Defence & Security Procurement in Finland: The PUTU Act

The Act on Public Defence and Security Procurement (1531/2011), known as the PUTU Act, is a separate statute from the general Procurement Act, based on the EU Defence and Security Procurement Directive 2009/81/EC. It applies to defence procurement — defence materiel and related works and services — and to security procurement involving classified information.

Defence materiel means products designed specifically for military use; in practice the boundary follows the EU Common Military List. A security procurement can be, for example, an authority's information system whose implementer handles classified material.

Not every defence administration purchase is a PUTU procurement: the Finnish Defence Forces' ordinary purchases, such as food services or civilian products, are competed under the general Procurement Act. In addition, where essential state security interests so require, a procurement can be carried out entirely outside procurement rules under Article 346 of the Treaty on the Functioning of the European Union.

The PUTU Act has both national and EU thresholds. They are lower than often assumed — the national notice obligation for goods and services starts at €100,000.

The EU thresholds follow the utilities thresholds and were last revised on 1 January 2026. Above-EU-threshold PUTU procurements are also published on TED, so they can be monitored with the same tools as other EU tenders.

The standard PUTU procedures are the restricted procedure and the negotiated procedure — the Act does not provide an open procedure. The supplier's path therefore always starts with a request to participate: the contracting authority selects candidates who then receive the invitation to tender.

This changes bidding dynamics. At the participation stage, suitability and references decide — not price or solution — so a carefully prepared request is a precondition for even entering the competition. In the negotiated procedure the content is refined during negotiations, which rewards suppliers who deeply understand the customer's capability requirements.

Direct award is available somewhat more broadly than under the general Procurement Act, for example in crisis urgency or research and development projects. Market Court jurisdiction and remedies work largely the same way as in ordinary procurement.

The distinctive feature of PUTU procurement is its security requirements. The contracting authority may require commitments on security of supply — continuity of deliveries in emergency conditions — on information security, and on handling classified information.

In practice suppliers often need personnel security clearances for key staff and a facility security clearance for the company, issued by the Finnish Security and Intelligence Service (Supo) under the Security Clearance Act (726/2014). Processing takes time, so start as soon as a defence-sector strategy is decided — not when a tender opens.

The subcontracting chain is also controlled: authorities can require approval of subcontractors and extend security requirements through the whole supply chain. Document your information security practices (for example, preparing for Katakri assessments) and your subcontractors' commitments in advance.

The largest PUTU buyer is the Finnish Defence Forces, whose procurement is mostly run by the Defence Forces Logistics Command. Other significant authorities include the Border Guard, the police and other security authorities, and the bodies responsible for defence real estate.

PUTU procurements above the national threshold are announced in Hilma, and above the EU threshold also on TED. Some upcoming defence procurements are visible as advance information in the authorities' own channels, and market dialogues are an increasingly common practice in the sector.

Rising defence budgets and NATO membership are growing procurement volumes for the long term. NATO-funded and NATO agency competitions are a separate world with their own rules — covered in our NATO procurement guide.

A realistic path into the defence sector often runs through subcontracting: the supply chains of large system suppliers and integrators, such as Patria, have a constant need for specialised capabilities from machining to software. As a subcontractor a company builds sector references and learns the security requirements before pursuing prime contracts.

Prepare systematically: obtain the necessary security clearances, document information security practices, identify which of your products fall under export control, and build a reference bank including demanding civilian deliveries. Dual-use suppliers must know the export control rules.

Monitor national PUTU notices and prior information notices, and take part in market dialogues. Small purchases below the national threshold do not appear in Hilma, so direct contact with contracting authorities and industry events complement systematic monitoring.