Artificial intelligence can help procurement teams organise information, identify patterns and prepare routine material. It should not become the unrecorded decision-maker. The safest operating model is simple: AI may support analysis, but named people remain responsible for evidence, judgement and approval.

AI in practice was one of the themes at NOE CPC's CPC Connect on 17 September 2026, alongside legal developments, supplier insight and NHS procurement updates. The event makes this a useful moment to move the discussion from general enthusiasm to practical commercial controls.

Is supplier use of AI in tendering prohibited?

No. Procurement Policy Note 017 states that supplier use of AI is not prohibited during the commercial process. It recommends proportionate steps to understand and manage the associated risks.

PPN 017 applies to central government departments, executive agencies and non-departmental public bodies. Other contracting authorities may choose to apply its approach. The note includes optional disclosure questions and warns that plausible AI-generated text may still be inaccurate.

Which five controls should a procurement team establish?

### 1. Define approved uses and data boundaries

State which tasks AI tools may support and which information must never be entered. Confidential tender material, personal data, commercially sensitive information and security-related content need explicit handling rules.

An approved-use register should name the tool, purpose, information classification, owner and review date. A blanket statement that staff may “use AI responsibly” is too vague to control risk.

### 2. Use disclosure to inform due diligence

Ask suppliers proportionate questions where AI use is relevant to the tender response or service delivery. Disclosure should help the buyer understand risk; it should not become an automatic penalty.

If AI supports service delivery, explore model purpose, data sources, human oversight, testing, change control, intellectual property, security and incident management. The depth of questioning should match the potential impact.

### 3. Verify every material output

A human reviewer should check facts, calculations, references and conclusions against authoritative sources. This applies whether AI is used to summarise market information, draft a specification, analyse contract data or support a tender response.

Keep a short verification record for material outputs: what was checked, against which source, by whom and when. AI-generated citations should never be accepted without opening and validating the source.

### 4. Protect human-owned evaluation

Evaluation criteria, scoring guidance and moderation must remain governed by the published process. AI should not make an award decision, infer undisclosed criteria or replace evaluator accountability.

If technology assists with administration or analysis, record its role and limitations. Evaluators should form their own judgement, explain their rationale and resolve inconsistencies through the approved moderation process.

### 5. Contract for transparency and change

AI systems and supplier practices evolve during a contract. Include proportionate obligations covering notification of material changes, data use, audit information, security events, performance monitoring, human intervention and exit.

The contract should also identify who owns generated content, training data, prompts, models and improvements where relevant. Without clear change control, a service assessed at award may operate differently months later.

What should suppliers do?

Suppliers should maintain an internal AI policy, verify AI-assisted bid content and protect buyer information. Be ready to explain where AI was used, what human checks were completed and how the proposed service will be governed.

A polished response cannot substitute for delivery capacity. Buyers may use clarifications, presentations, supporting documents or site visits to test whether the evidence and resources behind a tender are credible.

What should procurement leaders do next?

Create a small control set that teams can actually use: approved tools, data boundaries, disclosure wording, a verification record, evaluation rules and standard contract clauses. Train commercial, legal, information governance, security and service colleagues together, because the risk does not sit in procurement alone.

Prestige supports governance reviews, procurement documentation, evaluation assurance, KPI design and capability development. Explore our procurement governance and training services if your organisation needs a practical AI procurement control framework.

Source and scope note

This article draws on the CPC Connect event page and Cabinet Office PPN 017. It is general information, not legal, data protection or information-security advice. Apply current guidance and involve the relevant specialists for each use case.