Law 14,133/2021 allows the Administration to require bid security, but it does not make that security a mandatory requirement in every procurement procedure. If the option is adopted, Article 58 establishes three points that need to be clearly addressed in the planning documents and the tender notice: the security operates as a pre-qualification requirement, it may not exceed 1% of the estimated contract value, and proof of the security is tied to the moment when the proposal is submitted.
In 2026, Acórdão 1.128/2026-TCU-Plenário addressed the question that often arises in electronic procurement: can the security be required to exist before the bidding stage, as a condition for registering the proposal? The TCU answered yes. The precedent, however, did not make bid security mandatory, nor did it remove the need to design the requirement in a proportionate, clear way that is compatible with the electronic system being used.
Bid security is optional, not a general obligation
The opening provision of Article 58 uses the expression “may be required.” This places the decision within the procurement-planning process. The public body does not have to include bid security in every tender notice and, when it decides to use it, it should be able to connect the requirement to a legitimate purpose of the procurement, such as reducing the risk of bids submitted without a genuine commitment to the contracting process.
This point matters because security has a cost and can affect participation. Automatically requiring the maximum percentage for any type of contract, without examining risk, the market, and the competitive impact, weakens the justification for the measure. The TCU ruling itself treated bid security as a risk-management instrument and noted the need for adequate reasoning in the tender notice, even though, in the specific case, the lack of a dedicated technical justification was not enough to invalidate the challenged clause.
The practical decision, therefore, is not merely “does the law allow it?” The next question should be “why does this procurement need this filter, and what design provides protection without creating an unnecessary barrier?”
The legal cap is up to 1% of the estimated value
Paragraph 1 of Article 58 provides that bid security may not exceed 1% of the estimated contract value. This is a ceiling, not a mandatory percentage. The Administration may set a lower percentage, provided the choice is consistent with the risk it intends to mitigate.
In a procurement with an estimated value of R$ 10 million, for example, 1% corresponds to R$ 100,000. The law does not authorize a higher amount to be required as bid security. It is also important not to confuse this ceiling with the percentages applicable to performance security under Articles 96 through 102, which belong to a different stage and protect the performance of the contract.
In procurements divided into items or lots, the tender notice should make the calculation basis applicable to each participant unequivocal. The wording should avoid forcing the bidder to guess whether the security will be calculated on the total estimated value of the procurement or on the portion it actually intends to compete for. This definition is especially relevant when partial participation is allowed.
When the security must already exist
The wording of Article 58 links proof of the security to the moment when the proposal is submitted and characterizes it as a pre-qualification requirement. Acórdão 1.128/2026-TCU-Plenário gave practical effect to that wording in the electronic environment: the Plenary considered it permissible to require prior submission of the security as a condition for the bidder to register its proposal in the system, before the competitive bidding stage.
This understanding rejects the view that the security could only be demanded from the first-ranked bidder after the bidding stage or together with the traditional qualification documents. If the tender notice adopts bid security under Article 58, the logic recognized by the TCU is that it operates as an entry requirement for the competition.
That does not mean every electronic platform currently has a dedicated field for uploading the security before bidding begins. The TCU itself identified this operational problem and recommended that the Ministry of Management and Innovation in Public Services make adjustments to Compras.gov.br so that prior submission can be required as a condition for registering a proposal.
What to do if the system does not allow upload before bidding
The opinion underlying Acórdão 1.128/2026 recognized that a technological limitation should not, by itself, make the legal mechanism unworkable. Until the platform is adapted, the contracting authority may need to adopt an operational solution that is feasible, provided it is clearly stated in the tender notice and preserves equal treatment, publicity of the procedure, confidentiality of proposal contents until opening, and a minimum level of effectiveness for the security.
In the procurement reviewed by the TCU, the tender notice provided a specific alternative: if it was not possible to attach the security when registering the proposal, the security still had to be issued by the date and time set for opening the session, while the supporting document would be submitted later, after the bidding stage, within the deadline established by the tender notice itself. That specific deadline did not become a nationwide rule. What the precedent reinforced was the possibility of requiring the security to be constituted in advance and of regulating in the tender notice how proof will be operationalized when the platform does not provide the ideal workflow.
For that reason, “submitting after the bidding stage” can mean very different things. One possibility is allowing the security itself to be constituted only after the competition, which empties its role as a pre-qualification requirement. Another is that the security already exists at the time established for the proposal, while the supporting document is uploaded later solely because of a system limitation, under an objective rule in the tender notice.
What Acórdão 1.128/2026 actually decided
The case examined by the TCU concerned an electronic competitive procurement conducted by the Municipality of Aratuípe, in Bahia, financed with federal funds. The bidder challenged its disqualification because the security had not been submitted by the deadline required in the tender notice.
The Plenary unanimously found the complaint unfounded. The statement published by the Tribunal itself records that prior submission of bid security may be required, based on Article 58, as a condition for registering offers in the electronic system, for the purpose of ensuring the seriousness of the offer and preventing opportunistic behavior.
The scope of the ruling must be read precisely. It legally validates the advance requirement; it does not order every public body to start requiring bid security. Nor does it establish a single technical procedure for every platform. On the contrary, the TCU recommended adjustments to Compras.gov.br and the issuance of a federal regulatory act addressing the use of security, in addition to suggesting improvements to the standardized templates of the Federal Attorney General’s Office (AGU) while the issue remained without more detailed regulation.
The requirement must be clearly stated in the tender notice
If the Administration chooses to require bid security, the tender notice should state the percentage or amount, the calculation basis, the deadline by which the security must be constituted, the channel and method for proving it, the accepted forms, and the consequences of noncompliance. In an electronic environment, it should also explain what will happen if the platform does not allow attachment before the bidding stage.
Clarity is decisive because the timing of the security may lead to exclusion of the bidder before or during the competitive stage. A vague clause requiring a bidder to “submit security” without specifying when the security must exist, when the document must be sent, and how it will be verified creates a risk of unequal treatment and litigation.
Compatibility with a confidential estimated budget also deserves attention. If the amount of the security is calculated directly from an estimated budget that remains confidential, the design of the requirement may reveal information the Administration intended to preserve. The TCU itself included this coordination between the two issues among the matters it recommended addressing in templates and regulation.
Which forms of security may be used
Paragraph 4 of Article 58 refers to the forms listed in Paragraph 1 of Article 96. Under the currently effective wording of Law 14,133, security may be provided through a cash deposit or public-debt securities under the legal conditions, a surety bond, a bank guarantee issued by an institution authorized to operate in Brazil, or a capitalization bond funded by a single payment and redeemable for its full value.
The fourth form was added by Law 14,770/2023 and is still omitted from materials that reproduce older versions of the statute. For contracting authorities, this is a practical warning: tender templates need to be checked against the current wording of the law rather than simply recycled from earlier documents.
When the security is returned
Paragraph 2 of Article 58 requires the security to be returned to bidders within 10 business days, counted from execution of the contract or from the date on which the procurement is declared unsuccessful. This rule is specific to bid security and should not be confused with release of performance security, which follows a different legal regime.
The tender notice and internal controls should provide for a return procedure so that the security is not retained without legal grounds after the risk that justified it has ended.
When the security may be enforced
Paragraph 3 of Article 58 establishes two express grounds for enforcement of the full amount: refusal to sign the contract and failure to provide the documents required for contracting. At the federal level, IN SEGES/ME 73/2022 also provides for immediate forfeiture
of bid security when the successful bidder, without justification, refuses to sign the contract or framework agreement, or refuses to accept or collect an equivalent instrument within the established period.
This does not authorize turning the security into a generic fine for any failure occurring during the procurement. Enforcement must be tied to the applicable legal basis and to the procedure established in the tender notice. Acórdão 1.128/2026 itself recommended that templates address the grounds for enforcement and whether a prior sanctions proceeding is required in situations discussed by the Tribunal.
Bid security is not performance security
Bid security operates before contracting and protects the seriousness of the commitment assumed by the bidder. Performance security, provided for beginning in Article 96, is intended to protect the Administration against risks in the performance of a contract that has already been executed.
For that reason, the percentages are not interchangeable. For ordinary performance security, Article 98 allows up to 5% of the initial contract value, with the possibility of reaching 10% when justified by technical complexity and risk. For major engineering works and services, Article 99 allows a surety bond with a step-in clause of up to 30%. None of this changes the 1% ceiling for bid security under Article 58.
Bid security should also not be confused with economic and financial qualification. The former is a pre-qualification requirement focused on commitment to the offer. The latter assesses the bidder’s economic and financial capacity under the specific qualification rules in the law. Mixing the two concepts tends to produce redundant or disproportionate requirements.
How to decide whether it is worth requiring
A defensible decision starts with the concrete risk of the procurement. If past experience shows significant withdrawals, speculative bids, recurring difficulty in formalizing the contract, or a high cost of restarting stages, bid security may make sense as a filter. If the subject matter is simple, the market is narrow, and the cost of the security is likely to discourage participants, the Administration should consider whether the benefit outweighs the competitive impact.
The chosen percentage should follow the same logic. The 1% ceiling does not have to be the automatic answer. A lower percentage may be enough to signal commitment and reduce the risk of withdrawal without imposing the highest cost allowed by law.
It is advisable to record the justification in the procurement-planning file and reflect the decision in the tender notice in a verifiable way. The benefit is twofold: it improves transparency for bidders and makes it easier, in a future oversight review, to demonstrate that the requirement was not inserted by habit or merely copied from a template.
A decision framework for electronic procurement
Before publishing the tender notice, the Administration should determine internally whether there is a concrete risk that justifies bid security and whether a less burdensome means could address that risk. If it chooses to require security, it should define a percentage of up to 1%, the calculation basis, and the permitted forms under the current law.
Next, it needs to set the time by which the security must be constituted in a manner consistent with Article 58 and the TCU’s interpretation: as a pre-qualification requirement connected to submission or registration of the proposal, before the competitive stage. If the system does not accept the document at that time, the tender notice should distinguish precisely between the date by which the security must exist and the date or procedural stage at which proof will be uploaded.
Finally, the solicitation should provide for verification, return within 10 business days upon the legal triggering events, and grounds for enforcement without expanding through generic wording what the law establishes. On issues that remain sensitive, such as confidentiality of the estimated budget, suspension of the procurement, and peculiarities of the electronic platform, the solution should be developed with legal support and in accordance with the rules of the relevant government entity and the system being used.
The short answer for the contracting authority
Yes. Law 14,133 allows the Administration to require bid security. It is not a general obligation: it is an option that must be planned and stated in the tender notice. The amount may not exceed 1% of the estimated contract value.
As for timing, Article 58 links proof to submission of the proposal, and Acórdão 1.128/2026-TCU-Plenário recognized as valid a requirement imposed before the bidding stage, including as a condition for registering the proposal in the electronic system. When the platform does not support prior upload, the tender notice may need to create a clear operational solution that preserves equal treatment, confidentiality of proposal contents, and the effectiveness of the security.
The decisive point is not to turn the precedent into a shortcut. The ruling increased legal certainty for prior submission, but it kept proportionality, justification, and the specific design of the procurement at the center of the administrative decision.
