Public procurement collusion & EU-funds fraud risk scoring

Public buyers and EU-funds managing authorities spend huge budgets through tenders, but can audit only a small fraction of them by hand. Risk scoring combines open tender data, company registers and ownership graphs to flag bid rigging, single-bidder awards, contract splitting, conflicts of interest and suspicious beneficiary networks. The output is a prioritised list for human auditors and competition authorities, not a verdict. This is market-level screening by authorities; a company watching its own spend is ANOM-009.

Problem & value

• Today: managing authorities and audit bodies select projects for checks by sampling and by tip-offs. Competition authorities rely on leniency applicants, complaints and whistleblowers. Collusive patterns (cover bids, bid rotation, price patterns) are invisible in a single tender but visible across thousands of tenders and across company networks.
• AI value: (1) computing standardised red-flag indicators over whole procurement portfolios, (2) graph analysis of bidders, owners and officials, (3) text analysis of tender documents for tailored specifications, (4) ranking limited audit capacity towards the riskiest cases.
• Evidence base: the Commission's Arachne+ tool is a data-mining and risk-scoring tool for fraud, conflicts of interest and irregularities affecting the EU budget; the legacy Arachne used 107 risk indicators, Arachne+ a reduced set of 78. The Open Contracting Partnership's 2024 guide lists 73 red-flag indicators mapped to OCDS [1][2]. No source used here gives a verified, general hit-rate; published precision depends heavily on the country, labelled cases and indicator set, so measure it on local data.

Variants

• Managing authority / intermediate body (ESIF, RRF, CAP funds): project and contractor scoring to select on-the-spot checks, mostly via Arachne+ [1].
• National audit court, procurement review body, integrity unit: portfolio-wide red-flag dashboards on open data (OCDS, TED/eForms) [2][3][4].
• Competition authority (cartel screening): statistical screens for bid-rigging patterns, e.g. the COMCO (Switzerland), KFTC BRIAS (Korea) and CADE (Brazil) screens named in the research brief for this catalog; use as design references and check each authority's current documentation.
• Large buyer / municipal utility (own tenders): pre-award checks of bidder relationships; the company's internal view is ANOM-009.
• Civil society / journalism: open-data red-flag portals built on the same indicators; targeting named individuals is out of scope here.
• Private use: none.

How it works

1. data ingestion (TED eForms, national portals, OCDS, managing-authority systems, registers)
2. entity resolution (buyers, bidders, owners, officials, addresses, IBANs)
3. indicator layer (single bidding, short deadlines, contract splitting, repeated winners, modification growth)
4. network layer (shared owners/directors/addresses, bid-pair co-occurrence, rotation patterns)
5. text layer (tender documents: tailored criteria, copy-pasted wording across bids)
6. model layer (unsupervised outlier scoring + supervised ranking if labelled cases exist)
7. risk list with reason codes
8. human analyst review
9. audit/check decision
10. feedback (confirmed / dismissed / irregularity found)
11. recalibration

• Indicators first: transparent, rule-based red flags are the backbone; they are auditable and explainable to buyers, courts and reviewers. OCDS Cardinal (MIT-licensed, Rust/Python) computes OCDS-based indicators [3].
• Models on top: gradient boosting on indicator features with sparse labels (audit findings, convictions, debarments); anomaly detection where no labels exist; graph features from ownership and co-bidding networks.
• LLMs: read tender documents and contracts, extract criteria, compare wording across tenders and summarise evidence; they never decide risk.
• Human-in-the-loop: analysts review each flagged case; any measure against a natural person or company requires a human decision with objective facts.

Data preparation

Most inputs are public or semi-public: TED and national portal notices (eForms, OCDS), contract and modification data, beneficiary and contractor data from managing-authority systems, company and beneficial-ownership registers, and tender documents as PDFs. In an authority they sit in procurement portals, grant-management systems, file shares and paper project files. Typical gaps: inconsistent bidder and company identifiers, missing bid-level data, notices that are free text, scanned contracts, unreliable buyer names, and no labelled outcomes from past investigations. Steps: (1) inventory sources and owners, see PREP-001 and PREP-004; (2) pull data via feeds and APIs, see PREP-005; (3) entity resolution to unify companies, owners and officials, and a glossary of indicators, see PREP-012; (4) OCR for scanned tender documents, see PREP-006 and DOC-014; (5) harvest labels from past audit findings, see PREP-020, and build test sets with auditors, see PREP-018; (6) check legal basis for personal data of officials and owners, see PREP-025. Tools: OCDS tooling, Airbyte or dbt for pipelines, Neo4j for the graph. Expect around 35 to 45 percent of the effort in data preparation. Start with the readiness check in GUIDE-003.

Implementation paths

Which path for whom

• public (C): Tender and award data is largely open (TED, eForms, OCDS), the red-flag indicators are well documented, and sovereignty and procurement rules favour open-source analytics on own or sovereign EU infrastructure; Arachne+ (free) can complement it for EU-funds projects.
• enterprise (B): Large contractors, banks and corporate procurement teams screen counterparties and bid networks by combining cloud APIs with commercial register and ownership data.
• developer (C): Building screening and network tools on open data is done with open-source ML and graph stacks, keeping indicators transparent.

Path A — Buy / use provided tools

• Arachne+ (European Commission, EU): free for EU institutions, Member States and implementing partners; combines operational data with external data (Orbis ownership and financials, World Compliance sanctions/PEP/adverse media via Moody's Analytics). Use is voluntary for now; its use is to be reassessed in 2028, and Member States must provide data from 2028 [1].
• Commercial integrity and investigation platforms: analytics/case-management suites from vendors such as Moody's (Orbis), Palantir, SAS, Quantexa, Linkurious and Neo4j partners; check EU hosting, data-protection assessment and public-sector references.
• Choose A when: EU funds are involved (Arachne+ first) or the organisation has no data-science team.

Path B — Build on cloud APIs

• Ingest TED via the Publications Office's developer interfaces (eForms SDK for the data model) [5]; host in an EU region of a hyperscaler or a sovereign cloud (e.g. STACKIT, IONOS, OVHcloud).
• Use a frontier LLM with EU data residency (Mistral, Claude, Gemini or GPT in EU regions) with structured output for tender-document extraction; run scoring in a standard warehouse + notebook stack.
• Choose B when: you need national data sources and custom indicators but no secrecy constraint on the raw documents.

Path C — Self-host (open source)

• Indicators: OCDS Cardinal [3]; DIGIWHIST published procurement-processing code as open source, but its repositories lack a stated licence, so check before reuse [6].
• Stack: PostgreSQL/DuckDB, Python (scikit-learn, XGBoost/LightGBM, isolation-forest style outlier detectors), NetworkX or Neo4j/Memgraph for the ownership graph, an open-weight LLM (Qwen, Mistral, Llama family) via vLLM or Ollama for document extraction, Docling for PDF parsing.
• Hardware: HW1 suffices for indicators and tabular models; HW2 adds LLM document processing. Typical for audit offices with confidentiality requirements.

Path D — Custom training

Worth it only with hundreds or more labelled cases (confirmed irregularities, debarments, cartel decisions). Typical work is a supervised ranker plus graph embeddings per country; labels are biased towards what was already audited, so use calibration and holdout audits of random samples. Fine-tuning an LLM for tender-text analysis is rarely necessary.

State of the art (2026)

• Standardised data: eForms has been mandatory on TED since October 2023, with 46 form subtypes, making cross-country indicators easier [5]. OCDS is the common schema for red-flag tooling [2].
• Indicator-based screening is the established core (single bidding, short submission deadlines, repeated winner-buyer pairs, modifications after award). Graph analytics and ML ranking are early-adopter additions; fully automated decisions are not used and not allowed by the design of tools like Arachne+, which "does not make automatic decisions" [1].
• EU enforcement context: the EPPO investigates fraud against the EU budget; its October 2026 news shows both VAT-fraud and EU-funded project cases [7]. Risk scoring feeds such work but does not replace investigation.
• Limits: a red flag is not evidence of wrongdoing (single bidding can be legitimate in niche markets); missing and inconsistent data across countries; ownership data is incomplete for shell structures; label bias; displacement effects once screens are known; false positives burden honest SMB bidders.

Shared resources & combinations

• Same capabilities (tabular-ml, anomaly-detection, graph-ml): ANOM-009 (company-internal procurement fraud), ANOM-006 (ledger anomalies), ANOM-011 (supplier risk), ANOM-018 (tax audit case selection), ANOM-019 (benefit fraud), ANOM-021 (customs targeting) and PRED-028 (risk-based audit case selection) can share feature stores, graph database, entity-resolution and case-management layers.
• Data/knowledge: KNOW-017 (tender discovery) and KNOW-026 (investigative OSINT, entity resolution) share the TED and register ingestion; DOC-014 supplies document parsing for tenders and contracts; ANOM-016 adds sanctions/PEP/adverse-media screening of bidders.
• Hardware: one HW2 server can run the LLM document pipeline together with the other document-heavy cases; graph and tabular jobs run on CPU nodes.

Effort, cost & KPIs

• Path A: Arachne+ is provided by the Commission at no licence cost to Member States, but data preparation and onboarding take months [1]; commercial platforms are priced by contract.
• Path B: roughly 4–9 months for ingestion, entity resolution and a first indicator set; cost drivers are data licences (company-register and ownership data), data engineering and analyst time, not model inference.
• Path C: similar effort plus operations; the main cost is a small data team (data engineer, analyst, auditor liaison).
• Path D: only after 1–2 years of labelled feedback.
• KPIs: share of confirmed irregularities among flagged cases (precision at top-k) compared with random sampling, coverage of the tender portfolio, analyst time per case, time from award to flag, false-positive burden, share of flags with documented outcome.

People & change

Involve management and the department lead (audit, managing authority, procurement integrity) first, then data owners of the grant and procurement systems, IT, the DPO and legal. Auditors and investigators are the end users; bring them in at indicator design, because their domain knowledge defines useful red flags. The DPO is needed where personal data of officials and beneficial owners is processed, with a DPIA (Art. 35 GDPR) if profiling of individuals is possible and an AVV (Art. 28) with any platform provider. Works council: depends. If the tool only screens external tenders and companies, §87(1) no. 6 BetrVG is not triggered; if it records and evaluates auditors' individual case handling it is, and the council (Personalrat in authorities) must be informed under §90(1) no. 3. Clarify this early. AI literacy: support staff with training on indicators, false positives and the difference between red flag and proof (Art. 4 AI Act, GUIDE-006). Pilot with one programme or one procurement category and review every flag by hand. Typical concern: reputational damage from wrongly flagged firms. Address it by treating scores as a screening aid, documenting reasons, giving contractors a chance to comment before action, and keeping the decision with the auditor. See GUIDE-008, GUIDE-005 and GUIDE-009.

Risks, regulation & compliance

• EU AI Act: depends. Procurement risk scoring of tenders and legal entities is not listed in Annex III; the closest Annex III items are in law enforcement and public-benefits areas, and the credit-scoring item expressly excludes financial fraud detection [8]. If used by or for law-enforcement authorities to assess or predict individuals' offending risk or to profile in criminal investigations, it can be high-risk, and Art. 6(3) never exempts systems that profile natural persons [9]. Art. 5(1)(d) prohibits assessing the risk that an individual commits a crime based solely on profiling; AI that supports a human assessment based on objective, verifiable facts directly linked to criminal activity is outside that prohibition [10]. Therefore: score tenders, projects and companies, and do not score or rank natural persons (officials, owners) on personality or profile. Treat network views as leads for human review, document the classification under Art. 6(4), and check current application dates for Annex III obligations (the AI Act text tracked at [9] lists 2 December 2027, but follow the latest Digital Omnibus status).
• GDPR: owner, director and official data are personal data; define legal basis (public task, Art. 6(1)(e)), purpose limitation, DPIA, and Art. 22 safeguards (no solely automated decisions). Arachne+ operates under Regulation (EU) 2018/1725 with EDPS involvement [1].
• Sector law: EU public procurement directives, Financial Regulation and funds regulations (audit and anti-fraud obligations), national cartel and procurement review law (e.g. GWB in Germany), whistleblower protections. Debarment decisions require due process.
• Risks and mitigations: false accusations (reason codes, human review, no public naming); discrimination against small or foreign bidders (bias audits); gaming (rotate indicators, random control samples); data quality (documented lineage).

Getting started

1. Check whether your funds already offer Arachne+ access through the managing authority and request onboarding [1].
2. Build a clean tender dataset: TED/eForms plus national feeds mapped to OCDS; measure data completeness per field.
3. Implement 10–15 well-defined red-flag indicators (e.g. with OCDS Cardinal) and review the top 50 flags manually with an auditor [2][3].
4. Add entity resolution and an ownership/co-bidding graph; add LLM extraction of tender documents only after the indicators work.
5. Run a DPIA and AI Act classification note; set up a feedback loop and a random control sample to measure real precision.

Sources

1. European Commission, Anti-fraud Knowledge Centre — What is Arachne (Arachne+) — https://antifraud-knowledge-centre.ec.europa.eu/useful-tools/what-arachne_en
2. Open Contracting Partnership — Red Flags in Public Procurement (2024, 73 indicators) — https://www.open-contracting.org/resources/red-flags-in-public-procurement-a-guide-to-using-data-to-detect-and-mitigate-risks/
3. OCDS Cardinal (open-contracting/cardinal-rs) — https://github.com/open-contracting/cardinal-rs
4. Open Contracting Partnership — What is Open Contracting — https://www.open-contracting.org/what-is-open-contracting/
5. Publications Office of the EU — eForms (TED) — https://ted.europa.eu/en/simap/eforms
6. DIGIWHIST GitHub organisation — https://github.com/digiwhist
7. European Public Prosecutor's Office — https://www.eppo.europa.eu/en
8. AI Act Annex III (text) — https://artificialintelligenceact.eu/annex/3/
9. AI Act Article 6 (text) — https://artificialintelligenceact.eu/article/6/
10. AI Act Article 5 (text) — https://artificialintelligenceact.eu/article/5/