Governing AI in public procurement: a practical framework

Procurement teams are under pressure to do more with fewer people, and AI is well suited to much of the work: drafting documents, checking them against rules, and summarising long submissions. But public procurement decisions must be explainable and attributable to an accountable person. The challenge is to get the time savings without blurring who decided what.

Start with a clear boundary

Write down, before any tool is switched on, what AI may and may not do. A workable default for public procurement is:

• AI may draft, summarise, check, flag and suggest.
• AI may not select a supplier, change or override scores, approve anything, or alter submitted bids or audit records.

Make every output visibly provisional

Anything produced by AI should be labelled as AI-generated and require an explicit human action: accept, edit or reject. That action is itself part of the record. It shows that a person reviewed the suggestion, and it gives you data on how useful the AI actually is.

Log enough to reconstruct the decision

If a decision is challenged, you need to be able to show what the AI was asked and what it answered. For each AI call, log at least:

• Who asked, in which organisation, for which feature
• Which model and provider answered
• Which version of the prompt was used
• The output, and what the user did with it
• When it happened, and a risk level where relevant

Version your prompts

Prompts are policy. A change to the instructions given to a model can change its behaviour as much as a change to code. Store prompts with version numbers, review changes, and record the version used for every output.

Keep risk flags internal until reviewed

AI that flags possible collusion, restrictive clauses or price anomalies is useful, but an unreviewed flag is an allegation, not a finding. Keep flags internal until a person has reviewed them under a formal process.

Choose where the data goes

Each organisation should decide which AI provider processes its documents, and hold its own credentials. That keeps procurement data within the arrangements your data-protection rules require.

DigiProcure applies this framework by design: AI assists with drafting, compliance checks, restrictive-clause detection and bid summaries, while scoring, award and approval remain human decisions under configurable workflows.