Automating Public Procurement with AI: a Practical, Compliant Guide

Why consider AI for handling public procurement

Public procurement processes consume time and resources: drafting tender documents, managing queries, pre-selection, technical and administrative evaluation. AI can automate repetitive tasks —pre-filling documents, classifying bids, detecting anomalies— and speed up workflows without removing public accountability. But in the public sector efficiency is not enough: you must ensure legality (Law 9/2017), data protection (GDPR), security (ENS RD 311/2022) and emerging obligations from the EU AI Act.

Below is a practical approach to introducing AI into the procurement cycle while meeting regulatory requirements and preserving human control.

Concrete areas to apply AI (and practical limits)

• Assisted drafting of tender documents and base documentation: dynamic templates that suggest clauses depending on the contract type.
• Classification and pre-filtering of bids: extracting structured data (prices, timelines, certifications) to ease evaluation.
• Assisted evaluation: transparent scoring with factors explained to the human evaluator.
• Fraud and anomaly detection: alerts for atypical bids, collusion or formal errors.
• Handling questions and clarifications: a chatbot that suggests standard answers for the procurement team, subject to review.

Key limit: final decisions that affect rights, exclusion or award must remain under explicit, justified human responsibility.

Essential regulatory requirements (what you can’t ignore)

• Law 9/2017: ensures principles of publicity, competition, equality and transparency; any automation must preserve the reasoning and traceability of decisions.
• GDPR: processing of personal data in bids (staff data, financial offers linked to individuals). Carry out a DPIA (Data Protection Impact Assessment) when AI processes personal data at scale or profiles individuals.
• ENS (RD 311/2022): systems that process public information require security measures and asset classification; SaaS providers must demonstrate compliance.
• EU AI Act: classifies AI systems by risk. Many procurement uses —automatic evaluations with legal or decisive effects— could be high risk and require registries, technical documentation, impact assessments on fundamental rights and human oversight.

Practical implementation roadmap (actionable steps)

1. Evaluate scope and risk

   • Map tasks to automate and classify risk according to the EU AI Act (e.g., assistance vs. decision).
   • Identify the data used and whether a DPIA is required.

2. Design processes with human oversight

   • Define control points: who validates scores, who can reverse an exclusion, record of responsible parties.
   • Keep final responsibility with the procurement unit.

3. Adjust tender documents and contractual clauses

   • Include requirements on explainability, audit rights, access to logs and model review.
   • Require proof of ENS compliance, continuity policies and subcontracting clauses (in line with Law 9/2017).

4. Prepare the data layer

   • Catalog and clean data: avoid using unnecessary personal data.
   • Set retention periods and role-based restricted access.

5. Technical validation and testing

   • Functional tests: accuracy of extraction, robustness to atypical inputs.
   • Fairness tests: check for biases that could disadvantage SMEs or specific groups.
   • Security tests: penetration tests and ENS review for cloud services.

6. Transparency and documentation

   • Model cards, datasheets and version registers for the model.
   • Document evaluation parameters, weights and thresholds used in scoring.

7. Monitoring and continuous review

   • Operational and compliance KPIs (errors, complaints, response times).
   • Periodic re-audits and a model update process with change control.

Procurement and key clauses to negotiate with providers

When procuring AI solutions (SaaS or integrated), make sure to include, at a minimum:

• Clear description of functional scope and usage limits.
• Obligation to provide technical material (model cards, logs, validation tests).
• ENS guarantees and operational continuity measures.
• Audit rights and access to training data where appropriate (or, when not possible, justification and mitigations).
• SLA with availability metrics and incident response times.
• Commitments on subcontracting and cross-border data transfers (GDPR).

Operational best practices for day-to-day use

• Assign at least one person responsible per case file with decision-making authority.
• Use interfaces that show the rationale behind AI suggestions (not just a score).
• Train procurement staff in interpreting results and system limitations.
• Record all automated interactions in the electronic case file for auditing.

Immediate actions (checklist)

• Classify the AI use according to the EU AI Act risk levels.
• Perform a DPIA if relevant personal data are involved.
• Update model tender documents with AI and audit clauses.
• Implement logs and model cards from the first version.
• Define human responsables and control points in the evaluation.
• Plan fairness and security tests before the first use in real awards.

Conclusion: Automating parts of the procurement cycle with AI reduces time and operational risks if done with control, documentation and human responsibility. A structured deployment —based on the current legal framework (Law 9/2017, GDPR, ENS RD 311/2022 and the EU AI Act)— lets you gain efficiency without compromising transparency or legality. For municipal teams, starting with low-risk cases and standardized templates makes it easier to iterate and scale safely; modular tools like those offered by OptimGov can speed that path while maintaining regulatory controls.