Sovereign AI Is a Procurement Problem

Labs talk about models. Secretariats talk about files. Sovereignty dies in the second because the RFP asked for AI-enabled grievance redressal and scored 70 percent on price.

That is not a technology failure. It is a specification failure. The buyer asked for an outcome and left every control that makes the outcome lawful as a nice-to-have. Vendors did what vendors do. They bid the outcome at the lowest price the committee would accept.

If you want a different stack, write a different RFP. This article is the difference, in language a procurement file already understands.

What belongs in the specification

A specification that says latest AI / ML techniques has already lost. Name the controls. Leave the model brand to the bidder, or you will lock yourself to a fashion.

• Deployment locus: departmental, SDC, NIC, private cloud, or air-gapped. One box, not all of the above.
• Forbidden egress classes: prompts, embeddings, weights, logs, support sessions. Exceptions only if listed in a schedule.
• Model policy: named models, the right to replace them, and a ban on silent fallbacks.
• Role map: fiduciary, processor, sub-processors, with a change-control clause.
• Audit artefacts: log export, key ceremony, restore drill, all as deliverables, not slides.
• Exit: format, timeline, deletion certificate, and a ban on residual training use.
• Continuity: a failover model already loaded, and a drill that treats the vendor control plane as down.

Each of those lines is a measurable deliverable. Measurable deliverables can be delayed, deducted or terminated. Adjectives cannot.

Eligibility versus quality

If sovereignty is ten marks out of a hundred, a cheaper non-compliant bid will win. Put the controls that you actually mean in eligibility. A bidder who cannot run inside the named perimeter is L1 of the wrong shortlist.

Quality marks are for things you can trade: speed of retrieval, Indic language quality, number of connectors, training hours, documentation. Do not put no undeclared egress in quality. That is like putting fire exits in quality. Either they exist or the building does not open.

Procurement vehicles are not architecture

GeM listing, NICSI empanelment, a MeitY-adjacent brochure, DPIIT recognition under the Start-up India programme — these are paths to place an order. They are not evidence that Layer 0 through Layer 6 exist.

Use the vehicle to pay. Write the architecture into the additional terms, the statement of work and the DPA. If a catalogue item cannot carry those terms, do not buy that catalogue item for a citizen-facing agent. Buy the item that can, or run an open bid that can.

Make in India is a third race

Local content is a purchase-preference calculation. It is not a data-protection conclusion. An Indian-owned wrapper around a foreign model API can score well on local content and fail residency. A foreign-owned on-prem stack can fail local content and pass DPDP. Run the races separately or you will disqualify the wrong people.

The bill of quantities nobody writes

If the BoQ is only seats or only GPU hours, you will get seats or GPU hours. Add line items the auditor can count.

• Staging environment with egress logging, accepted before production.
• Key ceremony and privileged-user export, quarterly.
• SIEM connector and a week of traces the DPO can open.
• Restore drill, minuted, before go-live and every six months.
• Exit export of adapters, indexes and prompts, in an open format, tested once during the contract.
• Deletion certificate template, agreed at signature, not invented at termination.

Procurement is where sovereignty becomes real or becomes a preamble. Write it where money moves. Everything else is a conference.

How preambles eat specifications

Indian government files often open with a paragraph about Atmanirbhar Bharat, Digital India and citizen-centric services. Those paragraphs are fine. They become a problem when they substitute for the bill of quantities. A vendor will quote the preamble in the technical bid and leave the controls out of the price.

Keep the preamble. Then put a hard line: the following controls are eligibility. If a bidder's technical offer only repeats the preamble, it is non-responsive. Committees that are afraid to write non-responsive will spend a year managing a chatbot they cannot audit.

Who sits in the specification meeting

If only the IT cell drafts the RFP, you will buy a model. If only procurement drafts it, you will buy a price. If only legal drafts it, you will buy a clause nobody can operate. The meeting needs the process owner who knows the file movement, the DPO, the CISO, the SDC lead, and the person who will answer the PAC. Two hours with those five people is cheaper than a corrigendum.

Pilot terms are still procurement

Free pilots are how non-compliant stacks enter the building. If the pilot uses production personal data, it is processing. It needs the same role map, the same DPA, and the same egress rule. If the vendor will not sign those for a pilot, they will not honour them later. You have learned something useful before the work order.

Put a written end date, a written data-return, and a written ban on using pilot data to train anything other customers can reach. A pilot without an exit is a production system that nobody budgeted.

Rewrite one live RFP this month

Pick a file that is not yet published. You do not need a new scheme. You need one specification that treats controls as eligibility. Take the seven lines from the specification section of this article and drop them into the eligibility annex. Take the BoQ items and drop them into the financial form so they have prices.

Hold the five-person meeting. Process owner, DPO, CISO, SDC lead, PAC-facing officer. Two hours. End with a written non-responsive rule: a bid that only repeats the preamble fails. Publish the annex. Live with the smaller shortlist.

If the file is already a GeM catalogue buy, write the same controls as additional terms. If the catalogue item cannot carry them, do not use that item for a citizen-facing agent. Vehicles that cannot carry terms are the wrong vehicles.

Objections you will hear — and what to do with them

Finance will say eligibility controls reduce competition and raise price. They do. They also stop you buying a system you cannot run. Write the expected price band after the controls, not before. A low L1 on a non-compliant stack is not economy. It is a deferred invoice payable in incidents.

Legal will say material breach is too strong. Then use a stop on production data plus a right to terminate after a failed audit, with a payment withhold. A clause that cannot be used will not be used. Ask legal for a clause they will actually invoke, not for the strongest adjective.

Vendors will say these terms are not market. Market is what large buyers write. If your department is small, join a standard annex with other departments or with the state SDC. Shared language is how small buyers stop being price-takers on architecture.

Programme units will say the preamble already covers sovereignty. Preambles cover speeches. Bills of quantities cover money. If a control has no line item and no eligibility row, it will lose to price. That is not cynicism. That is how GFR scoring works.

Someone will propose a free pilot to test the stack instead of writing the RFP properly. A free pilot with production data is a procurement. Treat it as one. If you cannot, keep the pilot on synthetic data until the terms exist.

• Competition / price — price the compliant stack, not the unsafe one.
• Material breach too strong — take a usable clause, not a decoration.
• Not market — publish a shared annex.
• Preamble is enough — it is not a BoQ.
• Free pilot — same terms, or synthetic data only.

How this shows up in the file

If you change one file this month, change the eligibility annex and the BoQ, not the preamble. Preambles already say the right things. Money does not yet.

A free pilot with production personal data is a procurement. Give it a DPA, an end date and an exit. Otherwise you have a production system that nobody budgeted and nobody can turn off.

The first non-responsive bid will protest. Let it. The annex holding is how the market learns your definition. A market that only hears preambles will keep sending hymns.

What the next noting must contain

“Sovereign AI Is a Procurement Problem” belongs in a file, not only in a search result. A P1 CIO/CTO should be able to point at one artefact that proves “sovereign AI procurement”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

If sovereignty is only in the preamble and not in the bill of quantities, you will buy a chatbot with a flag on the homepage. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C1 Sovereignty & Data Residency: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “sovereign AI procurement”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.