Vardonne

Insights · Guide II

AI governance for bidders

What the Procurement Act 2023 changed, what a buyer may ask about AI, and the five documents to have ready.

Figure 1 The Act, as it arrived

  1. 24 February 2025

    The Act applies to new procurements. An enhanced Find a Tender service becomes the Central Digital Platform.1,2 PPN 017 on AI and PPN 014 on Cyber Essentials apply from the same day.5,6

  2. 1 January 2026

    Payments compliance notices (section 69) and contract performance notices (section 71) begin.4

  3. 1 April 2026

    Publication of payments over £30,000 (section 70) begins.4

Source: GOV.UK1,4

What changed for suppliers

Registration
You register on the Central Digital Platform at the point you want to bid. A supplier registered on the old Find a Tender must register again.2
Award
In a competitive procedure, a contract may be awarded to the most advantageous tender, assessed against the buyer’s award criteria (section 19).3
Procedure
Beside the open procedure, a buyer may run a competitive flexible procedure of its own design (section 20).3
Debarment
A Minister keeps a debarment list of excluded and excludable suppliers (section 62).3
Payment
Most public contracts carry an implied term to pay valid, undisputed invoices within 30 days (section 68).3
Direct award
A buyer must publish a transparency notice before a direct award (section 44).3

What a buyer may ask about AI

PPN 017 applies to central government departments, their agencies and non-departmental public bodies. It offers buyers optional questions, and states that suppliers’ use of AI “is not prohibited”.5 A buyer may:

  • ask you to disclose where AI was used in writing your tender;
  • put controls in place so its confidential information is not used to train AI;
  • carry out proportionate extra due diligence, such as clarification questions, presentations or site visits;
  • plan for more bids and more clarification, and allow more time;
  • require you to declare where AI will be used in delivering a service that is not itself an AI service.

The practical consequence: a well-written bid that cannot survive a clarification question about how it was written is now a risk, not a saving.

Cyber Essentials

Under PPN 014, Cyber Essentials or Cyber Essentials Plus, renewed annually, or equivalent controls, is required where a contract involves citizens’ or government employees’ personal data, ICT systems handling OFFICIAL information, or the day-to-day business of government. The evidence is needed when data is to pass to the supplier, and buyers must not take a blanket approach.6

Figure 2 The bidder’s governance pack

  1. AI use statement

    Where AI was used in preparing this bid and will be used in delivery, and where it will not. One page, true on the day.

  2. The AI register

    Every AI system in use, with its owner, purpose, data and risk. See Guide III.

  3. Data protection

    DPIAs for AI that touches personal data, a lawful basis per processing operation, and how buyer information is kept out of model training.

  4. Human review

    Who checks AI output before it reaches the buyer, and how that check is evidenced.

  5. Security

    Cyber Essentials or Plus where the contract calls for it, and how AI tools are secured and their access controlled.

What an evaluator can ask to see, held before the question comes. Source: Vardonne

What was dropped

DSIT consulted on AI Management Essentials, a self-assessment tool, from November 2024. Its response says DSIT “will not be publishing AIME and therefore will not be making it a requirement of the government procurement process”, and will instead produce guidance for SMEs deploying AI.7 There is no single AI certificate a bidder must hold; the pack above is how the question is answered.

Sources

  1. The Procurement Act 2023: guidance for suppliers and contractors. GOV.UK, updated 12 June 2026.
  2. Central Digital Platform factsheet. GOV.UK, updated 23 June 2026.
  3. Procurement Act 2023, sections 19, 20, 44, 62 and 68. legislation.gov.uk, as in force.
  4. New legislative requirements under the Procurement Act 2023. GOV.UK, updated 23 June 2026.
  5. PPN 017: Improving transparency of AI use in procurement. Cabinet Office, GOV.UK, 17 February 2025.
  6. PPN 014: Cyber Essentials scheme. Cabinet Office, GOV.UK, 17 February 2025.
  7. AI Management Essentials tool: government response. DSIT, GOV.UK, published 6 February 2026.
↑