Evaluating a photo platform: criteria for comparison and tenders
You assess a photo platform for employee and ID photos in six areas: image quality and standards, capture channels, integration, data protection and hosting, operations and support, and costs over the contract term. Before comparing vendors, define the criteria that absolutely must be met and set their weighting. Ask for evidence instead of promises, and test with real photos of your workforce.
If you need to collect ID photos for hundreds or thousands of employees, whether for an ID card replacement, a new access control system, or to replace the photo appointment, you will compare different vendors sooner or later. This guide explains which criteria matter, how to weight them, and what evidence to request. Simply add the checklist to your requirements specification.
Which criteria belong in the evaluation of a photo platform?
Six areas cover the entire process, from the photo on the smartphone to the printed badge. A photo platform is software that collects ID and employee photos, checks them automatically, and passes them on to ID card, HR, or access control systems. If you only compare the capture, you often overlook the expensive parts of the project: following up on unusable photos and the import into the ID card system.
| Area | Key question |
|---|---|
| Image quality and standards | Does the platform check photos automatically against ICAO 9303 and ISO/IEC 19794-5, and can you add your own requirements? |
| Capture and user experience | How easy is the upload for employees who don't have a company email or who work in shifts? |
| Integration and export | Do the photos appear in the right format in the ID card, access control, or HR system? |
| Data protection and security | Where is the data stored, who has access to it, and when is it deleted? |
| Operations and support | What availability is guaranteed in the contract, and who is there to help when problems arise? |
| Costs over the contract term | How high are the project costs, including internal effort and exit? |
Before you compare vendors, define your own requirements: framing, background, format, objective. An employee photo guideline is the best basis for this, because only then can you check whether a platform actually enforces these requirements.
Which must-have criteria rule out vendors early on?
Must-have criteria are the few requirements that absolutely have to be met so that your project does not fail for legal or technical reasons. A must-have criterion is a requirement that excludes a vendor if it is not met, regardless of the vendor's score in the other areas. Typical must-have criteria for a photo platform:
- Data location and legal basis. You know in which country the photos are processed. If data is disclosed abroad, adequate protection or appropriate safeguards are required there (Art. 16 FADP).
- Data processing contract. The vendor signs a data processing agreement (DPA) under Swiss or EU law with a clear rule on subprocessing. Learn more in the article What do DPA and SLA mean?
- Valid ISO/IEC 27001 certificate with a scope that covers software and operations (more on this below).
- Export format for your ID card system. The photos arrive in the resolution, format, and file names that your card printer or access control system expects.
- Channels for all employees. In plants with shift operations or without company email, you need alternatives to the email link, such as a QR code, kiosk, or assisted capture.
- Exit. At the end of the contract, you get all your data back in full, along with a confirmation of deletion.
For public authorities, accessibility comes on top: the Swiss Federal Administration requires the eCH-0059 standard, which refers to WCAG 2.1 level AA. Limit yourself to five to seven must-have criteria. Every additional must-have shrinks the field of vendors without improving the quality of the decision.
How should you weight the criteria?
The weighting follows the project risk, not the length of the feature list. For a company with 1,000 to 10,000 employees, this distribution is a good starting point:
| Area | Weight | Why |
|---|---|---|
| Image quality and standards | 20 % | Unusable photos cost follow-ups and print jobs. |
| Capture and user experience | 20 % | Every hurdle lowers the response rate. |
| Data protection and security | 20 % | Photos are personal data and often remain stored for years. |
| Integration and export | 15 % | Manual rework during import eats up the savings. |
| Costs over the contract term | 15 % | Relevant, but only in comparison with the internal effort. |
| Operations and support | 10 % | Critical at peak times, such as shortly before a deadline. |
Adjust the values to your project. A university launching during the semester puts more weight on capture, while a public authority prioritizes standards and accessibility.
Set the weighting before receiving bids
Define criteria and weights before you open the bids. In Switzerland, award criteria and their weighting must be disclosed in public tenders (Art. 29(3) PPA), and the same applies in Germany (Section 58(3) VgV).
Don't overweight the price
Awarding on the lowest price alone is only permitted for standardized services (Art. 29(4) PPA). In Germany, the most economically advantageous bid is selected, which means that the best price-performance ratio is decisive (Section 127(1) GWB). In Austria, the lowest-price principle is only permitted for services that are described clearly and completely (Section 91(4) BVergG 2018). A photo platform with capture, checking, and integration rarely offers this kind of standard service.
What evidence should you request?
Before the decision, the vendor must provide evidence for each criterion. Promises made in a presentation cannot be assessed, but documents and tests can.
| Criterion | Evidence |
|---|---|
| Automated standards check | Overview of checks, test run with your images |
| Data location | Contract clause and list of subprocessors |
| Data processing | Draft contract (DPA) |
| Information security | ISO/IEC 27001 certificate: scope and validity period |
| Deletion | Deletion concept with configurable retention periods |
| Interfaces | Documentation and a sample file for your test import |
| Responsiveness and customer service | SLA with availability, response times, and support language |
| Experience | Reference of comparable size, ideally with contact details |
A processor is the vendor that processes photos on behalf of your organization. The law makes choosing the processor your responsibility: in Switzerland, the controller must ensure that the processor is able to guarantee data security (Art. 9(2) FADP). In the EU, processors may only be used if they provide sufficient guarantees for technical and organizational measures (Art. 28(1) GDPR).
Is the certificate valid for the data center or the vendor?
The data center's ISO 27001 certificate only applies to the hosting; it does not cover the vendor's software, operations, and support. So ask about the scope and about who was awarded the certification. Also check the version: certificates under ISO/IEC 27001:2013 expired at the end of the transition period on October 31, 2025. You can find more information in the article on ISO 27001-certified data centers.
How do you test a photo platform before deciding?
A real employee pilot proves more than any demo. Invite two to three vendors that meet all must-have criteria and run a test under real conditions:
- Participants: 30 to 50 people from different groups, such as office staff, shift workers, and employees without company email.
- Channels: all the options you want to use later, such as smartphone link, QR code, kiosk, or assisted capture.
- Requirements: your own custom photo guideline, not the vendor's default option.
- Import: transfer the checked photos once, in full, into your ID card or access control system.
Measure four values: the time per person, the share of rejected photos, the manual review effort per photo, and the rework during import. The cost calculation below is based on these figures. Also look at how quality is checked: the ICAO 9303 and ISO/IEC 19794-5 standards define what an ID photo must look like. The article ICAO 9303 vs. ISO/IEC 19794-5 explains the difference.
What applies to public tenders in Switzerland, Germany, and Austria?
Contracting authorities are required to put contracts out to tender above certain thresholds and to disclose their award criteria and the weighting of these criteria. The decisive factor is the estimated contract value over the entire term.
| Contracting authority | Supply and service contracts |
|---|---|
| Switzerland, federal level (PPA) | direct award below CHF 150,000, invitation procedure from CHF 150,000, open or selective procedure from CHF 230,000 |
| Switzerland, cantons and municipalities (IAPP 2019) | direct award below CHF 150,000, invitation procedure below CHF 250,000, open or selective procedure from CHF 250,000 (scope of international treaties from CHF 350,000) |
| EU, central government authorities | EU-wide tender from EUR 140,000 |
| EU, other contracting authorities (including states and municipalities) | EU-wide tender from EUR 216,000 (excl. VAT) |
As of November 2026. The EU thresholds apply to Germany and Austria. The Swiss thresholds remain unchanged for 2026 and 2027; the EU thresholds have applied since January 1, 2026 (Delegated Regulation (EU) 2025/2152). Some cantons still apply the IAPP 2001, under which the thresholds are lower.
The law distinguishes between two types of criteria. Suitability criteria check whether a vendor is able to perform the contract, such as its professional, technical, and organizational capacity (Art. 27 PPA). Award criteria assess the bid directly. Under Art. 29 of the Federal Act on Public Procurement, factors to be considered in addition to price and quality include appropriateness, life-cycle costs, customer service, functionality, and level of innovation. Under Section 58 VgV in Germany, quality covers everything relating to accessibility, staff, and customer service and technical assistance, including these aspects. The criteria checklist can be mapped directly to these categories.
Which costs belong in the comparison?
Consider the life-cycle costs over three to five years, not just the license prices. Life-cycle costs are all costs over the contract term: license, implementation, internal effort, operation, and exit. Ask for a price sheet based on your template to make sure the bids are comparable.
- License or volume: per photo, per person, or flat rate per year
- Implementation: configuration, adaptation to your branding, training
- Integration: connection to the ID card, access control, or HR system
- Internal effort: manual review, follow-up on rejected photos, support for employees
- Operation: support, updates, additional languages or locations
- Exit: data export and deletion at the end of the contract
Internal effort is the cost most often underestimated. The pilot's measurements show how many hours your team actually needs per 1,000 photos.
Further questions
Are ID photos biometric data? Only if they are processed using specific technical means that allow unique identification (Recital 51 GDPR; in Switzerland, Art. 5(c)(4) FADP). Ask the vendor whether the platform compares faces or only assesses image quality.
Is a photo platform a high-risk system under the AI Act? A pure quality check (lighting, pose, background) falls under neither biometric identification nor categorization under Annex III. Biometric verification, which only confirms that someone is the person they claim to be, is explicitly excluded there. The obligations for high-risk systems under Annex III apply from December 2, 2027.
Is the data center's ISO 27001 certificate sufficient? Not automatically. Make sure the scope also covers the vendor's software, operations, and support, and check whether the certificate was issued under the 2022 version.
From what value must a public authority issue a tender? At the Swiss federal level, from CHF 150,000 in the invitation procedure and from CHF 230,000 in the open or selective procedure. In the EU, Europe-wide tendering starts at a value of EUR 140,000 or EUR 216,000. The details are listed in the table above.
How many vendors should take part in the pilot? Two to three, after the must-have criteria have been assessed. More vendors make the test longer without improving the decision.
Final thoughts
A good evaluation starts before the first meeting with a vendor: document your own requirements, define five to seven must-have criteria, and set the weights. Evidence and a pilot with real employees matter more than feature lists. You can find step-by-step guidance on these points in the criteria checklist.