What are you actually buying when you procure AI?
When you procure an AI system, you are also acquiring dependencies, responsibilities and constraints that may remain long after the initial contract is signed.
In today’s governance note, I want to ask a question that public institutions should settle before evaluating AI suppliers: what are you actually buying?
The obvious answer is a product or service. Perhaps it is a chatbot, an analytical system, a fraud-detection tool or something intended to make administrative work faster.But an AI procurement creates a much wider institutional relationship.
AI Procurement Considerations
You may be purchasing access to a model that the supplier can change. You may be transferring organisational or citizen data into infrastructure you do not control. You may become dependent on proprietary formats, specialist support, or an interface that cannot be easily replaced. You may also retain accountability for decisions that the supplier’s system helped produce. Hence, why an ordinary software specification is not enough.
Before entering the market, I would define what the institution must be able to do independently. Can you retrieve your data in a usable format? Can you investigate an unexpected output? Can you test the system after the provider updates it? Can you explain its role in a decision? Can you continue delivering the service if the supplier withdraws the product or substantially increases its price?
These are not secondary contractual details. They determine whether the institution continues to govern the service it is responsible for.
The UK government’s AI procurement guidelines advise public-sector buyers to address accountability, data, technical limitations, ongoing evaluation and supplier responsibility throughout the procurement process. The guidance also treats procurement as an iterative process rather than a single purchasing decision. UK Guidelines for AI Procurement
More recent OECD analysis shows why this capability matters. Its 2026 Digital Government Outlook found that only 21 of 36 OECD countries provided central-government support for procuring AI goods and services. The OECD identifies vendor lock-in, accountability, transparency, data rights and lifecycle risk as areas requiring stronger public capability. OECD Digital Government Outlook 2026
I would therefore treat the contract as part of the governance system. Your procurement documents should establish access to information, testing and audit rights, responsibilities following model changes, data return and deletion requirements, accessibility expectations, incident procedures, and a workable exit route. These conditions should be agreed upon while the institution still has negotiating power, not after the system becomes operationally necessary. The supplier can provide the technology, but not the institution’s public obligations.
Before asking whether an AI system performs well, ask what your organisation must surrender in order to use it, what it will still control afterwards and whether it could leave without damaging the public service