---
title: "Interoperable Europe: what suppliers to government should…"
description: "How the Interoperable Europe Act and the Single Digital Gateway Regulation shape what public bodies buy, share and reuse, and what that means for the software,…"
url: https://pitch.law/academy/interoperable-europe-act
---

[pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Data](https://pitch.law/academy/topics/information-technology)

# Interoperable Europe: what suppliers to government should know

How the Interoperable Europe Act and the Single Digital Gateway Regulation shape what public bodies buy, share and reuse, and what that means for the software, licences and contracts you offer them.

- - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law
  - 13 November 2026

- Updated

  13-11-2026

## The legal framework

### Status and the texts

The Interoperable Europe Act is [Regulation (EU) 2024/903](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R0903) of 13 March 2024. It was published in the Official Journal on 22 March 2024 and entered into force on 11 April 2024. It applies from 12 July 2024. Two parts came later: the interoperability assessment in Article 3(1) to (4) and the national competent authorities in Article 17 apply from 12 January 2025 ([Article 23](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R0903#art_23)).

It works next to the Single Digital Gateway Regulation, [Regulation (EU) 2018/1724](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32018R1724) of 2 October 2018. That Regulation sets up the gateway to online information and procedures, and the "once-only" technical system that lets authorities exchange evidence across borders. Its rules on online procedures and the once-only system ([Articles 6, 13, 14(1) to (8) and (10) and 15](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R1724#art_39)) apply from 12 December 2023.

### Who is caught

The Interoperable Europe Act applies to Union entities and public sector bodies that regulate, provide, manage or implement trans-European digital public services ([Article 1(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R0903#art_1)). A public sector body has the meaning given in the Open Data Directive, [Directive (EU) 2019/1024](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1024) ([Article 2, point (6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R0903#art_2)). A trans-European digital public service is a digital service that public bodies provide to each other or to people and businesses in the Union, and that needs interaction across Member State borders through their network and information systems.

Companies are not addressees. The Act does not oblige a software house, a consultancy or a cloud provider to do anything directly. It reaches suppliers through their customers. Three examples:

- A software company built a permit platform for a Belgian region. The region exchanges data on that platform with authorities in the Netherlands. The region now has to be able to share that solution with other public bodies on request.
- A consultancy drafts technical specifications for a new national e-invoicing rule that affects cross-border exchanges. The ministry has to run an interoperability assessment before it decides, and publish a report.
- A start-up has a tool for verifying company documents across borders. It can join an interoperability regulatory sandbox that public bodies set up.

### The duties, article by article

**Interoperability assessment ([Article 3](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R0903#art_3), from 12 January 2025).** Before it decides on new or substantially modified binding requirements, a Union entity or public sector body must carry out an interoperability assessment. A binding requirement is an obligation, prohibition, condition, criterion or limit of a legal, organisational, semantic or technical nature that affects cross-border interoperability (Article 2, point (15)). The assessment looks at the effects on cross-border interoperability, the stakeholders concerned, and the Interoperable Europe solutions that could support it. The body publishes a report on an official website, using the checklist in the Annex, and shares it with the Interoperable Europe Board. Publication must not compromise intellectual property rights or trade secrets. The body must also consult the recipients of the services directly affected (Article 3(4)).

**Sharing and reuse ([Article 4](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R0903#art_4)).** This is the article that matters most to suppliers. On request, a public body must make an interoperability solution that supports a trans-European digital public service available to another public body. That includes the technical documentation and, where applicable, the version history, documented source code and the references to open standards or technical specifications used. An interoperability solution is a reusable asset, such as frameworks, guidelines, reference architectures, specifications, standards, services and applications, and documented technical components such as source code (Article 2, point (4)).

The duty does not apply to solutions for which third parties hold intellectual property rights that restrict sharing (Article 4(1)(b)). Nor does it apply to solutions outside the body's public task, or to solutions restricted for critical infrastructure, defence or public security reasons. The sharing body states the conditions of reuse, which may include an exclusion of its liability for misuse (Article 4(2)). A body or a third party reusing a solution may adapt it, unless third-party IP restricts that (Article 4(4)). Sharing and reusing bodies may agree to share future development costs (Article 4(5)).

**Preference for open licensing ([Article 4(6)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R0903#art_4)).** When choosing interoperability solutions, public bodies must prioritise solutions that do not carry restrictive licensing terms, such as open source solutions, where they are equivalent in functionality, total cost, user-centricity, cybersecurity or other relevant objective criteria. The Act defines an open source licence in Article 2, point (12).

**Interoperable Europe solutions and the portal ([Articles 5 to 8](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R0903#art_7)).** The Interoperable Europe Board recommends solutions, which then carry the label "Interoperable Europe solution" and appear on the Interoperable Europe portal. The Board develops the European Interoperability Framework (EIF), which the Commission may adopt (Article 6). Member States take the EIF into utmost account in their own frameworks.

**Support projects and innovation ([Articles 9 and 10](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R0903#art_9)).** The Board may propose projects to support the digital implementation of EU policies, and innovation measures that may involve GovTech actors. GovTech means technology-based cooperation between public and private sector actors supporting public-sector digital transformation (Article 2, point (9)). Outcomes and solutions developed in support projects are made public on the portal (Article 9(5)).

**Interoperability regulatory sandboxes ([Articles 11 and 12](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R0903#art_11)).** Public bodies may set up sandboxes to develop, test and validate interoperability solutions. One aim is an open European GovTech ecosystem, including cooperation with SMEs, research institutions and start-ups. Participants may involve companies wishing to test innovative solutions, in particular SMEs and start-ups (Article 12(1)). Participation runs for at most two years, extendable by up to one year (Article 12(2)). It rests on a plan with roles, regulatory issues, risk management, milestones and, where needed, the personal data processed (Article 12(3)). Participants remain liable under Union and national law for damage caused during their participation (Article 12(5)). Personal data may be reused in the sandbox only under the strict conditions of Article 12(6).

**Community and governance ([Articles 15 to 18](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R0903#art_16)).** Public and private stakeholders residing or with their registered office in a Member State may register on the portal as members of the Interoperable Europe Community, which provides expertise to the Board (Article 16(2)). Each Member State designates competent authorities and a single point of contact (Article 17).

### The once-only system and public procurement

The Single Digital Gateway Regulation obliges Member States to let cross-border users complete national online procedures in the same way as domestic users, including electronic identification and electronic evidence ([Article 13](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R1724#art_13)). The technical system for the automated exchange of evidence covers the procedures in Annex II and, among others, the procedures of the public procurement Directives 2014/24/EU and 2014/25/EU ([Article 14(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R1724#art_14)). Using it is not obligatory for users and happens only at their explicit request (Article 14(4)). The user may preview the evidence and decide whether to proceed (Article 14(3)(f)). Evidence received through the system is deemed authentic for the requesting authority (Article 14(8)).

## In practice

Expect public customers to ask about reuse from the start. A body that must share a solution on request will want the rights to do so. If your standard licence only allows use by the contracting authority, the authority may either negotiate wider rights or lean towards an equivalent solution with less restrictive terms, as Article 4(6) asks.

A software house supplies a case-management module to a federal agency. The module exchanges data with authorities in two other Member States. Before signing, the agency asks for a licence that allows it to share the module, with documentation and source code, with other public bodies, and to let them adapt it. The supplier keeps its core library proprietary and separates it clearly. That library is third-party IP from the agency's point of view, so Article 4(1)(b) applies to it. The supplier licenses the interoperability layer more widely and adds a support offer for reusing bodies.

A consultancy prepares an interoperability assessment for a ministry. Its working papers name the supplier's architecture. The report will be published. The consultancy marks the trade secrets and agrees with the ministry what goes into the public report, relying on the rule that publication must not compromise IP or trade secrets.

A start-up joins a sandbox run by three public bodies. It signs on to the sandbox plan, agrees its role and milestones, and buys insurance, because it remains liable for damage it causes.

### Practical steps

1. **Map your public customers.** Which solutions support services that cross borders? Those are the ones Article 4 may reach.
2. **Separate components.** Document which parts are your own, which are open source and which are licensed from others. Third-party IP that restricts sharing is outside the duty, but only if it is identified.
3. **Write reuse into the licence.** Decide in advance whether you allow sharing with other public bodies, adaptation, and publication on the portal. Set terms for each.
4. **Price support and maintenance separately.** The sharing body may state guarantees on cooperation, support and maintenance (Article 4(2)). Offer reusing bodies a direct support contract.
5. **Protect trade secrets in assessments.** Ask the public body to mark what may not be published.
6. **Prepare evidence for tenders.** Keep your company documents available in electronic form, so that cross-border procurement procedures can use the once-only system if you choose to.

## Frequently asked questions

### Does the Interoperable Europe Act oblige my company to publish its source code?

No. The Act binds Union entities and public sector bodies. A public body must share a solution, including documented source code where applicable, when another public body asks. It cannot share what third-party IP prevents it from sharing. What it may share depends on the licence you granted.

### Does Article 4(6) exclude proprietary software from public tenders?

No. It asks public bodies to prioritise solutions without restrictive licensing terms where they are equivalent on objective criteria such as functionality, total cost, user-centricity and cybersecurity. A proprietary solution that is better on those criteria can still be chosen.

### Can a company take part in an interoperability regulatory sandbox?

Yes, if the participating public bodies involve it. Article 12(1) mentions companies wishing to test innovative interoperability solutions, in particular SMEs and start-ups. Participation is time-limited and based on a plan.

### Does the once-only system force bidders to use it?

No. Article 14(4) of the Single Digital Gateway Regulation says its use is not obligatory for users. You may still submit evidence directly to the authority.

## How this connects

For the procurement process itself, see [running a request for information or proposal](https://pitch.law/academy/rfi-rfp-procurement). The proposed [Cloud and AI Development Act](https://pitch.law/academy/cloud-and-ai-development-act) would add sovereignty levels for cloud procurement and an EU catalogue for open source software released by public bodies. We review licences for public customers and draft the reuse, support and liability terms with [Document Studio](https://pitch.law/technologies/contract-studio), our proprietary document analysis and development system, and test existing terms with the [clause library and risk review](https://pitch.law/technologies/clause-library-risk-review). Our [commercial contracts and transactions](https://pitch.law/solutions/commercial-contracts-transactions) team handles the negotiation.

**Cited provisions:** Regulation (EU) 2024/903, Articles 1 to 4, 6, 7, 9 to 12, 16, 17 and 23 and the Annex; Regulation (EU) 2018/1724, Articles 13, 14 and 39.

**Key dates:**

- 12 December 2023: once-only technical system and cross-border online procedures apply
- 11 April 2024: Interoperable Europe Act in force
- 12 July 2024: Interoperable Europe Act applies
- 12 January 2025: interoperability assessments (Article 3(1) to (4)) and national competent authorities (Article 17) apply

## In short

- Who the Interoperable Europe Act binds, and who it touches indirectly
- Sharing and reuse of solutions, source code included
- Preference for solutions without restrictive licensing terms
- Interoperability sandboxes open to companies and start-ups
- Contract terms to settle before you sign with a public body

## Related solutions

- [Solutions](https://pitch.law/solutions/commercial-contracts-transactions)
  ### [Commercial Contracts & Transactions](https://pitch.law/solutions/commercial-contracts-transactions)
  [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://pitch.law/solutions/commercial-contracts-transactions)

## Our proprietary Legal Tech

- [Technology](https://pitch.law/technologies/contract-studio)
  ### [Document Studio](https://pitch.law/technologies/contract-studio)
  [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://pitch.law/technologies/contract-studio)
- [Technology](https://pitch.law/technologies/clause-library-risk-review)
  ### [Contract Review](https://pitch.law/technologies/clause-library-risk-review)
  [Send us the contract the other side drafted and we check it clause by clause against our playbook, with a risk ranking an attorney has verified.](https://pitch.law/technologies/clause-library-risk-review)

## More in Data

- ### [Children Online: the EU KIDS Act Proposal and Age Verification](https://pitch.law/academy/children-online-kids-act-and-age-verification)
  [What the Digital Services Act already requires to protect minors, what the EU KIDS Act proposal of 17 September 2026 would add for social networks, video platforms, games, app stores and chatbots, and how the EU age verification framework fits in.](https://pitch.law/academy/children-online-kids-act-and-age-verification)
- ### [The Cloud and AI Development Act: sovereignty rules for cloud and AI procurement](https://pitch.law/academy/cloud-and-ai-development-act)
  [What the Commission's proposal for a Cloud and AI Development Act would require of cloud providers that sell to the public sector, of contracting authorities, and of bidders for cloud and AI contracts, and how it sits next to the Data Act and the procurement Directive.](https://pitch.law/academy/cloud-and-ai-development-act)
- ### [Cyber Resilience Act III: importers, distributors, open source and contracts](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
  [The duties of importers, distributors and authorised representatives under Articles 18 to 23 of Regulation (EU) 2024/2847, when a reseller becomes a manufacturer, how free and open-source software and its stewards are treated, and the clauses that follow.](https://pitch.law/academy/cyber-resilience-act-importers-distributors-open-source)
- ### [Cyber Resilience Act I: which products are caught, and in which class](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
  [How to tell whether hardware or software you sell falls under Regulation (EU) 2024/2847, whether it is a default, important (class I or II) or critical product, and which conformity route follows from that, with the dates up to 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-products-and-classes)
- ### [Cyber Resilience Act II: vulnerability handling and reporting since 11-09-2026](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
  [What manufacturers must report under Article 14 of Regulation (EU) 2024/2847 since 11 September 2026, within 24 hours, 72 hours, 14 days and one month, and the vulnerability handling duties of Annex I, Part II, that follow from 11 December 2027.](https://pitch.law/academy/cyber-resilience-act-vulnerability-handling-and-reporting)
- ### [Cyber incidents across borders: the Cyber Solidarity Act](https://pitch.law/academy/cyber-solidarity-act)
  [What Regulation (EU) 2025/38 sets up, the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism with the EU Cybersecurity Reserve and the incident review mechanism, how a company hit by a major incident can benefit, and what it means for managed security service providers.](https://pitch.law/academy/cyber-solidarity-act)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://pitch.law/schedule)