← Home
Malta – Tender for Implementation of a Fully Compliant European Digital Identity Wallet (EUDIW), Supporting Trust Ecosystem and Use Cases
Malta Digital Innovation Authority (MDIA) / Department of Contracts · Malta
Original notice title
Malta – Miscellaneous software development services and computer systems – CT2274/2026 - Services - Tender for the Implementation of a Fully Compliant European Digital Identity Wallet (EUDIW), Supporting Trust Ecosystem and use cases for the Malta Digital Innovation Authority (MDIA)
This run uses Harborline Identity, a sample company. It is not your account. Open the live tender
Deadline
2 Dec 2026 · 47d left
Estimated value
EUR 15,659,714.03
Excl. VAT · From the summary
Market relevance
95
Company fit
Not assessed
Summary
The Department of Contracts (Malta) is tendering CT2274/2026 on behalf of the Malta Digital Innovation Authority (MDIA), the final beneficiary. The contract covers implementing a fully compliant European Digital Identity Wallet (EUDIW), its trust ecosystem and use cases. It is funded from the local budget and is not divided into lots. Version 1 is a Maltese/English mobile wallet app for iOS and Android, due within 6 months. It authenticates with the national eID server using the eID card over NFC, stores identity data and offers age verification and at least two use cases. Version 2, due within 21 months, is a fully compliant EUDIW under the EUDI Regulation (910/2014 as amended by 2024/1883), ARF v2.4 and the implementing acts, with these components: Wallet Provider PID Provider using OpenID Connect to eid.gov.mt at LoA High Relying Party Registrar PKI / Signing Certificate Provider WRPAC Provider RP verification component Signature Creation Application (QES, PAdES) HSM-based Remote WSCD Wallet Unit supporting PACE over NFC, TEE/SE, ISO/IEC 18013-5/7, OpenID4VP/VCI and SD-JWT VC
The work runs through 16 milestones and ends with support for certification of the wallet. It also covers 7 years of hosting, operation, maintenance and support from commissioning of Version 1, 20,000 hours of new use-case development, 7,000 hours of regulatory consultancy and a design refresh every 3 years. Version 1 is hosted on MITA's Azure hybrid cloud; Version 2 is colocated in two MITA data centres.
The estimated value is EUR 15,659,714.03 excl. VAT, which is not a cap. The duration is 90 months, with two optional 24-month extensions. Repetition of services is allowed up to 55% of contract value and additional services up to 20%. Award is on best price/quality ratio, weighted 70% technical and 30% price, with a minimum average technical score of 60%. Bids are submitted in English via the ePPS (www.etenders.gov.mt). As first published, the clarification deadline was 10/08/2026 and the submission deadline 03/09/2026 at 09:30 CET.
Four change notices and Clarification Note 31 extended the deadlines several times. Clarification requests now close 09/10/2026, the buyer's last answers are due 14/10/2026, and submission is due 02/12/2026 at 09:30 (opening at 10:00). Clarification Note 10 issued an updated Financial Bid Form. The Q&A confirmed the following: ISO/IEC 27001 applies to every consortium member or subcontractor involved in data processing or security-relevant components. Key Expert 7 must be physically present in Malta. The HSMs for the RWSCD must be fully separate from the PKI HSMs, and PKI components must be physically segregated. There is no price revision for hardware (Item 11). DDP pricing includes all import costs. Bidders must not rely on existing Azure WAF/CDN/DDoS protection. No changes to eid.gov.mt are in scope, and the ICAO eMRTD model is not required.
Tender Analysis Agent · from the notice and the tender documents
Requirements 46
Eligibility criteria 10
| Requirement | Threshold | Mandatory |
|---|---|---|
| Complete ESPD Part III exclusion grounds, including Maltese purely national and blacklisting grounds (labour law, misconduct, early termination, misrepresentation, undue influence) Evidence: ESPD in tender response format Tender document Section 1 Clause 5(B); ESPD request | Mandatory | |
| High-risk personal data processing due diligence. Without the Data Controller's written authorisation of the bidder as Data Processor, the contract cannot be awarded. Evidence: Completed GDPR Questionnaire (Eligibility) with justifications; further documents on request Tender document Section 1 Clause 5; GDPR Questionnaire_Eligibility | GDPR-compliant high-risk processing by bidder and all sub-processors | Mandatory |
| Minimum average yearly turnover over the past three financial years Evidence: Signed declaration by a warranted auditor appointed by the economic operator; ESPD Part IV.B Tender document Section 1 Clause 5(B)(b); ESPD Part IV | ≥ EUR 2,500,000 per year (average, 3 years) | Mandatory |
| ISO/IEC 27001 certification of the bidder and of every consortium member or subcontractor involved in data processing or delivery of security-relevant components, maintained for the whole contract Evidence: Copy of valid certificate(s) with the bid; ongoing on request Tender document Section 1 Clause 5(B)(d); Special Conditions Art. 7.3; Clarification Note 30 Q2 | Valid ISO/IEC 27001 | Mandatory |
| Declare subcontractors and the percentage subcontracted (empty means 0%). Each subcontractor completes ESPD Part III. If a subcontractor is relied on for selection criteria, complete Part IV and provide written commitments. Evidence: ESPD Part IV; subcontractor ESPDs uploaded under Sections 1.4.1/1.4.2; written commitments Tender document Section 1 Clause 5(B)(c)(ii); Clarification Note 29 Q6 | Mandatory | |
| Power of Attorney and other applicable eligibility forms Evidence: Uploaded forms via ePPS Tender document Section 1 Clause 5(A) | Mandatory | |
| Performance guarantee in the form of a bank guarantee, provided within 15 days of receipt of the contract. Consortium members may split it if the aggregate equals the full amount. Evidence: Bank guarantee per specimen Special Conditions Art. 7.12; Clarification Note 28 Q2 | 10% of contract value (contracts ≥ EUR 500,000) | Mandatory |
| Professional indemnity and cyber insurance covering DPC investigations, business interruption, civil claims, reputational damage and cyber security expenditure, held for the whole contract and renewed yearly Evidence: Copy of policy within 100 calendar days of contract signature; yearly renewal Special Conditions Art. 13.2 | Minimum EUR 4,000,000 in aggregate | Mandatory |
| Sign the Data Processing Agreement. No personal data transfer outside the EEA (UK excepted) without prior written approval. Sub-processors only with prior approval. Evidence: Signed Data Processing Services Agreement Data Protection Services Agreement | Mandatory | |
| Bid, documents and all written communication in English Special Conditions Art. 2.4 | English | Mandatory |
Project references 1
| Requirement | Threshold | Mandatory |
|---|---|---|
| Successful completion of large-scale software development and deployment projects limited to Trust Services, Identity solutions or Digital Wallet solutions, completed in 2023, 2024 and 2025. The bidder consents to client contact. Evidence: List of Projects form signed in wet ink by a warranted auditor confirming completion and values; ESPD Part IV.C Tender document Section 1 Clause 5(B)(c)(i); Form - List of Projects | ≥ 2 projects; cumulative value ≥ EUR 5,000,000 excl. VAT | Mandatory |
Human resource requirements 10
| Requirement | Threshold | Mandatory |
|---|---|---|
| Key Expert 4 Cybersecurity Specialist. Add-ons: MQF 7; >5 years. Evidence: CV, degree certificate BPQR 1.7d; ToR 6.1.1 | MQF 6 in Cybersecurity/ICT/Engineering; 3–5 years cybersecurity | Mandatory |
| Seven Key Experts, each in a distinct role held by one natural person: Project Manager, Solution Architect, Lead Developer, Cybersecurity Specialist, Trust Services Specialist, Legal Specialist, Systems and Network Engineer Evidence: Key Experts Form, Statement of Availability, self-declaration on public employees, CVs (incl. English/Maltese level), copies of certificates Tender document Section 1 Clause 5(C)(ii); BPQR 1.7; Clarification Note 30 Q8 | 7 distinct named persons | Mandatory |
| Key Expert 1 Project Manager. Add-ons (scored): MQF 7, >8 years, ≥1 year in EUDIW Large Scale Pilots, based in Malta. Evidence: CV, degree certificate BPQR 1.7a; ToR 6.1.1 | MQF level 6 in Management/ICT/Engineering; minimum 5–7 years ICT experience | Mandatory |
| Key Expert 2 Solution Architect. Add-ons: MQF 7; >8 years incl. >3 years mobile/backend design. Evidence: CV, degree certificate BPQR 1.7b; ToR 6.1.1 | MQF 6 in ICT; 5–7 years ICT, of which 3–5 years designing mobile and backend solutions | Mandatory |
| Key Expert 3 Lead Developer for mobile and backend, APIs and integration. Add-ons: MQF 7; >8 years. Evidence: CV, degree certificate BPQR 1.7c; ToR 6.1.1 | MQF 6 in Software Development/ICT/Engineering; 5–7 years software development | Mandatory |
| Key Expert 5 Trust Services Specialist (PKI, signatures, seals, certificates). Add-ons: MQF 7; >5 years. Evidence: CV, degree certificate BPQR 1.7e; ToR 6.1.1 | MQF 6 in ICT/Engineering; 3–5 years trust services | Mandatory |
| Key Expert 6 Legal Specialist (EUDI Regulation compliance, certification). Add-ons: >5 years; involvement in ≥2 technology/trust services projects each > EUR 1 million. Evidence: CV, degree certificate BPQR 1.7f; ToR 6.1.1 | MQF 6 in Law (≥180 ECTS); 3–5 years technology law / EU regulation | Mandatory |
| Key Expert 7 Systems and Network Engineer must be physically present in Malta for the 90-month contract. Add-on: >5 years. Evidence: CV, degree certificate BPQR 1.7g; ToR 6.1; Clarification Note 30 Q8–Q9 | MQF 6 in ICT/Engineering; 3–5 years in mission-critical, high-availability, security-sensitive environments; based in Malta | Mandatory |
| Key developers must have completed industry-recognised, role-appropriate security training before work starts. Add-ons: recognised certification; annual refresher training. Evidence: Write-up (~250 words) BPQR 1.6d; ToR 4.2.1.3.7.5 | Mandatory | |
| Replacement Key Experts must meet tender requirements and be approved by the Contracting Authority, provided within 10 calendar days of notice Evidence: Detailed profile of replacement Special Conditions Art. 17.2 | 10 calendar days | Mandatory |
Technical & project requirements 25
| Requirement | Threshold | Mandatory |
|---|---|---|
| Version 1 iOS/Android wallet app with the following scope; LoA High at launch is a scored add-on:
- eID authentication via the eID card authentication certificate over NFC
- storage of identification data
- privacy-preserving age verification aligned with the EC age verification blueprint
- at least 2 use cases
- approved Maltese/English branding
- Accessibility Directive compliance
- changeover plan to Version 2 Evidence: Technical architecture, compliance matrix, function and use case descriptions, changeover plan Tender document Section 1 Clause 1.1; BPQR 1.1; Art. 18.2 Milestones 2–3 | Deployed within 6 months; at least 2 use cases | Mandatory |
| Deliver the 16 milestones on schedule, with daily delay penalties:
- M1: branding, at least 5 proposals, 45 days
- M2: eID LoA High authentication, 3 months
- M3: Version 1 and M4: Wallet Provider attestations, 6 months
- M6: RP Registrar and M7: UX design, 9 months
- M5: PKI and M11: PID Provider, 12 months
- M8: WRPAC, M9: RP verification, M10: SCA and M12: RWSCD, 15 months
- M13–M14: remaining functions, 16 months
- M15: integrated EUDIW, 19 months
- M16: certification support, 21 months Evidence: Project plan (~2,500 words) with resources, milestones, deliverables, risks, methodology Special Conditions Art. 18.2, 19.2; BPQR 1.5 | Version 2 fully compliant within 21 months | Mandatory |
| Version 2 EUDIW fully compliant with the EUDI Regulation, ARF v2.4, its technical specifications and the CIRs 2024/2977, 2024/2979, 2024/2980, 2024/2982, 2025/848 and 2025/1569. Covers:
- Wallet Provider, PID Provider, RP Registrar, PKI/Signing Certificate Provider, WRPAC Provider and RP Verification
- SCA and RWSCD
- integration with Maltese national infrastructure
- architecture allowing component ownership by different public bodies Evidence: Architecture and sequence diagrams, standards-to-component mapping, third-party licence details, legal compliance write-up BPQR 1.2, 2.1; ToR 4.2.1.2, 4.2.2, 4.2.3; Abbreviations and References | Mandatory | |
| Wallet Provider:
- ARF conformance
- issuing wallet attestations (WUA) with correct format, signing, lifecycle and revocation
- privacy- and security-by-design data collection for fraud and risk monitoring Evidence: Write-up (~1,500 words) BPQR 2.2a–c; ToR 4.2.3.2, 4.2.3.10.3 | Mandatory | |
| Signature Creation Application for QES using the eID card as external QSCD via NFC, with mandatory PAdES. Scored add-ons: SCA external to the Wallet Provider; XAdES/JAdES/CAdES/ASiC support. Evidence: Write-up BPQR 2.2d–e; ToR 4.2.3.7.1–4.2.3.7.3 | PAdES QES | Mandatory |
| Relying Party Registrar: establish and maintain the national RP register and enable RPs to request and validate PIDs/EAAs and verify wallets. Optional scored component: issuing RP registration certificates. Evidence: Write-up (500–1,000 words) and architecture BPQR 2.3; ToR 4.2.3.10.6 | Mandatory | |
| PID Provider:
- issues unique PIDs via OpenID Connect to eid.gov.mt at LoA High
- validates the Wallet Unit before issuance
- ensures the PID is bound to the subject's device
- secure revocation
- no changes to eid.gov.mt required Evidence: Write-up (~1,250 words) with sequence diagrams BPQR 2.4; ToR 4.2.2, 4.2.3.10.4; Appendix I; Clarification Note 30 Q11 | LoA High | Mandatory |
| PKI deployed in the GoM secure hosting environment, physically segregated from other components and on HSMs separate from the RWSCD HSMs. Supports WRPAC issuance (ETSI TS 119 411-8) and complies with ETSI EN 319 401. Evidence: Architecture and documentation (~750 words) BPQR 2.5; ToR 4.2.2, 4.2.3.10.5; Clarification Notes 29 Q1, 30 Q7 | Mandatory | |
| Wallet Unit requirements:
- PACE over NFC with the eID card (CAN, secure messaging, Java Card applets) on Android and iOS
- secure authentication
- TEE with SE detection
- remote and proximity presentation per ISO/IEC 18013-5/7 and OpenID4VP
- cross-device interoperability
- secure backup and recovery
- pseudonyms
- PID-based authentication with nonce validation
- selective disclosure Evidence: Architecture and documentation (~2,000 words) BPQR 2.6; ToR 4.2.2.2, 4.2.3.1–4.2.3.11.3; Clarification Note 29 Q7 | Mandatory | |
| Remote WSCD on one or more HSMs:
- registration with two-factor authentication (hardware-bound key + PIN), replay prevention and PIN retry counters
- PID secret key generation, storage, rotation and revocation without key export
- signing of Verifiable Presentations
- robust cryptography addressing quantum risks Evidence: Technical write-up (~1,500 words) with sequence diagrams (registration, key generation, PID issuance) BPQR 2.7; ToR 4.2.2.1–4.2.2.4 | Mandatory | |
| Hosting arrangements:
- Version 1 backend on MITA Off-Premise Hybrid Cloud (Azure), assuming no existing WAF/CDN/DDoS protection
- Version 2 hosted entirely (incl. PKI) by colocation in two MITA data centres
- staging environment logically and physically separate from development and production
- hardware must fit 19-inch racks of max 1,000 mm depth with standard power and cooling
- hardware EoL/EoS replacement priced by the bidder
- no price revision on hardware (Item 11) Evidence: Hosting write-up BPQR 1.3c–d; ToR 4.2.1.1, 4.2.1.3.1, 4.2.3.11.10; Appendix III; Clarification Notes 29 Q2/Q4/Q5/Q9, 30 Q1/Q3–Q6 | RPO 15 minutes; RTO 2 hours | Mandatory |
| HSM-based key management with disaster recovery capabilities, full recovery of PID secret keys and high availability for identity operations Evidence: Write-up BPQR 1.3d; ToR 4.2.2 | Mandatory | |
| Build, operate, maintain and support for 7 years from commissioning of Version 1, including monitoring, ITSM, continuity, scalability and governance, meeting the Appendix III service levels and volumetrics. Quarterly operation reports after M16 cover uptime, incidents and SLA compliance. Evidence: Operations write-up (~1,000 words) BPQR 1.3a; ToR 4.2.3.11.8; Art. 24.1; Clarification Note 30 Q1 | 7 years; Appendix III SLAs | Mandatory |
| Secure SDLC, with scored add-ons as stated:
- periodic security architecture reviews
- SAST/DAST before major releases (on every deployment and in CI/CD: add-on)
- penetration testing (annual and independent: add-ons)
- tamper detection for secure storage
- log protection and integrity
- incident response drills
- at least one threat intelligence feed (two or more and integration: add-ons)
- regular security control assessments with independent audits by risk level
- anomaly detection (ML/behavioural biometrics: add-on)
- RASP: scored Evidence: Write-ups per BPQR 1.6 (approx. 150–400 words each) BPQR 1.6; ToR 4.2.1.3.7.1–4.2.1.3.7.16 | Mandatory | |
| Testing: user acceptance criteria in Gherkin (or equivalent), regression testing and verification of security controls. Add-ons: smoke tests and UAT on changes; automated testing. Evidence: Write-up (~400 words) BPQR 1.6e; ToR 4.2.1.3.7.8 | Mandatory | |
| Mobile integrity and anti-tampering controls with safe response mechanisms, risk assessments and vulnerability management, in line with the Cyber Resilience Act ToR 4.2.1.3.7; Clarification Note 29 Q3 | Mandatory | |
| Support the Contracting Authority in obtaining certification of the wallet solution under the applicable national or EU scheme Art. 18.2 Milestone 16 | Within 21 months (Milestone 16) | Mandatory |
| Develop additional use cases on demand and provide consultancy on new legislation, implementing acts and standards. Both are priced in the Financial Bid Form and paid monthly on use. Evidence: Financial Bid Form (updated per Clarification Note 10) ToR 4.2.1.2, 4.2.1.3.6; Clarification Note 30 Q12 | 20,000 person-hours development (Item 14); 7,000 person-hours consultancy (Item 16) | Mandatory |
| Design refresh of all public-facing interfaces every 3 years after Version 2 goes live Tender document Section 1 Clause 1.1(iii) | Every 3 years | Mandatory |
| Documentation and training:
- design- and implementation-stage documentation
- operations and support documentation (incident logs, maintenance schedules, performance reports)
- knowledge base and support portal
- interactive user training modules Evidence: Write-ups (~300 and ~200 words) BPQR 1.4, 1.3b; ToR 4.2.3.11.9 | Mandatory | |
| Reporting: monthly progress reports until M16 (KPIs, milestones, risks), weekly meetings during development, and cost reports per component at each milestone Evidence: Progress and cost reports Special Conditions Art. 24.1, 24.7 | Monthly / weekly | Mandatory |
| Intellectual property and licensing:
- full IP assignment of all bespoke deliverables (Wallet Provider, PID Provider, RP Registrar, PKI, WRPAC, RP Verification, Wallet Instances)
- EUPL for partially developed open-source components
- no GPL/AGPL without approval
- no proprietary dependencies without approval
- third-party licences maintained, with annual proof
- full ownership of Version 1 and the SCA are scored add-ons Evidence: IP description in bid; licence proofs annually Special Conditions Art. 14.5–14.7; BPQR 2.8 | Mandatory | |
| Deliver the following at each milestone and 30 days before expiry; escrow applies for Version 1 and the SCA:
- full source code with commit history
- build and deployment instructions and CI/CD definitions
- technical documentation
- SBOM in SPDX/CycloneDX
- reproducible infrastructure-as-code environment specification Evidence: Repository and documents; payment conditional on acceptance Special Conditions Art. 1.3, 14.5 | Mandatory | |
| GDPR technical questionnaire on location and processing of personal data. Customer data may not be stored outside the solution without approval. Evidence: GDPR Questionnaire – Technical Tender document Section 1 Clause 5(C)(iv); Clarification Note 30 Q1 | Mandatory | |
| Technical Offer Questionnaire and literature corroborating a fully compliant technical offer Evidence: Technical Offer Questionnaire; Literature List form Tender document Section 1 Clause 5(C)(iii),(v) | Mandatory |
Tender EvaluationSample company
Compare the tender requirements with your company evidence to identify matches, gaps and partner needs.
This run uses Harborline Identity, a sample company. It is not your account.
Harborline holds ISO 27001, turns over €4.1 million a year, and has delivered two identity-wallet projects worth €3.7 million together. It has no staff in Malta, and its cyber insurance is €2 million.
Proposal brief
Build a starting brief from your evaluation, including evidence, unresolved requirements and roles a partner needs to cover.
Tender Documents 40
Notices 5
Contract notice — TED 483367-2026PDF ↓Change notice — TED 546615-2026 RevisedPDF ↓Change notice — TED 601493-2026 RevisedPDF ↓Change notice — TED 633640-2026 RevisedPDF ↓Change notice — TED 671205-2026 RevisedPDF ↓Clarifications & Q&A 31
Clarification Note No 01 — CT2274_2026 - Clarification Note 01.pdf PDFDownload ↓CT2274_2026 - Clarification Note 02.pdf PDFDownload ↓CT2274_2026 - Clarification Note 03.pdf PDFDownload ↓CT2274_2026 - Clarification Note 04.pdf PDFDownload ↓CT2274_2026 - Clarification Note 05.pdf PDFDownload ↓CT2274_2026 - Clarification Note 06.pdf PDFDownload ↓CT2274_2026 - Clarification Note 07.pdf PDFDownload ↓CT2274_2026 - Clarification Note 08.pdf PDFDownload ↓CT2274_2026 - Clarification Note 09.pdf PDFDownload ↓CT2274_2026 - Clarification Note 10 and Updated Financial Bid Form.zip ZIP RevisedDownload ↓CT2274_2026 - Clarification Note 11.pdf PDFDownload ↓CT2274_2026 - Clarification Note 12.pdf PDFDownload ↓CT2274_2026 - Clarification Note 13.pdf PDFDownload ↓CT2274_2026 - Clarification Note 14.pdf PDFDownload ↓CT2274_2026 - Clarification Note 15.pdf PDFDownload ↓CT2274_2026 - Clarification Note 16.pdf PDFDownload ↓CT2274_2026 - Clarification Note 17.pdf PDFDownload ↓CT2274_2026 - Clarification Note 18.pdf PDFDownload ↓CT2274_2026 - Clarification Note 19.pdf PDFDownload ↓CT2274_2026 - Clarification Note 20.pdf PDFDownload ↓CT2274_2026 - Clarification Note 21.pdf PDFDownload ↓CT2274_2026 - Clarification Note 22.pdf PDFDownload ↓CT2274_2026 - Clarification Note 23.pdf PDFDownload ↓CT2274_2026 - Clarification Note 24.pdf PDFDownload ↓CT2274_2026 - Clarification Note 25.pdf PDFDownload ↓CT2274_2026 - Clarification Note 26.pdf PDFDownload ↓CT2274_2026 - Clarification Note 27.pdf PDFDownload ↓CT2274_2026 - Clarification Note 28.pdf PDFDownload ↓CT2274_2026 - Clarification Note 29.pdf PDFDownload ↓CT2274_2026 - Clarification Note 30.pdf PDFDownload ↓CT2274_2026 - Clarification Note 31.pdf PDFDownload ↓Tender documents 2
Documents, Forms and Annexes — CT2274_2026 - Docs, Forms and Annexes - Digital Identity Wallet.zip ZIPDownload ↓Digital Identity Wallet Tender Document PDFDownload ↓Price & financial forms 1
CT2274_2026 - Financial Bid Form - Digital Identity Wallet.xlsx XLSXDownload ↓Forms to complete 1
ESPD request pdf — espdRequest-13926846.pdf PDFDownload ↓Timeline 10
Deadline extended: 24 Sep 2026 → 15 Oct 2026
Status changed: CLOSED → OPEN
Deadline extended: 15 Oct 2026 → 05 Nov 2026
Deadline extended: 05 Nov 2026 → 02 Dec 2026
Deadline extended: 03 Sep 2026 → 24 Sep 2026