oh but you forgot the mandatory time before they even start considering the tender.
looking at average speed of bureaucracy in EU it will take roughly a year to set date for a meeting that will set the date for actual meeting which will decide if this will go forward or not....
(if you think i'm joking - i'm basing this on proposed EU initiative for nuclear power which started with setting a date of meeting to setup a meeting to draft an agenda)
https://www.enisa.europa.eu/topics/vulnerability-disclosure
They have a tender going on tracking best practices: https://www.enisa.europa.eu/procurement/vulnerability-disclo...
So they will take 12 months to select for the tender...18 months pondering on the report...and in 3 years they make a tender out for a solution...