What Italian public buyers actually screen for in cloud procurement

Italian public-sector buyers talk less about "sovranità" than the marketing around it suggests. What actually shows up in central-administration cloud tenders — including Consip's framework agreement for cloud application services, ID 2860, published in December 2025 for the Pubbliche Amministrazioni Centrali — is a set of concrete, checkable requirements rather than a slogan.

The qualification bar that keeps appearing

Across recent Consip cloud framework agreements, a recurring requirement is that services be qualified by Italy's national cybersecurity agency, ACN, at least at qualification level 1, commonly written as QC1 for cloud services handling ordinary data, or AI1 for the equivalent infrastructure level. ACN's own published criteria for level 1 require self-certified conformity to ISO 9001 quality management, alongside security, performance, scalability, interoperability and portability characteristics set out in the regulation for public-administration cloud services. This is a specific, auditable qualification, not a synonym for "compliant."

Data location and exit terms matter more than the label

Two other bars turn up repeatedly in this class of tender: where data and backups physically sit, typically required within the EU or EEA, and how a supplier proves it, plus contractual terms for ending the relationship without losing access to data or facing prohibitive costs to leave. A vendor's marketing claim of being a "cloud sovrano" is not a substitute for meeting either of these directly.

What to check before treating a slogan as an answer

Before a bid response repeats language like "sovereign cloud" or cites a certification as if it were self-evident, the working questions are: does the qualification actually cover the ACN level this specific tender requires, is the data-location and disaster-recovery evidence current, and what does the contract say about exit terms and timeline. Always verify against the live tender documentation on Consip's own site before relying on a summary — procurement text gets amended through clarification rounds, and an older reading can be stale by the time a bid is due.

Sources: Consip — ID 2860, ACN — QC1 qualification requirements.