S9.07 - Procurement

S9.07 ? Procurement

flowchart LR
    A[Traditional procurement problem
Claims without run-level visibility] --> B[RAIDT
Run-level evidence framework]
    B --> C[[Procurement
Evidence requirements for suppliers]]
    H[Tender questions
Contract clauses
Due diligence
Interoperability] --> C
    C --> D[Exportable evidence pack]
    C --> E[RAIDT score profile]
    C --> F[Reviewer reconstruction]
    D --> G[Governance readiness
Auditability
Contestability
Organisational learning]
    E --> G
    F --> G

? Star S9 - Policy, Standards and Assurance

Star context: Connects RAIDT to policy instruments, standards, assurance, procurement, audit and organisational accountability by showing how external governance expectations can be translated into concrete evidence demands at the level of an individual GenAI run.

Academic picture

Definition / background

Procurement is the organisational process through which a buyer specifies requirements, evaluates suppliers, awards contracts and governs delivery. In the context of GenAI governance, procurement matters because many of the conditions that determine later accountability are fixed before a system is fully embedded in practice. If a purchaser does not ask for evidence, logging, exportability, review routes or version transparency at the point of acquisition, those capabilities may be absent or difficult to recover later.

Within RAIDT, procurement is not treated as a generic buying function. It is the point at which governance principles are translated into operational evidence demands. RAIDT asks organisations to govern GenAI at the level of the run: one configured use of a system for a specific task, at a specific time, in a specific context. Procurement therefore needs to ask whether a supplier can support that level of granularity through run logs, configuration records, prompts or templates where appropriate, model and tool versions, reviewer reconstruction, evidence pack export and score reporting across Responsibility, Auditability, Interpretability, Dependability and Traceability.

This makes procurement conceptually distinct from high-level vendor assurance. A supplier may offer a strong policy statement, a generic model card or a platform security claim, but RAIDT-oriented procurement asks whether the buyer can inspect and reconstruct a specific organisational use. That is why procurement belongs in Star S9. It links policy and standards expectations to concrete assurance mechanisms, and it determines whether RAIDT evidence packs and score profiles will be contractually and technically obtainable in practice.

Why this concept matters

Procurement solves an important governance translation problem. Organisations often endorse responsible AI principles, yet still buy tools through tendering or commercial processes that request little more than promises of compliance. That creates a mismatch between strategic intent and operational oversight. RAIDT addresses this by making procurement ask for evidence structures that support later review, challenge and improvement.

Without this concept, buyers may acquire GenAI systems that are difficult to inspect after deployment. They may be unable to determine which model version was used for a disputed output, what prompt or configuration shaped the response, whether human review was required, or whether evidence can be exported for audit or incident response. The result is governance by assertion rather than governance by evidence.

Procurement therefore matters because it pushes accountability upstream. It allows organisations to state, before adoption, what must be observable, reconstructable and reviewable once the system is in use. In RAIDT terms, that is how governance moves from broad principles toward operational readiness.

Key idea: Procurement matters in RAIDT because it makes evidence requirements part of the buying decision, rather than a retrospective request after problems appear.

What this item enables

Translation of responsible AI principles into tender questions, contract clauses and supplier selection criteria.
Comparison of suppliers on the basis of evidence capability rather than marketing language alone.
Early specification of exportable RAIDT evidence packs, score reports and review artefacts.
Contractual access to run logs, version histories, configuration data and reconstruction pathways.
Better interoperability between supplier systems and the organisation's assurance, audit and incident processes.
Stronger post-award monitoring because the buyer has already defined what evidence must remain available.

Practical example / likely audience question

Audience question

If procurement already checks security, legal terms and supplier capability, why does RAIDT need a separate procurement concept?

Answer

The concern behind this question is that procurement may look like an administrative wrapper rather than a substantive governance mechanism. The direct answer is that ordinary procurement often checks whether a supplier appears credible, whereas RAIDT-oriented procurement checks whether a specific organisational use can later be evidenced, reconstructed and challenged.

For example, a supplier may pass standard due diligence by offering data protection terms, service levels and general statements about safe AI. That is useful, but it does not tell the buyer whether a contested output can later be traced to a particular run, model version, prompt template, reviewer decision or score profile. RAIDT adds value by making those evidential capabilities explicit procurement requirements instead of optional extras.

This is stronger than a generic AI governance approach because it does not stop at principles such as transparency or accountability. It asks what the buyer must receive, store or be able to reconstruct at run level for those principles to become operational. Procurement is therefore the gateway through which RAIDT becomes actionable in real organisations.

Practical example in RAIDT terms

A local authority procures a GenAI assistant to help staff draft responses for housing and benefits enquiries. At first glance, the purchase appears low risk because the tool is presented as a drafting aid rather than an autonomous decision-maker. The run-level issue, however, is that different runs may serve different functions: one run drafts routine replies, another summarises case notes, and another suggests escalation categories for vulnerable residents. Those runs have different governance implications even if they use the same supplier platform.

A RAIDT-oriented procurement process would therefore require the supplier to support evidence for each configured use. The buyer would ask for run identifiers, model and version records, prompt or workflow configuration, human review checkpoints, data handling details, logging scope, exportable evidence packs, and score outputs or inputs sufficient to calculate the five-pillar profile. If a complaint later arises about an inaccurate or insensitive response, reviewers can inspect the relevant run rather than rely on generic supplier assurances.

In this example, Responsibility is affected because the authority must define acceptable use and oversight roles; Auditability and Traceability are affected because disputed outputs need reconstruction; Interpretability matters because staff must understand the basis of the generated draft; and Dependability matters because the system must perform consistently across routine and high-stakes cases. Procurement improves governance readiness by ensuring these evidential requirements are built into the buying and contracting process from the start.

Detailed link to RAIDT

Procurement links to RAIDT in four ways.

First, it connects RAIDT's core idea to institutional decision-making by turning responsible governance into explicit acquisition requirements.
Second, it links directly to the run because the buyer must ask whether evidence can be generated and retrieved for a specific configured use, not just for a product in the abstract.
Third, it shapes the evidence pack and score profile by determining whether the supplier can provide the artefacts, metadata and access needed to assemble them.
Fourth, it supports reviewability, contestability, audit readiness and organisational learning because evidence requested at procurement stage remains available when incidents, audits or policy reviews occur.

Procurement specification ? Run-level evidence ? Evidence pack ? RAIDT score profile ? Governance readiness

When procurement is weak, the rest of this chain is fragile. When procurement is evidence-aware, RAIDT can function as an operational governance framework rather than a conceptual aspiration.

Link to the five RAIDT pillars

Responsibility

Procurement supports Responsibility by clarifying who must define acceptable uses, approve supplier choices, set review thresholds and own accountability for deployment decisions.