Open-source Ecommerce

January 12, 2026

EU & UK Public Sector Procurement: Open Source Commerce for Government

eIDASgovernment procurementNIS2open source commercepublic sector

---

Key Takeaways

Government procurement agencies and public institutions face a unique commerce problem: mainstream SaaS eCommerce platforms lack the regulatory requirements for government digital services.

Governments must ensure data sovereignty (domestic hosting), source code auditability (open source for security), digital accessibility (WCAG AA or equivalent), and in the EU, eIDAS 2.0 digital identity integration.

US government procurement also requires FedRAMP certification and Section 508 accessibility compliance.

Open source platforms deployed on government-approved cloud (GovCloud in the US, EU cloud in the EU) provide the architectural sovereignty government requires.

This guide covers the regulatory environment for government procurement, which platforms serve government agencies, and how to architect a sovereign, accessible, auditable government commerce platform.
Last verified: March 2026

Why Does Public Sector Procurement Require Open Source Platforms?

Government procurement is one of the largest digital commerce markets in the world. The EU spends approximately €2 trillion annually on public procurement. The US federal government spends over $600 billion annually. The UK spent £190 billion on public procurement in 2023.

Yet government procurement eCommerce has remained fragmented, with dozens of isolated national and regional systems instead of integrated digital platforms. The reason is regulatory. Governments operate critical digital infrastructure that citizens depend on.

This creates requirements that mainstream eCommerce platforms fail to meet. Governments must control their own data (data sovereignty), verify that software is secure (source code auditability), ensure all citizens access services regardless of ability (digital accessibility), and in Europe, enable digital identity authentication (eIDAS 2.0).

Using the wrong platform creates legal liability. Hosting on US SaaS infrastructure violates EU data residency requirements (GDPR). Inaccessible services violate Section 508 (US) or the European Accessibility Act (EU). Proprietary code prevents security audits, creating cybersecurity and data protection violations. For government infrastructure, this is a compliance and accountability issue.

For US government regulations, see US Government Commerce Guide (coming soon). For EU regulations, see EU Compliance Environment 2026 (coming soon).

---

Regulations That Affect Public Sector Procurement eCommerce

Government procurement operates under a framework of procurement law, data protection, accessibility, and digital identity requirements that vary by region but all converge on one principle: government digital services must be sovereign, auditable, and universally accessible.

Regulation	Jurisdiction	What It Means for Government Procurement	Impact
NIS2 Directive (Network and Information Systems Security)	EU	Critical entities (including government digital infrastructure) must meet baseline cybersecurity requirements. Includes incident reporting, risk management, and supply chain oversight.	🔴 Critical
GDPR (EU) 2016/679	EU	All personal data in procurement systems must be protected. EU data residency required — data must be stored in the EU.	🔴 Critical
eIDAS 2.0 (EU Digital Identity Regulation)	EU	By 2026, all member states must offer digital identity wallets for citizen authentication. Government services must accept eIDAS 2.0 credentials.	🔴 Critical
European Accessibility Act (EAA) 2026	EU	All digital products and services, including government platforms, must be WCAG 2.1 Level AA accessible by 2026 (June 28).	🔴 Critical
UK GDPR + Data Protection Act 2018	UK	UK data residency required. All personal data must be stored in the UK (unless processing agreement allows UK cloud).	🔴 Critical
UK Accessibility Regulations 2018	UK	All government digital services must be WCAG 2.1 Level AA accessible. Required by Section 508 equivalent (PSBAR compliance).	🔴 Critical
FedRAMP (Moderate or High)	US Government	Any cloud service used by US federal agencies must achieve FedRAMP authorization. Requires extensive security assessment and continuous monitoring.	🔴 Critical
Section 508 of the Rehabilitation Act	US Government	All government digital services must be accessible to users with disabilities. Enforced through ADA compliance and accessibility testing.	🔴 Critical
Government Procurement Regulations (EU Directive 2014/24)	EU	Government procurement must be open, transparent, and competitive. Digital procurement platforms must meet procurement law transparency and audit requirements.	🟡 Moderate
Cabinet Office Digital Services Standard (G-Cloud, UK)	UK Government	Government digital services must meet the Digital Service Standard (user research, accessibility, security, operations, open standards).	🟡 Moderate
UK Procurement Act 2023	UK	Replaces the Public Contracts Regulations. Applies to central government, local authorities, and NHS. Requires transparency in procurement.	🟡 Moderate

NIS2 Directive establishes the cybersecurity foundation for government digital infrastructure. Critical entities (including government procurement systems) must implement baseline cybersecurity measures: risk assessments, incident response plans, supply chain oversight, and staff training. For official guidance on NIS2 requirements, see the NIS2 policy framework. Procurement platforms fall under NIS2 as government-critical infrastructure. This requires choosing platforms where security can be audited and demonstrated.

Data sovereignty requirements (GDPR in EU, UK Data Protection Act in UK, and various US state laws) mandate that government data be hosted in the government’s own jurisdiction. The EU cannot host citizen data on US cloud infrastructure. The UK cannot host citizen data in the EU. The US federal government cannot host classified or controlled data on commercial cloud. This rules out any global SaaS platform that consolidates data across jurisdictions.

eIDAS 2.0 is the EU’s new digital identity regulation (effective May 2024, with deadlines through 2026). By December 2026, all EU member states must offer citizens a secure digital wallet (European Digital Identity Wallet). By December 2027, government services and any service requiring strong customer authentication must accept eIDAS 2.0 credentials. This means government procurement platforms must integrate eIDAS 2.0 authentication — not standard username/password, but digital identity verification through the wallet.

Digital Accessibility (WCAG 2.1 Level AA) is a legal requirement, not a feature. The European Accessibility Act (EAA) becomes enforceable June 28, 2026. The UK requires WCAG 2.1 AA for all government services (UK Accessibility Regulations 2018). The US requires Section 508 compliance for all federal systems. For government procurement platforms serving all citizens, accessibility is mandatory.

FedRAMP is the US government’s security authorization framework. Any cloud service used by US federal agencies must achieve FedRAMP authorization (Moderate or High level). This requires security assessment, continuous monitoring, and certification by an independent assessor. Most SaaS platforms have never pursued FedRAMP because the cost is substantial ($200,000–$500,000+) and the compliance burden is continuous. Government procurement systems, especially those processing federal procurement data, typically require FedRAMP.

---

Why SaaS Commerce Platforms Fail for Government Procurement

Government procurement has regulatory and architectural requirements that mainstream SaaS platforms (Shopify, BigCommerce, Salesforce Commerce Cloud, commercetools) do not meet. The gaps are fundamental architectural misalignments, not configuration issues.

The data sovereignty violation

SaaS platforms are globally distributed with data hosted in multiple regions, replicated across jurisdictions, and governed by US-based privacy policies. The EU requires data residency within the EU (GDPR). Shopify hosts data globally. BigCommerce uses AWS US regions. Salesforce Commerce Cloud is US-based. None provide jurisdiction-specific residency.

A government procurement platform on global SaaS creates permanent data sovereignty violations. The platform operator lacks assurance that government data stays within the jurisdiction. Citizens’ information becomes potentially accessible from the vendor’s US headquarters. This violates GDPR, UK GDPR, and government data protection obligations.

The source code auditability gap

Government cybersecurity requires the ability to audit code running on government systems. Proprietary SaaS platforms prevent this. Government agencies must trust vendor security claims instead of verifying directly.

Critical infrastructure requires verification over trust. Open source code is auditable. Proprietary code is not.

NIS2 compliance includes supply chain risk management. The Digital Operational Resilience Act (DORA) requires assessing third-party digital dependencies. Proprietary platforms prevent this assessment entirely.

The digital accessibility barrier

WCAG 2.1 AA compliance requires systematic accessibility testing and continuous remediation. Most SaaS platforms were built for desktop users and have accessibility debt from years of development. Retrofitting accessibility is expensive and ongoing.

For government, accessibility is mandatory, not optional. A procurement platform inaccessible to users with disabilities violates Section 508 and the European Accessibility Act. Government agencies bear liability for accessibility violations, not platform vendors.

The eIDAS 2.0 integration gap

eIDAS 2.0 requires integration with national digital identity systems and European Digital Identity Wallets. This involves validating government-issued digital credentials and integrating with national identity infrastructure. Most SaaS platforms have not implemented eIDAS 2.0 because the standard is nascent (effective May 2024) and integration is complex.

EU government procurement platforms must support eIDAS 2.0 authentication by 2027. SaaS platforms prioritize integration slowly because the EU represents a small fraction of their global user base. Building on SaaS means waiting years for vendor implementation or building custom integration on top of proprietary code.

How platforms compare for government procurement

Government Procurement Requirement	Shopify Plus	Salesforce CC	commercetools	Self-Hosted (Spree)
Data sovereignty (domestic hosting)	❌ Global SaaS	❌ Global SaaS	⚠️ Custom cloud needed	✅ Any cloud region, GovCloud, on-prem
Source code auditability (open source)	❌ Proprietary	❌ Proprietary	❌ Proprietary	✅ Full source code (BSD 3-Clause)
FedRAMP certification	❌ Not FedRAMP authorized	⚠️ Some components FedRAMP	❌ Not FedRAMP authorized	✅ Can deploy on FedRAMP cloud (GovCloud)
WCAG 2.1 AA accessibility	⚠️ Partial	✅ Strong accessibility	⚠️ Partial	✅ Can be built to WCAG 2.1 AA
eIDAS 2.0 integration	❌ Not integrated	❌ Not integrated	❌ Not integrated	✅ OpenAPI for eIDAS 2.0 integration
Multi-country government compliance	⚠️ Limited	⚠️ Limited	⚠️ Custom build	✅ Per-country legal/tax config
Procurement law transparency	⚠️ Limited audit trails	⚠️ Limited audit trails	⚠️ Limited audit trails	✅ Full transaction + compliance logging
NIS2 compliance demonstrability	⚠️ Vendor claims only	⚠️ Vendor claims only	⚠️ Vendor claims only	✅ Full security auditability

The pattern is definitive: government procurement cannot be reliably built on platforms designed for commercial eCommerce. The regulatory requirements (data sovereignty, source code auditability, accessibility, eIDAS 2.0) and the government-critical infrastructure requirements create a gap that no global SaaS platform fills.

---

What Government Procurement Commerce Actually Requires

Government procurement platforms need operational capabilities and regulatory infrastructure that address both marketplace complexity and government compliance.

Business Requirement	Why It Matters	Capability Needed
Data sovereignty	Government data must stay within jurisdiction	Flexible hosting: any cloud region, on-prem, GovCloud. No global replication.
Source code auditability	Cybersecurity requires code inspection	Open source (BSD, GPL) with security documentation
Digital accessibility (WCAG 2.1 AA)	Services must serve citizens with disabilities	Accessible HTML, keyboard navigation, screen reader support, ARIA labels
eIDAS 2.0 integration	Citizens authenticate with digital wallets	OpenAPI for eIDAS 2.0, SAML support, credential validation
Multi-country compliance	Countries have different procurement laws	Per-country configuration for taxes, audit trails, invoices
Supplier management	Verify credentials and track permissions	Identity verification, role-based access, audit logging
Audit trails	Document every procurement decision	Immutable logging of selections, pricing, awards
Multilingual support	Serve citizens in multiple languages	Multilingual UI, localized content, per-country language options

Global SaaS platforms fail these requirements because data sovereignty, code auditability, and government-critical infrastructure are foundational constraints. Only self-hosted open source platforms deployed on government-approved cloud or on-premise infrastructure meet government requirements.

---

How Does Spree Enterprise Address Government Procurement?

Spree Enterprise combines architectural sovereignty (open source code, flexible deployment, jurisdiction-specific data residency) with procurement-specific functionality (supplier management, audit trails, compliance logging) and accessibility and digital identity infrastructure.

Government Procurement Requirement	Spree Enterprise Feature	How It Works
Data sovereignty	Self-hosted on any cloud or on-prem	Deploy on AWS GovCloud, EU cloud, UK cloud, Azure Government, or on-premise networks. No vendor-controlled global infrastructure.
Source code auditability	Open source (BSD 3-Clause)	Full source code available for security audit, compliance verification, and custom integration. No proprietary black box.
WCAG 2.1 AA accessibility	Accessibility-first UI framework	Native screen reader support, keyboard navigation, color contrast compliance, ARIA labels. Tested against WCAG 2.1 AA standards.
eIDAS 2.0 integration	OpenAPI + SAML support	Integration with eIDAS 2.0 digital identity systems, European Digital Identity Wallets, and national identity providers via SAML assertions.
Multi-country procurement	Per-country configuration	Each country storefront configures procurement law compliance, tax rules, currency, language, audit trail formats, invoice templates.
Supplier management	RBAC + supplier portal	Supplier self-service registration, identity verification, role-based access, supplier status tracking, permission management.
Audit trails	Immutable transaction + compliance logging	Every procurement decision, supplier selection, pricing change, contract award, and system access logged with timestamp, user, and action. Exportable for compliance audits.
Multilingual support	Native i18n + content management	Procurement platform UI in any government language, localized content, currency-aware checkout, per-country language support.

Why Open Source Matters for Government

Spree’s open source architecture means government agencies own the infrastructure, the code, and the compliance evidence. No vendor can change policies, restrict access, or limit government control.

When a government procurement agency needs to verify that their system is secure, they conduct source code audits. When they need to demonstrate NIS2 compliance, they provide their own security assessment instead of vendor claims.

The deployment flexibility lets government agencies choose their own hosting. AWS GovCloud meets FedRAMP requirements for US federal agencies. EU cloud regions meet GDPR data residency. UK cloud meets UK data protection. On-premise deployment serves agencies with the highest security requirements. This flexibility is foundational for government infrastructure.

WCAG 2.1 AA compliance is built in, not retrofitted. Government agencies deploy knowing that citizens with disabilities can access procurement services. This is mandatory, not optional.

eIDAS 2.0 support (via SAML and OpenAPI) lets EU government procurement platforms use citizen digital wallets for authentication. By 2027, this becomes a legal requirement. Building on Spree means this integration is available immediately.

---

Architecture & Deployment for Government Procurement Commerce

Government procurement platforms must balance data sovereignty, security auditability, accessibility requirements, and procurement-law compliance while maintaining the performance and reliability government agencies expect.

Hosting and infrastructure. US federal agencies deploy on AWS GovCloud, Azure Government, or FedRAMP-authorized cloud providers. EU government agencies use EU cloud regions (AWS EU, Azure EU, Google Cloud EU). UK government agencies use UK cloud regions. Some use on-premise deployment for maximum control. Spree supports all of these without vendor-specific infrastructure requirements.

Data residency and jurisdictional isolation. Government data must remain within the government’s jurisdiction. Spree’s per-country data configuration ensures each country’s data stays within that country’s cloud region. A pan-EU procurement platform stores German data in Germany, French data in France, Polish data in Poland, all from a single Spree instance.

Security and auditability. Spree’s open source architecture lets government security teams conduct source code audits, penetration testing, and security assessments on actual running code. The platform logs every access, transaction, and configuration change for NIS2 compliance and government audit trails.

Accessibility infrastructure. WCAG 2.1 AA compliance requires systematic accessibility testing and remediation. Spree’s UI framework is built on accessible HTML patterns (semantic elements, ARIA labels, keyboard navigation). Government teams can extend and customize for additional requirements.

eIDAS 2.0 integration. EU government procurement systems must support eIDAS 2.0 digital identity authentication. Spree’s SAML-based authentication and OpenAPI support let government IT teams integrate with national eIDAS 2.0 implementations without vendor delays.

Procurement compliance and audit trails. Every procurement decision (supplier selection, pricing negotiations, contract awards) must be documented and auditable. Spree’s immutable audit logging records every action with timestamp, user identity, and context. Government agencies export audit logs in formats required by procurement oversight bodies.

Multilingual support. Government procurement serves citizens in multiple languages. Spree’s native i18n support handles UI translation, localized content, per-country messaging, and compliance documentation in any government language.

---

Public Sector Procurement Compliance Resources

For detailed compliance guidance on the regulations affecting government procurement:

Regulation	Scope	What It Means for Government Procurement
NIS2 Directive	EU	Cybersecurity baseline for critical entities, incident reporting, supply chain oversight — see NIS2 Compliance Guide
GDPR (EU) 2016/679	EU	EU data residency, personal data protection, data subject rights — see Full GDPR Compliance Guide
eIDAS 2.0	EU	Digital identity integration, digital wallet authentication (coming soon)
European Accessibility Act (EAA)	EU	WCAG 2.1 AA accessibility for government digital services (coming soon)
FedRAMP	US Government	Security authorization for federal cloud services — see FedRAMP Compliance Guide
Section 508	US Government	Accessibility for federal digital services (coming soon)
UK GDPR	UK	UK data residency, personal data protection (coming soon)

For related industry perspectives on multi-country procurement and regulatory audit trails, see EU Automotive & Manufacturing B2B: Cross-Border Procurement Compliance (coming soon) and HealthTech Commerce: Marketplace Platforms for Digital Products (coming soon).

For regional compliance overviews, see EU Compliance Environment 2026 (coming soon), UK Regulated Commerce 2026 (coming soon), and US Government Commerce Guide (coming soon).

---

Ready to Build Government Procurement Commerce with Spree?

Spree Enterprise gives government agencies an open source commerce platform that combines procurement-specific functionality (supplier management, audit trails, compliance logging) with multi-country government compliance, digital accessibility, and eIDAS 2.0 support. Everything is deployed on government-controlled infrastructure with full source code auditability.

Government procurement platforms require a specific combination of architectural flexibility, regulatory compliance, and accessibility. Whether you are building a new government procurement digital marketplace from scratch, consolidating fragmented procurement systems across government agencies, or modernizing legacy procurement infrastructure, Spree Enterprise provides the platform foundation you need.

The Spree team works with government agencies to scope the right architecture for your procurement requirements and governance model. We help with hosting and data residency decisions, security auditing requirements, eIDAS 2.0 integration, WCAG accessibility standards, and multi-country compliance obligations.

Your government procurement platform should give you full control over data, the ability to audit every line of code, and compliance infrastructure built in from day one. Spree provides all of this without vendor lock-in or platform fees.

Get Started →

Frequently Asked Questions