Tender / RFP compliance response pack (covering both EU public procurement and enterprise procurement)

Structure (9 sections)

1. 1. Pre-bid triage: can we bid, and is it worth bidding

   Run the hard gates before drafting, so you do not lose two weeks and then fail formal screening. Check: does the tender require a local entity, local data residency or local personnel; does it demand a specific certification (ISO/IEC 27001, SOC 2, a national security certification) with no equivalence accepted; are any exclusion grounds engaged (unpaid taxes or social security, criminal conviction, grave professional misconduct, conflict of interest); does the subject matter fall within your export control or investment screening sensitivities; and are the liability cap, audit rights and data sovereignty clauses within your acceptable range. Record the conclusion as a one-page bid/no-bid memo — that record is worth a great deal when win rates are later reviewed.

   Evidence to attach

   • · Triage checklist and the bid/no-bid memo with decision-maker and date
   • · Check record for local entity, data residency and personnel requirements
   • · Initial screening note on export control and investment screening sensitivity
   • · Red-line comparison table for key contract terms

   Common pitfalls

   • · Discovering the certification gap late and applying then, when certification takes far longer than the bid window
   • · Missing a "no equivalence accepted" clause and substituting another certificate, which is ruled non-compliant
   • · Finding the audit rights or data sovereignty terms unacceptable only at contract negotiation, sinking the entire prior investment

2. 2. Eligibility declarations and exclusion grounds: the ESPD and its equivalents

   In EU public procurement the contracting authority must accept the European Single Procurement Document (ESPD) as preliminary evidence — a self-declaration that no exclusion ground applies and that the selection criteria are met, with only the winning tenderer required to produce the actual certificates (identifiable through eCertis). Points to note: the Commission switched off its own ESPD service on 2 May 2019 but the obligation to use the ESPD remains, so national services are used instead; the standard form is established by Implementing Regulation (EU) 2016/7; and an ESPD already used may be reused in a later procedure provided its content is confirmed still correct. Maintain an internal ESPD master: assemble in advance the domestic documents behind each declaration (tax, social insurance, absence of criminal record, business registration) with their validity dates, so that winning does not trigger a scramble inside the submission deadline.

   Evidence to attach

   • · ESPD master (each declaration with an index of supporting documents and validity dates)
   • · Tax and social insurance clearance, business registration and qualification documents
   • · Legal confirmation on exclusion grounds, covering affiliates and directors and officers
   • · Where circumstances that could constitute an exclusion ground have occurred: the self-cleaning measures note

   Common pitfalls

   • · Treating the ESPD as the final evidence and discovering after award that the underlying certificates cannot be produced
   • · Reusing an old ESPD without rechecking, so the declaration no longer matches reality and becomes a misrepresentation
   • · Declaring only for the bidding entity, forgetting that entities relied upon and subcontractors face the same checks

3. 3. Economic and financial standing, technical and professional ability, and references

   The standard parts are: audited financial statements and key ratios, professional indemnity and cyber insurance policies, a list of comparable projects (with the customer’s prior permission to be named), key personnel CVs and qualifications, and the delivery methodology. Handle two obstacles common to Chinese companies in advance: (1) domestic financial statements follow accounting standards and formats the buyer may not recognise — prepare an English summary with a note on the standards differences; and (2) Chinese customer names often cannot be disclosed, so prepare anonymised descriptions (sector, scale, scope, verifiable third-party corroboration) and, where needed, a confidential verification route. Where you intend to rely on the capacities of a parent or affiliate, provide that entity’s commitment document as the procurement rules require — and note that the entity is itself checked against the exclusion grounds and selection criteria.

   Evidence to attach

   • · Audited financial statements with an English summary and a note on accounting standards differences
   • · Insurance policies (professional indemnity, cyber) and cover amounts
   • · Reference list with customer permission to be named, or anonymised descriptions plus a verification route
   • · Key personnel CVs, qualifications and committed allocation
   • · Commitment document from any entity whose capacity is relied upon

   Common pitfalls

   • · Naming customers in references without permission, then withdrawing the material after a complaint
   • · Relying on a parent’s capacity without filing the commitment document, so that capacity scores nothing
   • · Committing the same key personnel at 100% across multiple bids, which cannot be honoured at delivery

4. 4. Management system and environmental management certificates: equivalence and the "unable to obtain" route

   The EU public procurement rules contain two provisions that work in a bidder’s favour. Where quality assurance certificates are required, the contracting authority must refer to systems based on the relevant European standards series certified by accredited bodies and must recognise equivalent certificates from bodies in other Member States; and where the operator demonstrably had no possibility of obtaining such a certificate within the time limits for reasons not attributable to it, other evidence of equivalent quality assurance measures must also be accepted. The same applies to environmental management: the authority must refer to EMAS, to other systems recognised under the applicable rules, or to environmental management standards based on relevant European or international standards certified by accredited bodies, and must likewise recognise equivalent certificates and equivalent measures. In practice: submit the certificates you hold (ISO/IEC 27001, ISO 14001, ISO/IEC 42001 and so on) together with the accreditation body details; where you do not hold one, submit an equivalent-measures note plus a third-party assessment and a certification timetable, citing the equivalence provisions expressly.

   Evidence to attach

   • · Scans of the certificates held (number, scope, validity, certification body and accreditation body)
   • · Note mapping certificate scope to the subject matter of the bid
   • · Equivalent-measures statement (control list, third-party assessment, internal audit conclusions)
   • · Certification timetable and any signed certification engagement contract

   Common pitfalls

   • · Submitting a certificate whose scope does not cover the subject matter (covering the R&D centre but not the operated service)
   • · A certification body without recognised accreditation in the relevant jurisdiction, so the authority does not accept it
   • · Giving up the points instead of invoking the equivalence provisions
   • · A certificate that expires during the contract term with no recertification plan submitted

5. 5. Data protection and security exhibit: processor terms, transfers and security commitments

   Prepare a data protection and security exhibit that can be attached to the bid as-is: a description of the processing (purpose, categories, data subjects, duration), the processor obligations, the sub-processor list and change mechanism, the transfer mechanism and the conclusions of any transfer assessment, the security measures list (kept consistent with the questionnaire answer bank above), incident notification deadlines, deletion and return arrangements, and audit and cooperation duties. A Chinese supplier must address the cross-border question head-on: the geographic boundary of storage and access, the access controls over PRC-based operations staff, and the transfer mechanism relied on with the assessments completed. Evasion simply causes the buyer to assume the worst. Where the buyer is a financial entity, also prepare a clause-by-clause comparison against the required contractual elements for ICT third-party services.

   Evidence to attach

   • · Processing description table and processor clause template
   • · Sub-processor list and change notification mechanism
   • · Transfer mechanism documents and transfer assessment conclusions
   • · Security measures list, consistent with the customer questionnaire answer bank
   • · Incident notification deadline table and the deletion/return procedure
   • · Clause-by-clause comparison against the contractual elements required by financial-sector buyers

   Common pitfalls

   • · Security commitments in the bid that are more aggressive than the answer bank and cannot be met after award
   • · Vague cross-border arrangements, which buyer legal simply rules unacceptable
   • · Promising "immediate" incident notification when internal detection cannot deliver it

6. 6. AI-related declarations: role, transparency, use limitations and human oversight

   Tenders increasingly require a standalone AI declaration. Pre-draft: an inventory of the AI components in the solution and their purpose; your role in the regulatory chain (provider or deployer); whether the system serves a use that may be classified as high risk (employment screening, educational assessment, law enforcement, critical infrastructure) and, if so, the conformity assessment route and the state of the technical documentation; how users are informed when interacting with the system and how generated content is marked; the instructions for use, technical information and human oversight design you can supply to the buyer as deployer; the provenance and rights status of models and data; and the appeal and human review arrangements around automated decisions. Public sector buyers often also need to complete their own assessment as deployer (including where fundamental rights impacts are engaged) — spelling out which inputs you can supply is a real competitive advantage.

   Evidence to attach

   • · Inventory of AI components and their purpose
   • · Written assessment of role and high-risk classification
   • · Instructions for use and technical information pack for the deployer
   • · Product implementation note on interaction disclosure and content marking
   • · Human oversight and appeal/review mechanism note
   • · Provenance and rights status of models and training data

   Common pitfalls

   • · Declaring "no high-risk AI in this solution" when the buyer’s actual use falls within the high-risk list, forcing a redo of conformity assessment after award
   • · Being unable to supply the technical information the buyer needs as deployer, so it cannot complete its own assessment
   • · Marketing claims about model capability that contradict the technical declarations in the bid

7. 7. Subcontracting, consortia and reliance on the capacities of other entities

   Set out the delivery chain: what you perform, what is subcontracted, who the subcontractors are, the share subcontracted, and how they are managed. Under the EU public procurement rules, reliance on another entity’s capacity must be proved by showing the resources will actually be available (typically through that entity’s commitment document); the authority checks that entity against the exclusion grounds and selection criteria too and requires replacement where it fails; and where economic and financial standing is relied upon, the authority may require the tenderer and that entity to be jointly liable. Consortium bids should agree in advance the internal allocation of responsibility, a single external representative, and what happens if a member withdraws. Chinese companies bidding through an overseas subsidiary or joint venture should be especially explicit about the "technology delivered by the PRC team, contract held by the offshore entity" arrangement, or capacity to perform will be challenged.

   Evidence to attach

   • · Delivery split table (self, subcontracted, consortium members, with shares)
   • · Subcontractor list with qualifications and exclusion-ground checks
   • · Commitment document from entities relied upon and any joint liability arrangement
   • · Consortium agreement (responsibility split, authority to represent, withdrawal)
   • · Cross-border delivery note (location of the technical team, contracting entity, data exposure)

   Common pitfalls

   • · Subcontractors not checked against the exclusion grounds, forcing replacement and solution rework at evaluation
   • · An entity relied upon issuing a letter of intent rather than a resource commitment, which the authority does not accept
   • · No withdrawal arrangement inside the consortium, so one member leaving invalidates the whole bid

8. 8. Sustainability and social responsibility commitments: environmental, social and labour law obligations

   The EU public procurement directive requires Member States to take appropriate measures to ensure that economic operators comply, in performing public contracts, with applicable obligations under EU law, national law, collective agreements or the international environmental, social and labour law instruments listed in Annex X. Sustainability commitments in a bid are therefore a precondition of performance, not a bonus. Prepare: an environmental and labour compliance declaration covering yourself and the subcontracting chain; carbon data (Scope 1 and Scope 2, and where needed the Scope 3 portion attributable to this contract); your supply chain labour due diligence practice; and equivalence evidence where the tender documents reference a particular label or standard. Chinese bidders should anticipate two lines of questioning in particular: labour conditions in contract manufacturing and data labelling, and the provenance of critical minerals and the hardware supply chain. Feeding the outputs of tmpl-ghg-inventory-workpaper and tmpl-supplier-esg-security-ddq straight into this section avoids last-minute data gathering.

   Evidence to attach

   • · Environmental and labour compliance declaration covering the company and the subcontracting chain
   • · Carbon data summary (Scope 1 and 2, and contract-relevant Scope 3 where needed)
   • · Supply chain labour due diligence policy and recent verification records
   • · Equivalence evidence for any label or standard referenced
   • · Compliance records from environmental and labour authorities (such as confirmation of no material penalties)

   Common pitfalls

   • · Committing on behalf of the subcontracting chain while never having verified a single subcontractor
   • · Carbon data on a different basis from the published ESG report, found by the buyer’s cross-check
   • · Citing an environmental label without equivalence evidence, scoring zero on that criterion

9. 9. Submission control and the post-award obligation list

   Run a formal check before submission: completeness, signature and notarisation/legalisation requirements (overseas bids by Chinese companies often require notarisation and consular legalisation, which takes time to arrange), language and translation requirements, formatting and file naming, and the technical requirements and deadline time zone of the e-procurement platform. Immediately after award, generate an obligation list: the original certificates to be filed and by when, the continuing reporting duties under the contract (security reports, sustainability data, audit cooperation), certificate expiry and recertification dates, and the duty to notify subcontractor changes. Load that list straight into the compliance calendar to avoid the "won the bid, then went quiet" performance risk.

   Evidence to attach

   • · Pre-submission formal checklist with sign-off
   • · Notarised/legalised documents and translations with the translator’s statement
   • · E-platform submission receipt and timestamp
   • · Post-award obligation list (item, deadline, owner) and the compliance calendar entries

   Common pitfalls

   • · Underestimating notarisation and legalisation lead time and missing the deadline
   • · Reading the deadline in local time when it is set in the buyer’s time zone, and filing late
   • · Nobody tracking the continuing obligations after award, so the first annual report is already overdue