How Smart Cities Buy Technology in 2026: New Procurement Models Explained

When Baltimore spent $38 million on a smart lighting system in 2019, the vendor promised 30% energy savings and real-time traffic optimization. Three years later, the city was locked into a proprietary platform that couldn’t talk to its existing infrastructure.

The streetlights worked, but the data stayed trapped in the vendor’s cloud, and the contract prevented Baltimore from switching providers without forfeiting the entire investment.

This is the problem cities worldwide spent 2024 and 2025 solving. The answer wasn’t better technology. It was better buying.

Municipal procurement has undergone its most significant transformation in decades. Cities are no longer purchasing products with fixed specifications. They’re commissioning outcomes, funding competitive R&D sprints, and structuring contracts where vendors get paid only when measurable public benefits materialize. The shift affects every technology vendor selling to government, every startup pitching smart city solutions, and every procurement officer writing an RFP.

This guide breaks down the five procurement models defining how cities buy technology in 2026, why they emerged, and what they demand from vendors who want to win contracts.

I. Why Traditional Procurement Broke

Traditional municipal RFPs followed a simple pattern: write 50 pages of technical specifications, accept the lowest qualified bid, install the equipment, and pay when the boxes arrive. This worked fine for buying fire trucks. It failed spectacularly for buying technology.

The core problem was the specification trap. By the time a city drafted detailed technical requirements, got them approved through committee, posted the RFP, evaluated bids, awarded the contract, and waited for delivery, the technology landscape had already shifted. Requirements written in 2022 for sensors that measured air quality often specified hardware that was obsolete by deployment in 2024. Cities were contractually obligated to accept equipment they no longer needed, solving problems that had evolved.

Worse, the lowest-bid mentality encouraged vendors to meet specifications exactly while building in lock-in mechanisms that made switching impossible. A city might save $2 million on initial hardware costs only to discover three years later that adding new functionality required replacing the entire system. Kansas City’s initial smart city deployment in 2016 cost $15 million. Expanding it to cover additional neighborhoods in 2020 required a complete system replacement at $28 million because the original vendor’s platform couldn’t integrate with newer sensors.

The breaking point came between 2022 and 2024. High-profile failures in Dallas, Phoenix, and several European cities made clear that procurement structure mattered more than technical capability. Cities that wrote better RFPs got better outcomes, regardless of budget size. This realization, combined with new regulatory pressure from the UK Procurement Act 2023 and the EU’s push for digital sovereignty, forced a fundamental rethinking of how cities buy technology.

II. Challenge-Based Procurement: Buying Solutions, Not Specifications

The first major shift replaces technical specifications with problem statements. Instead of requesting “10,000 IoT sensors with specific connectivity protocols,” cities now post challenges like “reduce traffic fatalities by 25% within three years” and invite vendors to propose whatever combination of hardware, software, and services will achieve that outcome.

New York pioneered this approach with its Vision Zero technology procurement in 2024. Rather than specifying camera types, data storage requirements, and analytics platforms, the city described the safety problem and the metrics for success.

Vendors proposed solutions ranging from AI-powered crosswalk monitoring to connected vehicle systems to predictive maintenance for traffic signals. The winning bid combined all three, something the city’s procurement team would never have specified because they didn’t know that combination was possible.

The GovTech Lab in the Baltic region has formalized this into a repeatable methodology: Scan, Pilot, Scale. In the Scan phase, cities work with researchers to map the problem and identify potential approaches. The Pilot phase tests 3-5 competing solutions in real conditions over 6-12 months. Only solutions that demonstrate measurable impact move to the Scale phase, where they’re deployed citywide. This structure spreads risk across multiple vendors and ensures cities only pay for approaches that actually work.

The ‘Smart City Challenge 2025’ took this further with a six-phase competition that started with 200 concept papers and ended with 12 funded pilots. Each phase eliminated proposals that couldn’t demonstrate viability, technical feasibility, and cost effectiveness. The process took nine months but produced solutions that were immediately deployable because they’d been validated against real urban challenges, not theoretical specifications.

Challenge-based procurement works when cities have the internal expertise to define problems clearly and evaluate solution quality. It fails when cities outsource problem definition to consultants or when evaluation criteria are too subjective.

Dresden’s 2024 mobility challenge received 40 proposals but couldn’t select a winner because the evaluation committee disagreed on how to weight innovation versus proven reliability. The procurement was canceled after eight months, wasting $400,000 in evaluation costs.

For vendors, this model requires a fundamental capability shift. Success depends less on meeting technical specifications and more on demonstrating outcome delivery. Companies need case studies showing measurable impact, not just feature lists. A sensor manufacturer that can prove its deployment reduced energy costs by 18% in a comparable city will win over a competitor offering more sensors at a lower price.

III. Outcome-Based Contracts: Pay for Results, Not Equipment

The second major shift changes when and how vendors get paid. In traditional contracts, payment occurred when equipment was delivered and installed. In outcome-based contracts, payment is tied to achieving specific, measurable results. The vendor assumes the performance risk.

This fundamentally reallocates risk from cities to vendors. If a smart lighting system was supposed to reduce energy costs by 30% but only achieves 15%, the vendor doesn’t get full payment. If an AI-powered traffic system was meant to reduce commute times by 20 minutes but only saves 8, the contract includes penalties. Vendors must now finance projects upfront and wait months or years to recoup costs based on actual performance.

The ‘UK Procurement Act 2023’, which took full effect in early 2025, embedded this approach into all major government contracts. The legislation introduced the “Most Advantageous Tender” evaluation framework, replacing the previous “Most Economically Advantageous Tender” standard. The difference matters: procurement teams must now evaluate total public benefit over the contract lifecycle, not just initial cost plus features.

The updated Social Value Model, detailed in Policy Procurement Note 002, mandates that social value accounts for at least 10% of evaluation weighting for all central government contracts above specific thresholds. Social value includes carbon reduction, local job creation, skills development, and digital inclusion. A vendor might submit the lowest bid technically, but lose to a competitor who commits to training 50 local residents in system maintenance or who can prove their solution reduces carbon emissions by a specific tonnage annually.

Performance tracking requirements have become equally stringent. Cities must log evidence of delivery against key milestones throughout the contract. Monthly or quarterly reports document whether the vendor is on track to meet outcome targets. This transparency helps, but it also creates documentation burdens that smaller vendors struggle to meet. Birmingham’s smart waste management contract requires the vendor to submit 23 separate performance reports annually, each tied to specific contract clauses.

Energy Performance Contracting provides the clearest example of how this works in practice. An energy services company installs LED lighting, HVAC upgrades, and building management systems in municipal facilities at no upfront cost to the city. The vendor is repaid through a percentage of the actual energy savings generated over 10-15 years. If the systems save $500,000 annually, the vendor receives $300,000 per year until the investment is recovered plus a margin. If savings underperform, the vendor’s repayment timeline extends or they absorb the loss. The city only pays for verified results.

This model attracts service-oriented firms comfortable with performance risk and terrifies traditional equipment vendors who lack the capital reserves to finance multi-year deployments. It also requires cities to invest in measurement infrastructure. You can’t pay for outcomes you can’t measure reliably.

IV. Public-Private Partnerships: Who Pays, Who Profits, Who Carries Risk

Large-scale smart city infrastructure requires capital investments that routinely exceed municipal budgets. A citywide 5G network costs $200-400 million. An integrated mobility platform costs $50-100 million. Cities rarely have this money available upfront, and bond issuances take years. Public-Private Partnerships provide an alternative financing structure where private capital funds infrastructure in exchange for revenue rights or long-term service contracts.

The structure of a PPP determines its success more than the technology involved. At its core, a PPP is a risk-sharing agreement: the city provides something valuable (often physical assets, regulatory approvals, or guaranteed demand), the private partner provides capital and technical expertise, and both parties share in the upside while defining who absorbs which downside risks.

LinkNYC offers the textbook case study. New York City owned thousands of obsolete payphone booths occupying valuable sidewalk real estate. CityBridge, a consortium led by Intersection (Google/Sidewalk Labs), Qualcomm, and CIVIQ Smartscapes, proposed transforming these into smart kiosks offering free WiFi, phone calls, device charging, and digital displays. The deal structure was straightforward: the city provided access to the physical locations and regulatory permission to operate, the consortium invested $200 million in hardware and installation, and the consortium retained rights to advertising revenue generated on the digital screens.

The risk allocation was carefully structured. CityBridge assumed all technical risk (if the kiosks didn’t work, they absorbed the cost), operational risk (they had to maintain them), and market risk (if advertising revenue underperformed projections, that was their problem). The city assumed no financial risk but retained approval rights over advertising content and kiosk locations. The city also negotiated revenue sharing: after CityBridge recovers its investment plus a specified return, excess revenue flows to municipal coffers.

This structure worked because incentives aligned. CityBridge needed the kiosks to function reliably and attract users to generate advertising value. The city needed connectivity infrastructure but couldn’t afford to build it. Both parties benefited from high utilization. The project has installed over 1,800 kiosks since 2016, providing free WiFi to millions of users annually.

India’s Smart Cities Mission demonstrates PPP at national scale. The program has deployed approximately 21% of its funding through PPP structures, using Special Purpose Vehicles to bypass traditional municipal bureaucracy. An SPV is a separate legal entity created for a specific project, jointly owned by the city and private partners. This structure allows faster decision-making and attracts institutional capital that won’t invest directly in municipal budgets due to complexity and political risk.

The challenge with PPPs is that private partner ROI requirements can conflict with public benefit priorities. A vendor financing a smart parking system through PPP needs utilization rates high enough to generate revenue. If the city wants to reserve parking for residents at below-market rates, that reduces the vendor’s return and makes the partnership unviable. Successful PPPs require transparent negotiation of these tensions upfront, not discovery mid-project that the financial model doesn’t work.

PPPs fail when risk transfer is incomplete. If the city ends up backstopping vendor losses or the vendor can walk away from underperforming projects without consequences, the partnership structure provides no advantage over traditional procurement.

The key question for any PPP is simple: who loses money if this doesn’t work? If the answer is unclear, the contract isn’t structured properly.

V. Pre-Commercial Procurement: Buying R&D for Problems Without Solutions

Some urban challenges don’t have market-ready solutions. No vendor sells a proven system for eliminating microplastics from stormwater runoff. No commercial product exists for real-time carbon capture at the neighborhood scale. When cities face problems this complex, traditional procurement fails because there’s nothing to buy.

Pre-Commercial Procurement, used extensively by the European Union, solves this by turning the procurement process into a competitive R&D program. Instead of buying a product, cities buy R&D services from multiple competing vendors simultaneously, with the understanding that only the most successful solutions will progress to full deployment.

The structure involves three stages. In the concept design phase, cities pay 3-5 vendors to develop detailed technical proposals addressing the problem. The best 2-3 proposals move to prototype development, where vendors build working demonstrations. These prototypes undergo testing in real conditions during the pilot phase. Only solutions that perform reliably at this stage qualify for full-scale procurement.

Each stage is a separate contract with separate funding. A vendor might receive €200,000 for concept design, €800,000 for prototype development, and €2 million for pilot testing. If their solution fails at any stage, they keep the payments received but don’t progress further. This structures risk: vendors invest their own capital beyond what the city pays, and cities spread their investment across multiple approaches rather than betting everything on one solution.

Recent EU-funded PCP projects include developing AI-powered carbon capture facilities for urban industrial zones, autonomous snow-clearing vehicles for airports, and integrated health monitoring platforms that combine air quality sensors with anonymized patient data to predict respiratory health crises. The carbon capture project funded four competing teams through concept design, two through prototype development, and one through pilot testing in Rotterdam. That final solution is now commercially available and has been deployed in three additional European cities.

PCP works when problems are technically complex, when solution uncertainty is high, and when the city has patient capital willing to fund multi-year development cycles. It fails when cities try to use it for problems that already have adequate commercial solutions or when evaluation criteria change between stages, causing vendors to optimize for the wrong outcomes.

For vendors, PCP represents high risk and high reward. Winning a PCP contract doesn’t guarantee full deployment or commercial success, but it provides development funding and a reference customer if the solution works. Companies pursuing PCP need R&D capability, tolerance for uncertainty, and business models that don’t depend on immediate revenue. This favors research-backed startups and established firms with dedicated innovation budgets over smaller vendors operating on tight margins.

Cities should consider PCP when challenge-based procurement receives no viable proposals, when existing solutions have failed repeatedly, or when the problem requires fundamental technical innovation. It’s the most expensive procurement model per project and has the highest failure rate, but it’s the only model that creates solutions where none existed.

VI. The Vendor Lock-In Problem: As-a-Service Models and Digital Sovereignty

As cities move away from purchasing equipment outright, subscription-based “as-a-Service” models have become dominant.

Lighting-as-a-Service, Mobility-as-a-Service, Parking-as-a-Service. These models offer clear advantages: lower upfront costs, vendor-managed maintenance, easier scaling as city needs change.

A city can start with smart lighting for 5,000 streetlights and expand to 15,000 without new capital appropriations or procurement processes.

The trap emerges slowly. After three years of monthly subscription payments, the city has spent significant money but owns nothing. All data resides in the vendor’s cloud platform. All analytics run on the vendor’s proprietary algorithms. All integrations connect through the vendor’s APIs. Switching providers means starting over from scratch, losing historical data, and retraining staff on completely new systems. The exit cost becomes higher than the pain of staying with an underperforming vendor.

This isn’t theoretical. A mid-sized European city deployed a smart parking platform in 2021 under a five-year subscription contract. By 2024, the vendor had raised prices twice, added mandatory modules the city didn’t need, and refused to provide raw data exports for the city’s own analytics. When the city explored alternatives, it discovered that switching would cost €1.2 million in new hardware (the sensors were proprietary and incompatible with competing platforms), nine months of downtime during transition, and the loss of four years of parking utilization data that existed only in the vendor’s format. The city renewed the contract.

Different as-a-Service models carry different lock-in risks:

Modular SaaS (Example: Cisco Kinetic): Cities pay only for features used, such as traffic management or lighting control. The benefit is cost flexibility. The lock-in risk is high because these platforms typically require the vendor’s hardware infrastructure. A city can turn features on and off, but can’t easily move to a competing platform without replacing physical assets.

Pay-As-You-Go (Example: AWS IoT): Cities pay based on actual usage, measured by data volumes or API calls. This provides extreme scalability for applications like smart metering where seasonal variation is significant. The lock-in risk is medium. While the cloud infrastructure is portable in theory, practical migration requires deep technical expertise that most cities lack, and rebuilding custom applications on a new platform takes months.

Tiered Subscription (Example: Siemens MindSphere): Cities select a service tier based on size or feature needs. Different tiers offer different capabilities at different price points. The lock-in risk is low relative to other models because platforms like MindSphere support open protocols like MQTT and OPC UA, making data portability feasible. The city still faces switching costs, but they’re measured in weeks of effort rather than months and millions.

Cities are responding with three mitigation strategies, often called “digital sovereignty” initiatives. These strategies don’t eliminate lock-in risk entirely, but they reduce it enough to make switching viable.

First, cities are demanding open standards compliance. Procurement contracts now require that all platforms support frameworks like FIWARE (an open-source context information management system) or oneM2M (a global standard for IoT interoperability). These standards ensure that data can be exported in usable formats and that third-party applications can connect without vendor permission. Dresden made FIWARE compliance mandatory for all smart city procurements in 2024. This limits vendor options but guarantees the city isn’t trapped.

Second, cities are including explicit exit strategies in contracts. These clauses mandate that vendors maintain all city data in standardized formats throughout the contract, provide full data exports within 30 days of contract termination, and document all custom integrations sufficiently that a new vendor can replicate them. Some contracts even require vendors to provide transition support to competitors. Vienna’s 2025 IoT platform contract includes a clause requiring the vendor to spend up to 200 hours assisting a replacement vendor with data migration and system understanding at no cost to the city.

Third, cities are adopting platform-agnostic architectures that separate the user interface and business logic from the underlying vendor infrastructure. Instead of using the vendor’s dashboard directly, cities build their own “urban data platform” that pulls information from multiple vendor systems through standardized APIs. This approach, called a “sovereign virtualization stack,” means the city controls the integration layer. Vendors can be swapped out beneath this layer without disrupting the interfaces that city staff and residents use. Munich implemented this architecture in 2023 and has since replaced three different sensor vendors without any visible change to the public-facing mobility app.

These strategies work, but they require technical sophistication many cities lack. Smaller municipalities often can’t afford the staff needed to manage platform-agnostic architectures or evaluate open standards compliance. This creates a two-tier system: large cities with strong IT departments gain meaningful protection against lock-in, while smaller cities remain vulnerable.

The vendor perspective matters too. Open standards and easy exits reduce switching costs, which reduces the lifetime value of each customer. Vendors compensate by charging higher upfront fees or higher monthly subscriptions to recover costs faster.

Cities choosing open platforms may pay 15-25% more than cities accepting proprietary solutions.

This is the price of freedom.

VII. What This Means for Technology Vendors

These procurement shifts demand different capabilities than vendors traditionally needed to win government contracts.

First, vendors must develop outcome delivery expertise, not just product development capability. Cities no longer care what your technology does. They care what problem it solves and how you prove it worked. This requires building measurement systems into every deployment, maintaining detailed case studies with specific metrics, and being able to articulate return on investment in terms cities understand (dollars saved, lives improved, carbon reduced). A traffic management company needs to track not just system uptime but actual reduction in commute times, with the data collection infrastructure to prove it. Vendors that can’t measure and document outcomes won’t survive outcome-based procurement.

Second, vendors need contract structure expertise. Understanding risk allocation, payment milestones, performance penalties, and social value requirements has become as important as technical ability. Small vendors often lack this expertise and lose bids to larger competitors who can afford procurement specialists. The alternative is partnering with experienced systems integrators who understand contract mechanics, though this reduces margins. The shift favors vendors who invest in legal and finance capabilities early, treating them as core competencies rather than overhead.

Third, vendors must develop social value measurement capabilities. UK vendors bidding on government contracts now submit detailed plans for how they’ll create local jobs, reduce carbon emissions, support SME subcontractors, and promote digital skills. These commitments become legally binding contract terms. A vendor promising to hire 20 apprentices must document those hires and demonstrate that training occurred. This requires HR infrastructure, tracking systems, and reporting processes most technology companies have never needed. Vendors operating internationally must adapt these capabilities to each market’s specific social value requirements, which vary significantly between the UK, EU, and other regions.

Choosing which procurement model to pursue depends on company maturity and capabilities. Challenge-based procurement suits vendors with proven solutions and strong case studies but limited capital for risk-taking. Outcome-based contracts favor larger vendors with balance sheets strong enough to finance multi-year projects before payment. PPPs require patient capital and partnerships with financial institutions. PCP targets R&D-capable organizations comfortable with uncertainty. Vendors should assess their financial position, technical capability, and risk tolerance before deciding which procurement models to pursue.

The documentation burden has grown substantially. A typical smart city RFP response in 2026 includes technical specifications (expected), outcome guarantees with measurement plans (now standard), social value commitments with tracking mechanisms (mandatory for many contracts), risk allocation proposals, data sovereignty plans, open standards compliance documentation, and detailed financial models showing how the vendor gets paid under different performance scenarios.

Preparing a competitive bid requires 200-400 hours of effort across technical, legal, and financial teams. Smaller vendors often can’t afford this, creating a barrier to entry that concentrates the market.

VIII. The Real Competition Isn’t Technology

The fundamental shift in municipal procurement means cities now compete on buying sophistication as much as budget.

A city with excellent procurement processes and modest funding will outperform a wealthy city that writes poor contracts. The evidence is visible: San Jose and Austin have deployed more successful smart city infrastructure per capita than much larger cities with bigger budgets because their procurement offices understand how to structure challenge-based competitions and outcome-based payments.

What separates successful cities from struggling ones isn’t the technology they buy. It’s how they define problems, how they allocate risk, how they measure outcomes, and how they structure vendor relationships. Cities that treat vendors as partners rather than contractors, that invest in procurement expertise as much as technical infrastructure, and that write contracts favoring results over deliverables consistently achieve better outcomes.

The next phase of this evolution is already visible. As these five procurement models mature, standardization will increase. Industry groups are developing template contracts for outcome-based lighting projects, standardized evaluation rubrics for challenge-based competitions, and reference architectures for platform-agnostic IoT deployments. This standardization will lower transaction costs and make sophisticated procurement accessible to smaller cities that currently lack the resources to develop custom approaches.

For vendors, the competitive landscape has permanently changed. Success requires understanding not just what cities need but how they buy, how they measure success, and how they allocate risk.

The vendors winning contracts in 2026 aren’t necessarily those with the best technology. They’re the ones who best understand procurement structure and can align their business models with how cities want to buy.