170,000 a Polish public buyer follows its own internal rules and public finance law instead of the procurement act. What that means for a security vendor and its partner, and a short bid or no-bid discipline for every request and tender.
the buyer is under NIS2 or DORA
- 03NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn'tNIS2 makes supplier security a duty of the customer. It does not require any product, and no product makes a company compliant. What the articles say, the Polish KSC dates as of October 2026, and the claims to leave out of your deck.
- 04DORA in a sales conversation: what a bank will ask an ICT supplierDORA puts ICT third-party risk on the financial entity, and the bank passes the work to you through a contract annex, a due diligence file and its register of information. What the regulation and its technical standards ask, as of November 2026, and how to be ready before the first questionnaire.
tools for this area.
questions these guides answer.
What is an OPZ in a Polish tender?
The opis przedmiotu zamówienia, the technical specification of the contract. In software and security tenders it is usually a numbered list of functional and technical requirements, often with minimum parameters, required integrations, licensing models and support terms. Bidders confirm compliance requirement by requirement.
More in why a vendor with the better product loses a Polish tender
Does the Polish Public Procurement Law apply to purchases below PLN 170,000?
As of November 2026, Article 2(1)(1) of the Pzp applies the act to classic contracts awarded by public authorities from PLN 170,000, net of VAT. Below that value the act's procedures do not apply, and the buyer follows its internal rules and public finance law, although it still reports these purchases in its annual report under Article 82(1). This is not legal advice.
Can a product make a company NIS2 compliant?
No. NIS2 obligations apply to organisations, which must take risk-management measures and report incidents. Products can support specific measures, such as access control or logging. Compliance is an outcome of the organisation's management system.
More in NIS2 in a sales conversation: what the law asks of suppliers, and what it doesn't
Does DORA apply to a security vendor selling to a bank?
Mostly through the bank. Regulation (EU) 2022/2554 keeps the financial entity fully responsible for its obligations when it uses ICT services, so the bank must assess you, record you in its register of information and put the clauses of Article 30 in your contract. Direct EU oversight applies only to ICT providers the European Supervisory Authorities designate as critical. As of November 2026 the first list, published on 18 November 2025, names 19 providers.
More in DORA in a sales conversation: what a bank will ask an ICT supplier
Security Revenue · every Tuesday
How security vendors build pipeline.