Software procurement for 2027: evidence before launch or renewal

9 min read · 5 November 2026

For a 2027 software purchase, first classify the product, AI use and cloud service. Request evidence against the dates that apply to your role: release and vulnerability records, AI responsibilities and tests, and export and exit terms. Give every unresolved item an internal owner and a decision date.

Scope and source check: 5 November 2026. This Wavect-published guide connects supplier selection with engineering evidence. The calendar summarises selected EU requirements; the examples and project checkpoints are our proposed buying method. A qualified legal adviser should assess your actual classification and contract. A later date in one regime does not defer obligations already applying under another.

Which 2027 dates can change a software buying decision?

Use separate calendar entries for product security, high-risk AI and cloud switching. Each entry needs a scope decision before it becomes a requirement in your project. The following dates were checked against the linked legislation, not inferred from a supplier’s compliance badge.

Selected statutory dates, checked 5 November 2026. The scope column is essential; this is not a complete compliance calendar.
Date	Requirement to assess	Procurement consequence
11 September 2026, already applicable	CRA Article 14 reporting obligations, subject to the regulation’s scope.	Identify the reporting owner and process now. Waiting for the 2027 general application date is not a reporting plan.
11 December 2027	General application of the Cyber Resilience Act for products within its scope.	Resolve product and economic-operator roles, then request the relevant product-security evidence before market release.
2 December 2027	AI Act Chapter III, Sections 1 to 3, except Article 6(5), for high-risk systems under Article 6(2) and Annex III.	Record intended use and classification. Identify which party supplies each required record for that system.
12 January 2027	The Data Act Article 29 switching-charge prohibition for covered data-processing services.	Separate covered provider switching charges from migration work and other contractual amounts. Check Article 31 exceptions.

The CRA, Articles 69 and 71, gives the application and transitional rules. For reporting operations, use the separate CRA reporting playbook.

The current AI Act, consolidated on 27 July 2026, Article 113(c), also sets 2 August 2028 for the corresponding high-risk requirements under Article 6(1) and Annex I. These are specific high-risk application dates, not a general postponement of all AI duties. Check current law again before a 2027 commitment.

The Data Act, Articles 29 to 31, distinguishes switching charges, other fees and qualifying custom-built services. Article 31(1) exempts certain individually custom-built, non-catalogue services from Article 29 and specified other provisions. It does not create a blanket exemption from the entire switching chapter.

Which product, AI and cloud rules need a scope decision first?

Describe what the buyer receives and how it will be used. Then determine the relevant roles with the responsible legal and technical owners. Buying bespoke development, licensing a software product and renewing a cloud service can raise different questions within the same project.

Scoping prompts for three hypothetical purchases. These examples do not classify a real product or establish conformity.
Purchase	First question	Evidence to request
Internal knowledge assistant using an existing SaaS platform	What is the intended AI use, and which party performs each role?	Workflow description, data flows, access model, evaluation evidence, operating responsibilities and the applicable legal assessment.
Connected product with a necessary remote-processing component	Does the delivery fall within the CRA product definition and scope, and who is the manufacturer?	Product/version boundary, role assessment, security records and a documented vulnerability process appropriate to that assessment.
Cloud-service renewal with a planned provider change	Is this a covered data-processing service, and does an Article 31 exception apply?	Service description, export scope, contractual switching process, charge breakdown and any stated exception.

CRA Articles 2 and 3 define scope and products, including relevant remote-processing solutions. Do not classify every SaaS purchase as a CRA product solely because it is software. Likewise, an AI feature does not automatically belong to the same risk category as another feature using the same model. Document the intended use instead of borrowing a classification from a product label.

What evidence should you request before signing or renewing?

Request records tied to the system and release you intend to buy. A useful response names the version, describes what was checked and identifies what remains unresolved. Ask who maintains that evidence when a dependency, operating model or intended use changes.

Before award: a scope and role record, the proposed delivery owner, dependencies, acceptance conditions and a complete operating-cost breakdown.
Before release: the agreed verification results, known defects, deployment and recovery instructions, and the person authorised to accept residual risks.
Before renewal: the support scope, product and dependency changes, export capability, transition terms and an updated list of open evidence requests.

For a CRA-scoped product, connect requests to the manufacturer’s risk assessment and technical documentation under Article 13. Which records you receive and which rights you obtain need explicit treatment in the engagement. A supplier’s internal obligation does not automatically give the buyer every internal document or ownership of its source code.

Our software proposal clause review covers the contract questions in depth. The agency-selection guide helps you compare candidates using the same brief.

How should a buyer plan backward from launch?

Choose evidence deadlines from your actual launch or renewal date, leaving time to repair gaps. The following 90/60/30-day sequence is an illustrative internal plan, not a legal minimum lead time or a promise that every project fits three months.

90 days before the decision: agree the intended use and system boundary. Assign the legal classification and technical evidence owners. Record access, procurement and supplier dependencies.
60 days before: review the proposed records and run representative normal and failure cases. Ask the supplier to explain incomplete evidence and set a dated recovery plan.
30 days before: rehearse the agreed recovery or export path. Resolve critical unknowns, record any remaining limits and decide whether to proceed, reduce scope or defer.

Already-applicable reporting duties require an operating process now; they do not wait for this sequence. A late proposal also does not make a statutory date move. If a required decision cannot be completed in time, change the commercial or release plan with the accountable owners.

Does cloud switching become free in 2027?

A covered provider’s switching-charge row can become zero under Article 29. That does not make your migration effort, parallel operation or every contractual commitment free. Identify the service and any Article 31 exception before treating the charge prohibition as applicable.

Hypothetical net planning amounts, not prices, quotations or market benchmarks. Assess statutory scope and actual terms separately.
Category	Assumed amount	Treatment
Covered statutory provider switching charge	€0	Assumed to fall within Article 29 after 12 January 2027; verify that assumption.
Separately scoped migration implementation	€4,000	Assumed engineering work, not a re-labelled provider switching charge.
Parallel operation	€600	Assumed overlap between the two environments.
Internal test and reconciliation effort	€900	Economic value of internal time; not necessarily an external cash invoice.
Total modelled economic cost	€5,500	€4,000 + €600 + €900, before tax and excluding any early-termination commitment.

Keep early-termination penalties and ordinary service fees visible as separate questions; Article 29(4) recognises these distinct categories. Have the actual amounts and terms assessed rather than assuming every named fee is valid. For practical transition work, use the software provider-change guide.

What belongs in the supplier decision record?

Keep one register that links each requirement to an owner and inspectable evidence. Mark the state as demonstrated, contract-confirmed, public-offer-only or unresolved. Those labels record what you know. They do not create a supplier score or certify compliance.

Copyable fields: system and version; intended use; role and scope decision; requested evidence; supplier document or source; accountable internal owner; statutory reference where applicable; internal due date; unresolved question; release or renewal decision.

Illustrative entry: system/version: customer portal 1.0; intended use: invoice retrieval; role/scope: awaiting legal assessment; requested evidence: role A cannot access role B’s invoice; source: release-build test report; owner: product owner; statutory reference: pending scope assessment; internal due date: before pilot; unresolved issue: backup-restore drill; decision: pilot pending. This is a proposed record, not a customer result. Keep a critical unknown explicit instead of averaging it against unrelated evidence.

Our published Bond Analytics case study provides adjacent engineering context. It does not establish a 2027 regulatory outcome or formal legal advice. Wavect’s technology consulting service can help structure engineering decisions and the evidence needed for them. Bring your proposed system boundary to a software procurement scoping conversation.

2027 software procurement questions

Does an Austrian agency address prove EU-only data processing?

An address identifies a business location, not the complete processing arrangement. Request the proposed contributors, model services, logs, backups and support-access locations. Have the responsible privacy and legal owners assess the actual arrangement. Confirm required restrictions in the engagement rather than inferring them from a supplier’s country or a European brand.

Does renewal automatically make existing software a newly placed CRA product?

Do not classify a product from the renewal date alone. CRA Article 69 contains transitional treatment for products placed on the market before 11 December 2027, including the substantial-modification condition and separate reporting exception. Record the product history and proposed changes, then obtain an assessment of the actual scope. A renewal label cannot settle that assessment.

Can one application need evidence for more than one regime?

Yes, the buying decision can involve a product, an AI use and data-processing services together. Keep the scope and responsible role for each branch separate. The presence of one date does not cancel an already-applicable requirement elsewhere. The calendar helps organise questions; the final classification depends on the actual system and use.

Does the Data Act give the buyer the provider’s source code?

Do not treat switching rights as a transfer of all intellectual property. Data Act Article 30(6) protects specified intellectual-property and trade-secret boundaries. Agree exportable data, configuration, documentation and any separately commissioned code rights explicitly. Assess which legal provisions apply to the service before claiming a right to a particular internal asset.

What if the supplier cannot yet provide a requested record?

Record the missing item, its owner and the decision it prevents. Ask for a dated evidence plan or an alternative that meets the requirement. The buyer may need to reduce scope or defer a release. A promise to provide evidence later should remain distinct from a demonstrated control or a completed acceptance test.

Who should review classification and contract questions?

Use qualified legal advice for statutory classification and contract interpretation, alongside the technical owner who understands the product and data flows. Wavect can help organise engineering evidence and delivery questions within an agreed scope. This guide does not grant a conformity assessment, certification or legal clearance for an individual purchase.