Implementing AI in Public Procurement? You’ll Need to Start With a Solid Guidance Policy

When procurement professionals in our 2026 State of AI in Procurement survey were asked to name the single biggest obstacle to AI adoption at their agency, the lack of a policy framework was one of the most frequent responses. Not technology, not cost, not even resistance from leadership – the absence of internal guidance on what IA use is acceptable in the first place is keeping a lot of teams out of the latest technology wave.

In our survey, only 14% of more than 150 respondents have a written, actively enforced policy governing staff use of Artificial Intelligence. Another 20% are currently in the process of building one, and 43% said they don’t have one and aren’t actively building one.

The rest had some informal guidance from leadership, policies that weren’t consistently enforced, or didn’t even know whether such guidance exists at all in their agency.

This policy gap creates a practical risk for agencies starting to explore generative AI or other new technology. As the tech wave grows rapidly, general-purpose AI tools like large language models, document summarizers, and drafting assistants are becoming more widely accessible and increasingly embedded into common office software.

Your staff may already be using them for tasks that touch your procurement workflow, such as writing correspondence, summarizing specifications, researching vendor backgrounds, or drafting scope language.

Without a policy guiding this usage, there’s no framework for determining which uses are acceptable, what information can and cannot be shared with an AI system, how that information can be used, or what documentation is required for transparency regarding AI-generated procurement outputs.

This can leave your agency open to any number of risks, from basic distrust and a lack of vendor participation to bid protests and audits that can delay projects, force rebids, and cost your agency – and your taxpayers – valuable public funds.

Among agencies that do have an AI policy, we found that data privacy and handling is the most commonly covered area. The least addressed was vendor evaluation for AI tools – how software vendors are building these tools, what they’re doing with the data they ingest, and how confident they are in the tools’ outputs.

That can be a problem. Even if your own agency’s policy tells your staff what data they can share with an AI system or what outputs are allowed to be used to make decisions, if there’s no guidance on how to evaluate or approve a new AI tool before it’s used in procurement workflows, you’re leaving a gap exactly where you need the most guidance.

A functional AI policy for procurement doesn’t need to be comprehensive on day one. In fact, that would be nearly impossible with the rate of growth and adoption of this new technology. But at minimum, your agency should build a policy that answers five questions for your staff:

1. What tools are currently approved for use;
2. For what purposes are those tools approved;
3. What categories of information can and cannot be entered into an AI system;
4. What documentation is required when AI contributes to a procurement output or decision; and
5. Who approves a new AI tool before it is used in a procurement workflow?

Not sure where to start? The NIST AI Risk Management Framework, updated to Version 1.1 in May 2025, provides a voluntary governance baseline that state and local agencies can adapt. It is the most widely referenced framework in state-level AI legislation, and it’s a practical starting point for agencies without their own existing guidance.