How Dutch Government Organisations Should Procure AI

Dutch public sector organisations face AI procurement challenges that standard RFP processes are not designed to handle. AI projects are discovery-dependent, scope evolves as data is understood, and you are buying a team and a process as much as a deliverable. Here is how to procure AI projects effectively.

Why Standard RFPs Fail for AI

A standard RFP works when you know what you want and are buying a defined set of features or services. AI projects rarely satisfy this condition. The right solution design depends on data that must first be assessed. The technical approach depends on findings from a discovery phase. Fixing scope and price before this discovery means either the vendor underdelivers to protect margin, or overengineers to avoid scope disputes.

The result: fixed-price AI RFP responses are either heavily padded with contingency, or underbid by vendors who win on price and renegotiate later. Neither outcome serves the organisation well.

What to Ask Instead

Structure your procurement in two phases. Phase one: a time-and-materials discovery engagement (typically 4–8 weeks) to assess data, define the problem precisely, and design the technical approach. Phase two: delivery based on the outputs of discovery. This approach lets you evaluate vendors on how they work, not just what they promise.

During the discovery selection, ask these questions in written responses and interviews:

1. 1.Walk us through your data assessment process. What do you look for, and what findings typically change the project scope?
2. 2.What does the client team need to provide during an engagement? What is the realistic internal time commitment?
3. 3.How do you handle changing requirements once delivery begins?
4. 4.Who owns the models and code at project completion? Do you have any ongoing dependencies on your infrastructure?
5. 5.How do you handle model updates and retraining after initial delivery? What does a maintenance relationship look like?
6. 6.What is your approach to GDPR compliance for data processed during the project? Where is data stored and processed?

Public Sector Compliance Requirements

Dutch government AI procurement has specific requirements beyond standard commercial contracts:

• BIO (Baseline Informatiebeveiliging Overheid): vendors accessing government data systems must demonstrate BIO compliance. Request their documented BIO measures and any ISAE 3402 or ISO 27001 certification.
• Algorithm Register obligation: AI systems making or informing decisions about citizens must be registered in the Dutch Algorithm Register. Ensure your procurement requires the vendor to provide the documentation needed for registration.
• ADM (Automated Decision-Making) transparency: systems making automated decisions about individual citizens require specific documentation of decision logic, the ability to explain individual decisions, and a human review pathway.
• Sovereign data requirement: in most cases, Dutch government data cannot be processed outside the EU. Verify that development, training, and deployment infrastructure is EU-based.

Red Flags in Vendor Responses

• Fixed-price proposal for a project with no completed data assessment
• No explicit data audit or discovery phase in the project plan
• Inability to explain how individual model decisions are made
• Data processing on non-EU infrastructure without an adequacy decision or appropriate safeguards
• IP retention provisions that give the vendor ongoing rights to models trained on your data
• References exclusively from private sector — government AI has different constraints that require relevant experience