Model Refresh Obligations Over a 3-Year Term

The AMC said latest versions will be provided from time to time. In month eleven a CVE landed in a tokenizer library. In month eighteen the vendor wanted to swap the base model because the old one was end of life. In month twenty-four the new model failed the Hindi refusal items the department still used. In month thirty the vendor said refresh was always extra except when it was mandatory for security, which was always. The clause had been a shrug stretched over three years.

Models are not static goods. They also must not become a standing right for the vendor to change the system's behaviour without a gate. A three-year government term — common on GeM subscriptions and departmental AMCs — needs three different refresh duties: security and defect repair; optional capability refresh; and a forbidden silent swap. Air-gapped sites add a fourth: how the bits arrive.

This guide is for commercial officers writing the AMC or subscription schedule. It is not a promise that you must refresh on any particular calendar. It is how to stop latest version from meaning either neglect or an undeclared new product.

Three duties, not one adjective

Security and defect repair. Libraries, runtimes, connectors and known jailbreaks. This belongs in the AMC. It has a clock. It uses the same change-control as any other ICT patch, including, where CERT-In duties apply, log and incident hygiene. It does not require a new accuracy speech. It does require a regression on the hold-out set before production.

Capability refresh. A new base model, a larger context, a better embedder. This is optional unless you bought it. If you bought it, say how many times in the term, who chooses, and what eval must pass. If you did not buy it, the vendor may offer a priced option. They may not slip it in as assurance.

Forbidden silent swap. No change to base model, tool policy, or refusal behaviour in production without a written order and a passed eval. Vendors like to improve prompts globally. That is a change to your official process. Treat it as one.

Refresh types on a three-year term.

Type	Inside AMC / subscription?	Gate before production	Air-gap note
Security / defect patch	Yes	Hold-out regression; rollback plan	Hashed media or diode; no vendor tunnel just this once
Minor prompt fix inside a card	Yes, within included hours	Owner of the card initials	Same path as config, not as a new model
New base model / major version	Only if purchased as N refreshes	Full acceptance-style eval on sealed hold-out	New weights on media; licence still offline
New language or workflow	No — variation	New card and eval set	Do not smuggle it in a patch
Vendor global improvement	No	Forbidden without an order	Especially forbidden if it phones home

Evaluation on every swap that can change answers

Reuse the acceptance hold-out. That is why the department owns it. A refresh that fails refusals does not go to production even if the vendor says the new model is generally better. Generally is not your file.

Keep a rollback image. Air-gapped sites that overwrite the only copy of the old weights have not patched. They have jumped. Record the model identifier in every trace. If you cannot say which weights wrote a noting, you cannot investigate. Refresh without lineage is how a PAC later asks what changed in September.

End-of-life and vendor abandonment

Require notice — many months, not a tweet — if a base model or runtime will leave support. Require a migration plan that still meets isolation. If the only migration is to a hosted API, that is a new procurement conversation, not an AMC courtesy.

If you escrowed source, a refresh cadence that never updates the deposit is how the locker rots. Tie deposit updates to production releases.

Money

Price security patches inside the AMC. Price N capability refreshes as an option or an inclusion you can audit. Price extra eval labour if the department will not staff it. Do not leave refresh as to be mutually agreed — that is scope creep with a research accent.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

If we gate every prompt tweak we will never improve.

Gate changes that alter refusals, tools, or model identity. Do not hold a PAC for a typo in a system prompt. Write the line.

Security patches cannot wait for a hold-out eval.

Then have a fast path: critical severity, documented rollback, eval within a short clock, not never. Skipping eval forever is how a patch becomes a new personality.

We want whatever is latest, always.

Then you want a product you do not control. Buy a hosted toy, not a departmental agent. Official processes need lineage.

Three years is too long; we should re-tender yearly.

You can. If you do not, the refresh clause is how a long term stays honest. Yearly re-tender still needs an exit package.

Write the three-year refresh schedule before float

1. Split security, capability and forbidden silent change.
2. State N capability refreshes or none.
3. Point at the hold-out and rollback.
4. Name the air-gap media path if you claimed isolation.
5. Price it. Mutual agreement is not a price.

How this shows up in the file

Subject: Model and runtime refresh schedule for a three-year term.

AMC includes security and defect patches with regression on the department hold-out and a rollback image. Capability refreshes are limited to the number stated, each with an acceptance-style eval. Silent changes to model identity, tools or refusals are forbidden. Isolation claims continue to apply to the update path. This note is not legal advice.

Patch clocks and eval clocks are different

A critical library CVE and a capability swap must not share one sentence. The first has a short clock, a rollback image, and an eval that can finish after the patch if you write that exception. The second has no emergency. It waits on the sealed hold-out. Mixing the clocks is how a vendor ships a new personality under a security ticket.

Where CERT-In incident or logging duties apply to you, the patch path still has to produce traces you can keep. A silent binary drop that writes nothing to the SIEM is not a professional patch. It is a gap in the same ICT trail the direction cares about. Read the live text; do not let a vendor paraphrase it.

Minute the model identifier before and after every production change. If September's noting cannot be tied to a hash, you will not be able to tell a PAC whether the refusal break was a prompt tweak or a base-model swap. Lineage is cheaper than a reconstructed history.

This article is a field guide for Indian public buyers, not legal, procurement, financial or audit advice. Confirm every citation against the live GFR compilation on doe.gov.in, the relevant DoE procurement manual, GeM terms, CVC guidance and your own counsel before a sentence enters a tender file.

How to put this in the RFP, not the preamble

A P2 Procurement who searches “model update contract clause” is usually drafting or scoring a bid. “Model Refresh Obligations Over a 3-Year Term” belongs in eligibility, the evaluation matrix, or a numbered annexure. If it only lives in the covering note, L1 will ignore it.

A three-year agent without a refresh clause will rot or be force-updated through a vendor tunnel. Write security patches, capability refreshes, eval gates and the media path as separate duties. QCBS weights are a choice you must publish before opening. Accuracy is a task plus a dataset, not a slogan. SLAs for agents must name tool-calls, human gates and log export — uptime alone is a hosting metric.

Do not let a vendor write the specification and then bid on it. Record unsolicited proposals. Pay for pilots that touch personal data. Write exit before you write go-live.

1. Move the control from the preamble into a scored or eligibility row.
2. Attach a one-page definition (accuracy, SLA, language, data handling).
3. Require an artefact in the technical bid, not a slide.
4. Extend the bid date if a corrigendum is material.
5. Minute the demo on your data, offline if you claimed air-gap.

Close this loop before the next CAB

Put “Model Refresh Obligations Over a 3-Year Term” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P2 Procurement, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “model update contract clause” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.