Procurement of AI under PPRA: vendor diligence

Three ways to see it

1. 1

   AI procurement, reduced to first principles, is procurement of three things bundled together: software, ongoing service, and a probabilistic model. The first two are familiar to any procurement officer. The third is new and is what we usually mishandle. A traditional software contract specifies inputs and outputs. A probabilistic model specifies an expected accuracy distribution. The vendor sells a chance, not a guarantee. PPRA Rule 4 (economy, efficiency, transparency) still applies, but the SBD (Standard Bidding Document) was written for deterministic systems. We must extend it.

2. 2

   Begin diligence with the data question. An AI vendor's claim of accuracy is meaningful only on the data the model was trained and tested on. A triage model trained on Massachusetts General Hospital records will perform unpredictably in Karachi's Civil Hospital, where presenting symptoms, drug history, and patient demographics differ. Demand to see the training data composition. Demand a pilot on your own data, with your own ground truth, before signing a multi-year contract. PPRA permits a pilot procurement under Rule 42; use it.

3. 3

   Second, the data residency question. Where does citizen data flow when the model runs? A vendor whose backend sits in a US-east AWS region is sending Karachi patient records to Virginia. The Pakistan Personal Data Protection bill in its current draft has data localisation expectations. The Auditor General has begun flagging cross-border data flows in audits. Insist on a clause that says either: data stays in Pakistan, or data is processed under documented safeguards equivalent to those of the originating jurisdiction. Print this clause. Hand it to your vendor at the kickoff meeting.

The why-tree

Try this with Claude

AI-edge prompt: 'You are an outside advisor reviewing a draft tender from a Pakistani provincial health department for an AI hospital triage system. The annual budget ceiling is PKR 200 million. Identify the top ten risks I have not addressed in my draft, propose specific clauses for each, suggest three local academic institutions (e.g., NUST, IBA, ITU) who could serve as independent technical evaluators on the tender committee, and tell me what evidence the vendor must submit at bid stage to demonstrate clinical safety.'