The regulatory specifics of the public sector
Outsourcing in the French public sector operates under significantly different rules from the private sector. Public entities (ministries, local authorities, hospitals, universities) are subject to the Code de la commande publique, which requires tendering procedures from €40,000 excluding VAT. Provider selection cannot be negotiated directly except in strictly regulated exceptions.
Required certifications by sector
- Health data (hospitals, CPAM, mutuals): HDS type 1 and 2 certification mandatory
- Sensitive information systems (defence, justice): ANSSI SecNumCloud qualification required
- Tax and social data (CAF, URSSAF): EU-established provider mandatory, annual audit
- Digital citizen services (municipalities, regions): RGS (General Security Framework) applicable
- Education data (universities, schools): enhanced GDPR for minor data
How to access public procurement: UGAP and framework agreements
UGAP (Union of Public Purchasing Groups) is France's public purchasing centre. Being listed on UGAP allows a provider to be accessible to all French public actors without individual tendering procedures. Corpshore is in the process of UGAP listing in BPO and IT services categories, which will significantly simplify access for our public sector clients.
Data sovereignty: a growing issue
The concept of digital sovereignty is increasingly prominent in public sector specifications. Post-pandemic, many public entities require their data to be hosted on EU or even French territory. This requirement, combined with SecNumCloud qualification, significantly limits the number of eligible providers — a competitive advantage for Corpshore, whose European infrastructure has been operational since 2025.