Disclosure is the start of assurance, not the end
UK Procurement Policy Note 017 asks in-scope central government bodies to consider appropriate supplier disclosure of AI use in bid creation and contract delivery. It also makes clear that suppliers are not prohibited from using AI in procurement.
That distinction matters. A buyer does not need to treat every use of generative AI as misconduct. It does need to know whether AI affected material claims, evidence, pricing assumptions, solution design or the proposed delivery model, and whether those claims remain accountable to the supplier.
PPN 017 applies to defined central government bodies and procurements under the Procurement Act 2023. The verification method below is also useful outside that scope as a proportionate commercial assurance practice.
Ask two separate questions
The tender should distinguish AI used to prepare the response from AI that will form part of delivery. The first question protects the integrity of the procurement process. The second protects the buyer from acquiring an undisclosed AI-enabled service or operating model.
For bid preparation, ask where AI generated, summarised, translated or checked material content and how a named person verified accuracy. For delivery, ask what system or model will be used, for which purpose, with what data, under whose control and with what human oversight.
Require suppliers to update their declaration if the proposed solution changes during clarification, negotiation or mobilisation. A point-in-time checkbox is not enough for a changing technical design.
Verify material tender claims
Focus verification on claims that affect scoring, risk or contractual reliance. Examples include performance figures, security controls, certifications, data provenance, staffing assumptions, implementation timescales, regulatory conclusions and customer references.
Ask for the underlying source, accountable reviewer and date of verification. Where AI helped create an analysis or summary, compare it with the original evidence. Where a supplier proposes an AI capability, request relevant evaluation results, limitations and the conditions under which the result was obtained.
A supplier's declaration should never reduce its responsibility for the tender. The contract should preserve accountability for accuracy, confidentiality, intellectual property and delivery, regardless of which tool assisted the response.
Run a proportionate six-part verification
1. Purpose: record how AI was used in the bid and how it will be used in delivery. 2. Ownership: identify the supplier executive, technical owner and human decision-maker. 3. Evidence: trace material claims to source records and evaluations.
4. Data: confirm whether buyer, personal, confidential or copyrighted material entered an AI tool and which retention or training settings applied. 5. Controls: review human oversight, testing, security, incident and change controls. 6. Contract: turn accepted representations into enforceable duties, reporting rights and remedies.
Scale the depth to the use case. AI used only for grammar checking should not receive the same diligence as an AI model that will influence eligibility, safety, employment, credit or access to services.
Red flags that need clarification
Escalate answers that say “no AI” while the proposed service clearly embeds machine learning or generative features. Treat broad claims of compliance without a role analysis, system scope or evidence reference as unverified.
Other warning signs include unknown model versions, unapproved consumer AI accounts, buyer data entered into tools without a clear basis, performance results without test conditions, no human owner, and supplier terms that allow silent model or subprocessor changes.
A red flag is not always a reason to reject. It is a reason to pause scoring or approval until the claim is clarified, evidenced and reflected in the risk decision.
Keep the evidence alive after award
Carry the accepted AI declaration, evidence and residual risks into the contract and supplier record. Set notification thresholds for model, data, purpose, subprocessor and control changes. Link obligations to service reviews, incidents and renewal decisions.
Our supplier change-log guide explains how to maintain that visibility after signature. The AI supplier evidence pack provides the broader evidence structure for approval.
The practical objective is simple: a buyer should be able to explain what the supplier declared, what was checked, what evidence supported the decision and what must be reported if the solution changes.