Key Definitions
| Term | Definition |
|---|---|
| AI Procurement | The end-to-end process of identifying, evaluating, selecting, contracting, deploying, and managing AI systems and services, encompassing technical assessment, regulatory compliance, ethical review, and commercial negotiation. |
| Deployer | Under the EU AI Act, the natural or legal person that deploys an AI system under its authority, bearing specific obligations including transparency, human oversight, and monitoring — distinct from the provider who develops or places the system on the market. |
| AI Risk Assessment | A systematic evaluation of the potential harms, biases, security vulnerabilities, and regulatory risks associated with an AI system, conducted as part of the procurement process to inform selection and mitigation decisions. |
| Conformity Assessment | The process of verifying that a high-risk AI system meets the requirements of the EU AI Act before it is placed on the market or put into service, involving technical documentation review, quality management assessment, and where required third-party evaluation. |
| Algorithmic Impact Assessment | An evaluation of the potential societal, economic, and individual impacts of deploying an AI system, considering effects on fundamental rights, equality, and social welfare. |
| AI Bill of Materials | A comprehensive inventory of the components, data sources, models, and dependencies that constitute an AI system, enabling procurement teams to assess supply chain risks and compliance obligations. |
| Vendor Due Diligence | The investigation of an AI vendor's technical capabilities, financial stability, regulatory compliance, data practices, security posture, and ethical standards before entering into a procurement relationship. |
| Service Level Agreement (SLA) | Contractual commitments defining the performance standards, availability, response times, and remediation obligations for an AI system or service. |
| Total Cost of Ownership (TCO) | The complete cost of an AI system over its lifecycle, including acquisition, integration, training, operation, maintenance, upgrades, and eventual decommissioning. |
| AI Governance Framework | The organizational policies, procedures, roles, and accountability structures that govern the responsible procurement, deployment, and use of AI systems. |
| Explainability | The degree to which the decisions or outputs of an AI system can be understood by humans, enabling meaningful oversight, appeal, and accountability. |
| Data Processing Agreement (DPA) | A contractual arrangement required under GDPR when an AI vendor processes personal data on behalf of the procuring organization, specifying data handling obligations, security measures, and sub-processor arrangements. |
Chapter 1: The AI Procurement Landscape
Organizations procuring AI systems face a complex landscape of technical options, regulatory requirements, ethical considerations, and commercial models — requiring a structured procurement framework that ensures compliance, manages risk, and delivers genuine business value.
1-1. Why AI Procurement Requires a New Approach
Traditional IT procurement frameworks are insufficient for AI systems.
AI systems learn from data, creating unique risks around bias, drift, and unpredictability.
The outputs of AI systems may change over time as models are retrained or data distributions shift.
Regulatory requirements specific to AI (particularly the EU AI Act) add compliance obligations that do not exist for conventional software.
Ethical considerations around fairness, transparency, and human autonomy require evaluation beyond functional specifications.
The complexity of AI supply chains — including data sources, pre-trained models, cloud infrastructure, and third-party APIs — creates dependency risks.
Traditional procurement focus on features and price must be expanded to include risk assessment, compliance verification, and ethical review.
Organizations that apply conventional procurement practices to AI systems expose themselves to regulatory, reputational, and operational risks.
The cost of remediation after deployment significantly exceeds the cost of thorough pre-procurement assessment.
A structured AI procurement framework protects the organization while enabling the benefits of AI adoption.
1-2. The Regulatory Context for AI Procurement
The EU AI Act is the most comprehensive AI regulation globally.
It creates specific obligations for organizations that deploy AI systems.
Deployer obligations include transparency toward affected individuals.
Human oversight measures must be implemented according to the provider's instructions.
Input data must be relevant and sufficiently representative for the intended purpose.
Monitoring obligations require deployers to watch for risks during operation.
Serious incidents must be reported to the relevant market surveillance authority.
The Act classifies AI systems by risk level: unacceptable, high, limited, and minimal.
High-risk AI systems face the most stringent requirements.
These include conformity assessments, quality management systems, and registration in the EU database.
Procurement decisions must account for the risk classification of the AI system being acquired.
Public procurement of AI systems faces additional requirements under EU public procurement directives.
Transparency obligations apply to public bodies procuring AI for citizen-facing services.
National implementations of the AI Act may add further requirements.
Organizations should assess the full regulatory landscape before initiating AI procurement.
1-3. The NIST AI Risk Management Framework
The NIST AI RMF provides a voluntary framework for managing AI risks.
It is organized around four functions: Govern, Map, Measure, and Manage.
The Govern function establishes organizational AI governance structures.
The Map function identifies and contextualizes AI risks.
The Measure function assesses, analyzes, and tracks AI risks.
The Manage function prioritizes and acts on AI risks.
While voluntary, the NIST AI RMF is widely adopted as a procurement assessment framework.
Vendors who align with the NIST AI RMF demonstrate mature risk management practices.
Procurement teams can use the NIST AI RMF categories as evaluation criteria.
Alignment with NIST AI RMF facilitates compliance with multiple jurisdictions simultaneously.
1-4. International Standards for AI
ISO/IEC 42001 specifies requirements for AI management systems.
It provides a framework for organizations to manage AI responsibly throughout the lifecycle.
ISO/IEC 23894 provides guidance on AI risk management.
ISO/IEC 38507 addresses governance implications of AI use by organizations.
IEEE 7000 series standards address ethical considerations in system design.
Procurement teams should assess vendor alignment with relevant international standards.
Certification to ISO/IEC 42001 provides objective evidence of mature AI management.
Standards alignment reduces procurement assessment effort by providing third-party verification.
However, standards compliance alone is not sufficient — organizational context and specific risks must also be assessed.
1-5. Public Sector AI Procurement Considerations
Public sector organizations face additional requirements when procuring AI systems.
The EU Public Procurement Directives (2014/24/EU and 2014/25/EU) govern government purchasing above threshold values.
Open tendering procedures require public advertisement and competitive evaluation.
Award criteria must be pre-defined, transparent, and consistently applied.
The principle of equal treatment requires all vendors to receive the same information and opportunity.
Innovation partnerships allow public bodies to procure AI systems that do not yet exist in the market.
Dynamic purchasing systems enable ongoing addition of suppliers for standardized AI products.
Pre-commercial procurement supports research and development of AI solutions before commercial availability.
Value for money assessment in public procurement extends beyond price to include social and environmental value.
Public accountability requires transparent documentation of procurement decisions and their rationale.
Parliamentary or council oversight may apply to significant AI procurement decisions.
Freedom of information obligations may require disclosure of procurement documentation.
Citizen impact assessment evaluates how the AI system will affect individuals who interact with public services.
Public trust in government AI requires demonstrable fairness, transparency, and accountability.
Algorithmic accountability mechanisms must be built into public sector AI deployments.
Open source preferences may apply in some public sector jurisdictions.
Interoperability requirements ensure that public sector AI systems can work with existing government infrastructure.
Data sovereignty requirements restrict where government data may be processed and stored.
1-6. Sector-Specific AI Procurement Requirements
Different sectors face different regulatory requirements for AI procurement.
Healthcare AI procurement must address medical device regulations, patient safety, and clinical validation.
Financial services AI procurement faces regulations on algorithmic trading, credit scoring, and anti-money laundering.
Education AI procurement must consider student privacy, age-appropriate design, and accessibility.
Critical infrastructure AI procurement requires enhanced security, resilience, and backup procedures.
Employment AI procurement faces specific regulations on automated hiring, monitoring, and termination decisions.
Insurance AI procurement must address regulations on risk assessment, pricing fairness, and claim processing.
Transportation AI procurement covers autonomous vehicles, traffic management, and logistics optimization.
Energy AI procurement addresses grid management, demand prediction, and renewable integration.
Each sector adds compliance requirements beyond the general AI Act obligations.
Procurement teams must identify sector-specific requirements during the needs assessment phase.
Vendor evaluation must include assessment of sector-specific compliance capability.
Contract provisions must allocate sector-specific compliance responsibilities clearly.