Chapter 2 — Research and development procurementProposed — COM(2026) 567
Article 29 — Security measures during contract implementation
In brief
This article allows a public buyer to terminate an R&D procurement contract, in whole or in part, or to exclude an economic operator during contract implementation where a contractor fails to comply with security-related measures or where a security or public-safety risk has materialised or is likely to. Any such action must be proportionate to the risk and preceded by a written assessment. It applies without prejudice to Member States’ contract law.
Key points
Termination or exclusion must be proportionate and supported by a written assessment weighing the severity of the risk, the impact on public services and possible alternative mitigation measures such as contract amendments or enhanced monitoring.
The buyer must normally notify the contractor in writing beforehand, stating the grounds, the supporting facts and evidence (excluding classified information) and the proposed date.
Advance notification may be dispensed with where justified by the severity or imminence of the threat, or where notice would aggravate the risk.
The contractor must be given time to submit observations and propose remedial action, which may not be shorter than 10 calendar days, though this may be shortened in an emergency.
The contractor must cooperate to secure or transfer data, documents and assets and ensure continuity of critical services until the measure takes effect.
What it means in practice
Contractors delivering R&D services under these contracts face the prospect of termination or exclusion mid-performance if security obligations are breached or risks emerge. In most cases they will receive reasons and evidence and a chance to respond and remedy the situation, but they should also plan for cooperation duties around securing or transferring assets and maintaining critical services.
Anthony Bochon’s analysis
This article is the enforcement counterpart to Article 28, and it is drafted with an evident concern for due process during contract performance. The right to terminate or exclude “without prejudice to contract law of the Member States” is important: it signals that the Union rule sits alongside, not in place of, national contract remedies, which in my experience is where disputes over consequences, damages and continuity actually get resolved. The proportionality test, the mandatory written assessment weighing severity against the impact on public services, and the express preference for alternative mitigation such as contract amendments or enhanced monitoring, all reflect a deliberate attempt to keep termination as a last resort rather than a reflex.
What I would flag for both buyers and contractors is the interplay between the notification duty and its exceptions. The minimum ten calendar days to submit observations and propose remedies is a real safeguard, but it can be shortened in an emergency or dispensed with where notice would aggravate the risk — language that is necessary but ripe for careful documentation. My reading is that the buyer’s written assessment will become the pivotal evidentiary record if a termination is later contested, so I would advise structuring it, and the cooperation duty on data and asset transfer in paragraph 5, into the contract from the outset.
Official text — Article 29 (COM(2026) 567)
1. Without prejudice to contract law of the Member States, the public buyer may
terminate a R&D procurement contract in whole or in part where it determines that
the contractor has failed to comply with measures or obligations aiming at preventing
or mitigating risks for security and public safety, or a risk to security or public safety
has materialised or is likely to materialise. Under the same conditions, they may
exclude certain economic operators during contract implementation.
2. Termination and exclusion pursuant to this Article shall be proportionate in relation
to the risk for security or public safety. Before terminating a R&D procurement
contract or excluding an economic operator, the public buyer shall conduct a writ ten
assessment. The public buyer shall take into account in particular:
(a) the severity of the risk for security or public safety;
(b) the impact of termination or exclusion on the delivery of public services;
(c) alternative mitigation measures such as c ontract amendments or enhanced
monitoring.
3. Unless justified by the severity of the risks involved, the imminence of the threat or
where notification may aggravate the risk, the public buyer shall notify the contractor
in writing of its intent to terminate or exclude, specifying:
(a) the grounds for termination or exclusion;
(b) the facts and evidence supporting the decision, with the exception of classified
information;
(c) the proposed date of termination or exclusion.
4. The contractor shall have an appropriate time, determined by the public buyer, which
shall not be shorter than at least 10 calendar days, to submit observations on the
grounds for termination and propose remedial actions. The public buyer may shorten
the deadline in case of emergency.
5. The contractor shall cooperate with the public buyer to secure or transfer data,
documents, or assets related to the R&D procurement contract and ensure continuity
of critical services until the termination or exclusion takes effect.
Source: European Commission, proposal for a Regulation establishing the European Innovation Act, COM(2026) 567 final, 9 September 2026. Read the official proposal (PDF). Text may change during the legislative process.
Anthony Bochon’s analysis
This article is the enforcement counterpart to Article 28, and it is drafted with an evident concern for due process during contract performance. The right to terminate or exclude “without prejudice to contract law of the Member States” is important: it signals that the Union rule sits alongside, not in place of, national contract remedies, which in my experience is where disputes over consequences, damages and continuity actually get resolved. The proportionality test, the mandatory written assessment weighing severity against the impact on public services, and the express preference for alternative mitigation such as contract amendments or enhanced monitoring, all reflect a deliberate attempt to keep termination as a last resort rather than a reflex.
What I would flag for both buyers and contractors is the interplay between the notification duty and its exceptions. The minimum ten calendar days to submit observations and propose remedies is a real safeguard, but it can be shortened in an emergency or dispensed with where notice would aggravate the risk — language that is necessary but ripe for careful documentation. My reading is that the buyer’s written assessment will become the pivotal evidentiary record if a termination is later contested, so I would advise structuring it, and the cooperation duty on data and asset transfer in paragraph 5, into the contract from the outset.