Machine learning · RFP · UK public procurement · updated 15 August 2026

Machine learning RFP: writing one, finding one

A machine learning RFP is a request for proposal for work whose method cannot be specified in advance — the buyer describes an outcome and a dataset, and asks you to propose the model.

There is one fact underneath both halves of this page, and it is checkable in a minute: there is no CPV code for machine learning. UK procurement classifies every notice with a vocabulary the Procurement Regulations 2024 inherit from 2002. So ML work does not sit anywhere — it scatters.

See where it scatters to Work out which rules apply

What a CPV alert sees

Measured on our own corpus, 15 August 2026: the 279 UK notices out of 753,083 whose title or description contains the phrase “machine learning”. Bars are the share of those 279 that a watch on that many CPV codes would surface. The method, and its limits, are in the instrument below.

Scroll to descend

Two people arrive on this page, and the same fact matters to both of them.

What a machine learning RFP is, on both sides of the table

One side is writing the document. The other side is trying to find it before the deadline. They need different things from this page, and they share exactly one problem.

The distinction between a request for proposal and a tender is real: an RFP is issued when the buyer knows the outcome but not the method, and a tender when the specification is already fixed. Machine learning is close to a definition of the first case — the buyer has a dataset and a decision to improve, and cannot honestly write down the model architecture in advance. That is why so much of this work arrives as an RFP even when it is bought by a public body running a statutory tendering procedure. We take the terminology apart properly on RFP tender.

What the buyer and the supplier share is the classification problem. UK notices are indexed by the Common Procurement Vocabulary, and it has no entry for what this work is. The buyer publishes under a code that does not describe the contract; the supplier watches codes that do not surface it. Neither of them is doing anything wrong.

The rest of this page is organised by that: where the work actually sits, how to find it anyway, which rules bind you once you are in it, and what a well-formed pack should say.

If you are buying

Your notice will be found by its words, not its code. Write the description so a text search finds it, and read what the pack should specify — the AI Playbook has twelve drafting points and almost no ML RFP we see covers all of them. [14]

If you are selling

A CPV-code alert is the wrong instrument for this market. On our corpus the single best code sees 31% of ML notices and the best three together see 65%. What to watch instead.

If you are already bidding

Two rulebooks apply that most bidders have not read: PPN 017, on using AI to write your own response, and — if you sell into the EU — a high-risk compliance deadline that moved by about sixteen months in July 2026. [1] [10]

There is no CPV code for machine learning

Every UK public notice carries at least one Common Procurement Vocabulary code. It is how buyers say what they are buying and how suppliers say what they want to hear about. And the vocabulary predates the entire field.

The Procurement Regulations 2024, reg. 3, define the term without ambiguity: “‘CPV code’ means a code used in the Common Procurement Vocabulary as adopted by Regulation (EC) No 2195/2002 of the European Parliament and of the Council of 5 November 2002 on the Common Procurement Vocabulary”. [3] The regulations’ own footnote adds that this is “the retained version” of that regulation, as amended by SI 2020/1319. [3] The vocabulary’s current content was set by Commission Regulation (EC) No 213/2008, adopted in 2007. [4]

So the classification a UK machine-learning contract is required to carry was written before the field it is classifying existed in any commercial form, and has never been revised for it.

Watch this CPV code — how much ML work does it see?

72000000

of 279 ML notices — 31%

Method, stated so it can be re-run. Population: every notice in the rfp.quest corpus — 753,083 UK notices from Find a Tender and Contracts Finder, published 20 September 2005 to 14 August 2026 — whose title or description contains the string “machine learning”. That is 279 notices. The counts above are how many of those 279 carry the given code, taken from the CPV array on each notice. Queried 15 August 2026; the exact SQL is in this page’s ship note. What this does not measure: machine-learning work that never uses the phrase, and any requirement buried in an attached document rather than the notice body. It is a floor, not a census. [22]

We checked the vocabulary itself, not just our intuition about it

Across the 261,272 UK notices published since 1 January 2024 that we hold, buyers used 7,206 distinct CPV codes, each arriving with its official description attached. Not one of those 7,206 descriptions contains “machine learning”, “artificial intelligence”, “AI”, “algorithm” or “neural”. [22]

The nearest thing to a match is a 2008 phrase about forecasting, and nobody uses it

72212460 is “Analytical, scientific, mathematical or forecasting software development services” — the closest the vocabulary gets to a model-building code. It appears on none of the 279 notices that say “machine learning”. It does appear on the NHS AI framework below, which suggests the problem is discoverability rather than unwillingness: buyers cannot reach for a code they have no reason to know exists. [22] [6]

If the work has no code, the question is where it goes instead — and a nine-figure framework answers it.

Where machine learning work actually sits in the classification

The clearest single demonstration is a framework that is explicitly, exclusively about AI, and classifies itself entirely with codes about something else.

NHS Shared Business Services, “Healthcare AI Solutions”. A tender notice under the Procurement Act 2023, notice identifier 2026/S 000-050314, published 11 May 2026 and last edited 28 May 2026. An open framework in eight lots — radiology, pathology, virtual and robotic health, predictive analytics, research and innovation, operational efficiency, advisory, and combined solutions. Estimated total value £750,000,000 excluding VAT (£900,000,000 including VAT). [6]

Every CPV code it carries, across all eight lots, with the official description the notice itself publishes:

33100000Medical equipmentsA goods code. The framework buys software.

33110000Imaging equipment for medical, dental and veterinary useThe scanner, not the model that reads its output.

33124000Diagnostics and radiodiagnostic devices and suppliesDevices and supplies. Again, hardware vocabulary.

48180000Medical software packageThe closest fit on the notice, and it says nothing about how the software works.

71000000Architectural, construction, engineering and inspection servicesOn a framework for diagnostic AI.

72200000Software programming and consultancy servicesTrue of almost every IT contract ever let.

72212330Scheduling and productivity software development servicesFor lots including predictive analytics and operational efficiency.

72212460Analytical, scientific, mathematical or forecasting software development servicesThe nearest the vocabulary has to a model-building code.

72300000Data servicesThe generic data-handling code.

73100000Research and experimental development servicesWhere genuinely novel model work often ends up.

75100000Administration servicesPublic-administration services generally.

80000000Education and training servicesThe training and adoption element, presumably.

Twelve codes, not one of which contains the words the framework is named after. This is not a criticism of the buyer — there was no better code available. It is what a missing classification looks like from the inside.

Across the whole corpus the same pattern holds at scale. The 279 notices naming machine learning carry 261 distinct CPV codes across 23 divisions, and 17 of them carry no CPV code at all. [22] Three divisions do most of the work — 72 (IT services) on 101 notices, 48 (software packages) on 69, 73 (research and development) on 62 — and after that it thins fast: 79 business services on 26, 71 engineering on 22, then 80, 30, 35, 38, 32, 34, 33, 63, 22, 90, 85, 98, 45, 64, 60, 09, 03 and 66, most of them on a handful of notices each.

What that means if you are watching codes

Three codes get you two thirds

A watch on 72000000, 73000000 and 48000000 together would have surfaced 181 of the 279 — 65%. Adding twelve more codes takes you to 238, which is 85%. The tail is genuinely long and there is no set of codes that closes it. [22]

What that means if you are publishing

Your description is your index

Suppliers who find your ML notice will almost all have found it on its words. Write the description so it contains the terms a specialist would search for — including the ones you think are obvious, because a code alert will not carry them.

Which is a search problem before it is a bidding problem.

AI RFP software: finding work that has no code

Most tender-alert products are built on the classification, because the classification is what the registers publish and it is cheap to filter on. For this category that is the wrong axis, and the numbers above say by how much.

What it matches on Code-ledThe CPV array on the notice, which the buyer chose from a 2008 vocabulary. Text-ledThe words the buyer actually wrote in the title and description.

Coverage of ML notices, measured Code-led31% on the single best code; 65% on the best three. 17 notices carry no code at all and are unreachable by any code filter. [22] Text-ledBy construction it finds the 279 that say “machine learning”. It misses work that describes itself another way — “predictive model”, “computer vision”, “natural language”, “algorithmic triage”.

What it gets wrong Code-ledSilently. A code alert that returns nothing looks identical to a quiet market. Text-ledNoisily. You get contracts that mention machine learning in passing and are really about something else, and you have to read them.

The fix for its blind spot Code-ledThere isn’t one inside the classification. Widening to 72000000 wholesale means reading the entire UK IT market. Text-ledA synonym set, maintained deliberately, plus the buyer and framework routes below.

Below-threshold work Code-ledSame problem, smaller notices, thinner descriptions. Text-ledSame approach. Both UK registers matter here: Find a Tender carries everything commenced under the Act, and Contracts Finder is still live with legacy notices. [2]

Two routes work alongside the text search and neither depends on classification at all.

Route one

The buyer, not the code

Bodies that have bought machine learning once buy it again, and their cadence is visible in their published history. Watching an authority is a stabler signal than watching a code it did not choose carefully.

Route two

The commercial agreements

The AI Playbook names the routes to market directly: dynamic purchasing systems including “Artificial Intelligence (AI)”, “Automation Marketplace” and “SPARK”, and frameworks including “Big Data and Analytics”, “Technology Products & Associated Services 2” and “Technology Services 3”. [14] A place on the right agreement puts you in front of call-offs that never appear as an open notice.

One consequence worth naming because it cuts against us as well as for us: any vendor claiming complete coverage of “AI tenders” is claiming something the classification cannot deliver and text search can only approximate. We do not claim it either. What we can show you is the query and the corpus it ran against.

Machine learning tendering software: what it has to do differently

Four separable jobs sit behind the phrase, and a product can be excellent at one and useless at the next. Decide which one is failing before you shortlist anything.

01Find. Given the section above, this means text and buyer and framework, not classification. The test to apply to any product: ask it how many of its ML matches came from a code filter, and what it does about the notices with no code.

02Qualify. An ML notice with a generic code is often written by a buyer who has not scoped the work, which is the single biggest predictor of a bid you should not have entered. Look for a stated dataset, a stated baseline and a stated evaluation method — the twelve drafting points below are a usable checklist for reading someone else’s pack, not just for writing your own.

03Extract. The requirements in an AI pack cluster differently from a standard IT pack: data protection and DPIA, model explainability, bias testing, IP in trained weights, model drift and retraining, and increasingly a named management-system standard. A tool that extracts requirements should show you the sentence each one came from, or you cannot check it.

04Draft. This is where a language model earns its place and also where PPN 017 applies to you directly. Government policy is that using AI to write your bid is permitted; it also expects you to have checked what it produced.

The reason to separate them is that the market does not. Products are sold as one thing and are, in practice, strong at one or two of the four. We compare eleven UK products against eleven published criteria on AI tool for bids and tenders, including a section naming where we come off worst.

Then: once you are actually in one, whose rules are you under?

Which rulebook a machine learning bid is actually under

Four regimes can bite on one ML contract, and they attach for four different reasons — who the buyer is, what the system does, where you sell it, and what the buyer chose to put in the pack.

Four regimes to check

Nothing here is computed and nothing here is legal advice. Each line is a restatement of a published rule, cited in the record below, and the instrument only decides which of them your answers make relevant. Where a regime turns on a judgement — whether a system is high-risk, whether a tool has “significant influence” on a decision — it says so rather than deciding for you.

The one everyone knows

The Procurement Act 2023

If the buyer is a contracting authority and the contract is above the Schedule 1 threshold, the Act governs the procedure whatever the document is called — notices, statutory minimum tendering periods, assessment summaries, an eight-working-day standstill and challenge rights. It has applied to procurements commenced on or after 24 February 2025. [2] [1]

The one nobody reads

The Algorithmic Transparency Recording Standard

It binds the buyer, not you — but it reaches you through the contract. The AI Playbook is explicit: “contracts between the public sector and third parties can be drafted to require transparency from the supplier on the different information categories, as set out in the ATRS”. [14] Scope is tools that “have a significant influence on a decision-making process with public effect, or directly interact with the general public”, at “Beta/Pilot or Production phase”. [12]

How much ATRS activity there actually is, with its date on it. The public register held 142 records when we checked it on 15 August 2026. [13] That number moves; treat it as a reading, not a constant. Local government and police forces are not within the mandatory scope — publishing is recommended for them, not required. [12]

The EU AI Act reaches UK suppliers, and its main deadline just moved

Regulation (EU) 2024/1689 applies by placing on the market, so a UK supplier selling an ML system into the EU is in scope. [11] The Council of the EU gave final approval to the package on 29 June 2026, and it became law as Regulation (EU) 2026/1744 of 8 July 2026 (OJ L, 24.7.2026), in force 27 July 2026 — which is the instrument to cite, not the press release: “Given that provisions on high-risk AI systems were due to enter into force on 2 August 2026, the co-legislators treated this part of the package with utmost priority and agreed on a fixed timeline for the delayed application of high-risk rules: the new application dates would be 2 December 2027 for stand-alone high-risk AI systems and 2 August 2028 for high-risk AI systems embedded in products.” [10]

Two other dates in the same package

National regulatory sandboxes are postponed to 2 August 2027, and the grace period for providers to implement transparency solutions for artificially generated content is cut from six months to three, with the new deadline 2 December 2026. [10]

A note on what we are not telling you. As at 15 August 2026 the Council’s own release said the act would be published in the Official Journal “shortly”. [10] We have not found the amending regulation’s OJ number, so this page does not cite one — it cites the adoption and the base regulation, both of which are checkable today. If you need the consolidated text for a compliance decision, look it up rather than taking it from any page, including this one.

PPN 017: the UK government’s position on using AI to write your bid

This is the most directly useful document in this entire subject for a supplier, and it is the one competing pages do not cite.

Information Note PPN 017, Improving Transparency of AI Use in Procurement, Cabinet Office. Originally issued November 2023, updated February 2025, published on GOV.UK in its current form on 17 February 2025. It applies to procurements commenced on or after 24 February 2025; PPN 02/24 covers anything commenced before that. [1] As at 15 August 2026 the GOV.UK collection runs to PPN 026, and 017 is still the only AI note in the Procurement Act series. [21]

Paragraph 9, verbatim, and it is the sentence to know:

“There are potential benefits to suppliers using AI to develop their bids, enabling them to bid for a greater number of public contracts. It is important to note that suppliers’ use of AI is not prohibited during the commercial process but steps should be taken to understand the risks associated with the use of AI tools in this context, as would be the case if a bid writer has been used by the supplier.”
PPN 017, para 9 [1]

The same paragraph says what buyers may do about it: ask suppliers “to disclose their use of AI in the creation of their tender”, and put in place “proportionate controls to ensure suppliers do not use confidential contracting authority information, or information not already in the public domain as training data for AI systems”. [1]

Annex B is not scored, and it says so

“The questions included in this annex should not be scored or taken into account when assessing a tender and should be used for information only.” Buyers may still ask and evaluate their own AI questions elsewhere in the award process — but if what you are looking at is the Annex B disclosure question, answering it honestly cannot cost you marks. [1]

The example question uses the words on this page

“Have you used AI or machine learning tools, including large language models, to assist in any part of your tender submission?” — followed by “Where AI tools have been used to support the generation of Tender responses, please confirm that they have been checked and verified for accuracy”. A second example asks whether “AI or machine learning technologies” are used in the products or services you intend to provide. [1]

Paragraph 15 is the warning, and it describes the failure mode precisely enough to be worth quoting in full: “Content created with the support of LLMs may include inaccurate or misleading statements; where statements, facts or references appear plausible, but are in fact false… LLMs are trained to predict a ‘statistically plausible’ string of text, however statistical plausibility does not necessarily mean that the statements are factually accurate.” [1]

RFP GPT: what a language model can and cannot be trusted with here

“RFP GPT” is what people search for when they want a model to write the response. It is a reasonable thing to want, and the boundary is sharper than the marketing suggests.

Where it holds up

Re-expression from material you already own

Turning an answer you have written before into the vocabulary and length this buyer asked for. The facts are yours, the structure is the buyer’s, and the model is doing the transformation. This is the job it is genuinely good at.

Where it fails, quietly

Anything it has to supply itself

Case-study numbers, certification scope, named referees, clause references, standards. PPN 017 para 15 is describing exactly this: plausible and false are the same shape on the page. [1]

Three rules that follow from the policy rather than from opinion.

01Answer the disclosure question and answer it plainly. Use is not prohibited, the Annex B question is not scored, and a supplier who conceals use has swapped a non-issue for a misrepresentation. [1]

02Do not put the buyer’s confidential pack into a model that trains on it. PPN 017 names this specifically as something buyers may control for — using confidential tender documents to train a model to write future responses. [1] Check what your tool does with the documents you upload, in writing.

03Verify before submission, and be able to say how. The Annex B follow-up asks you to confirm that generated content “have been checked and verified for accuracy”. That is answerable if your process has a check in it and unanswerable if it does not. [1]

We build one of these tools. The reason our own drafting works from your previously-submitted answers rather than from open generation is the paragraph above, not modesty — a model asked to invent a compliance claim will invent one, and the buyer is the one who finds out.

And then the certification question, which almost every page on this subject gets wrong in the same direction.

ISO 42001 in AI tenders: what it certifies, and how often it is asked for

There is a widely-repeated line that ISO 42001 is becoming a standard entry ticket for AI tenders. We can measure that on UK notices, and the measurement does not support it.

ISO/IEC 42001:2023, “Information technology — Artificial intelligence — Management system”, Edition 1, published December 2023. It “specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations”. [8]

Read that scope carefully, because it is the whole point

42001 certifies the organisation’s management system. It does not certify the model. A supplier holding 42001 has demonstrated that it has governance processes for AI — it has not had its algorithm assessed, tested for bias or validated against your use case, and no certificate says otherwise. If that is what you need, ask for it separately. [8]

The companion standard is ISO/IEC 23894:2023, “Guidance on risk management”, published February 2023. It is guidance and is not certifiable, which is worth knowing before someone offers to certify you to it. [9]

How many UK tenders actually ask for it

We searched the whole corpus — 753,083 UK notices, published 20 September 2005 to 14 August 2026 — for the digits 42001 in the title or description, deliberately searching the number rather than the phrase so that misspellings and variant prefixes still match.

raw matches for the string “42001” across 753,083 notices

genuine requirement, once the false positive is removed

238

notices mentioning ISO 27001, for comparison

The false positive is worth naming, because it is exactly the kind of thing that turns into a statistic if nobody looks: a 2022 dental-equipment maintenance contract whose description lists a handpiece serial number, 42100393. [22]

The genuine one is First Rail Holdings Limited, First Cyber Security Tooling & Managed Services Tender, notice identifier 2026/S 000-045436, published 18 May 2026, estimated £3,433,993 excluding VAT. Verbatim from the notice: “Suppliers must provide certification with recognised industry standards, including: ISO/IEC 27001 (Information Security Management); ISO 22301 (Business Continuity Management); ISO/IEC 42001 (Artificial Intelligence Management Systems); UK NCSC-backed schemes Cyber Essentials and Cyber Essentials Plus”. [7]

Caveat one

It is a rail operator, not central government

First Rail Holdings is a public undertaking publishing under the Procurement Act 2023, which is not the same signal as a Cabinet Office department mandating a standard. And its Scope section carries the requirement as “CSO/IEC 42001” — a typo in the published notice, which is precisely why we searched on the digits. [7]

Caveat two

This is a floor, not a census

We search the notice title and description. A requirement that lives only in an attached ITT pack is invisible to this count, and packs are where conditions of participation usually live. The honest statement is: one notice in 753,083 names it in the published text, as at 15 August 2026. Not “only one UK buyer wants it”. [22]

What we will not publish, because we cannot support it: any figure of the form “X% of AI tenders now demand ISO 42001”. The most-shared version of that claim rests on the EU AI Act becoming fully applicable in August 2026, which stopped being true in July 2026. [10] If a page quotes you a rate here, ask what it counted. We have told you what we counted and where.

We keep a page on the standard itself: ISO 42001 in AI tenders.

The rules under this market: a dated record

Nine dates, because at least three of them are wrong on most pages currently ranking for these terms.

The vocabulary is adopted

Regulation (EC) No 2195/2002 establishes the Common Procurement Vocabulary. It is the instrument the Procurement Regulations 2024 still point at, in its retained form. [3] [5]

The vocabulary’s current content is set

Commission Regulation (EC) No 213/2008, adopted 28 November 2007, revises the CPV. Nothing has revised it for machine learning since. [4]

Guidelines for AI Procurement published

Office for AI, Cabinet Office and the World Economic Forum. Guideline 8: “Avoid Black Box algorithms and vendor lock in”. Still cited as live by both PPN 017 and the AI Playbook, and never revised. [15]

ISO/IEC 42001 published

The AI management-system standard, Edition 1. Certifiable, and about the organisation rather than the model. [8]

ATRS mandatory scope published

Which bodies must publish an algorithmic transparency record, for which tools, at which lifecycle stage. Local government and police forces are outside the mandatory scope. [12]

AI Playbook for the UK Government

Ten principles, the twelve drafting points for AI requirements, and the named routes to market. Government Digital Service. [14]

The Procurement Act 2023 commences, and PPN 017 applies

PPN 017 was published on GOV.UK on 17 February 2025 and applies to procurements commenced on or after 24 February 2025. PPN 02/24 covers anything commenced before it. [1]

AI Management Essentials is not embedded after all

The Playbook said DSIT planned to work with the Cabinet Office to embed the self-assessment tool in procurement frameworks. [14] DSIT’s government response: “By taking a size and occupation agnostic approach, AIME struggled to meet the diverse needs of different users… we plan to refine our approach, and develop future guidance focused solely on the foundational governance measures needed… and to specifically target SMEs.” [17]

The EU high-risk deadline moves

Council final adoption of the Digital Omnibus on AI. 2 August 2026 becomes 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for high-risk systems embedded in products. [10]

The AI Management Essentials line is the one worth carrying away. A supplier who built a compliance story around a tool that was going to be embedded in government frameworks was building on a plan that was withdrawn in February 2026, and very little content has caught up.

Writing the machine learning RFP: what the buyer should specify

The government’s own list is twelve items long, it is published, and it is a better checklist than anything a vendor will sell you. Tick the pack in front of you against it — whether you are writing it or answering it.

Tick what the pack actually covers

of 12 drafting points covered

The twelve items are the AI Playbook’s own list, quoted from the section headed “When drafting requirements for AI, you should:”, in its order. [14] The score is a count of what you ticked and nothing else — there is no weighting, no benchmark and no implied verdict on the procurement. It is a reading aid.

Two things the Playbook adds that change the shape of a public ML procurement before a word of the specification is written.

Business case

£10 million and the five-part case

“Typically, any investment approaching £10 million will require a five-part business case”, following the Treasury’s Green Book. [14]

Spend controls

£100,000 public-facing, £1 million otherwise

“it’s mandatory to assure all digital and technology spend above £100,000 for anything public facing and £1 million for anything else, through your assurance boards”. [14]

Two older documents remain in play and both need a date attached when you cite them. The Guidelines for AI Procurement were published on 8 June 2020 and have not been revised since, yet they are still cited as current by both PPN 017 and the AI Playbook — so treat them as current-but-unrevised-since-2020 rather than as up-to-date guidance. [15] [1] [14] And the NIST AI Risk Management Framework 1.0, with its four core functions GOVERN, MAP, MEASURE and MANAGE, gives a UK buyer a usable vocabulary for structuring requirements — but it is a United States framework and it is voluntary, so it is a structure a UK buyer may adopt, never an obligation on a UK supplier. [16]

Not all of this work is software, and the part that isn't is bought differently.

AI consulting RFP support: where the work is advisory rather than software

A large share of what gets bought under an AI heading is not a system at all. It is a feasibility study, a data-readiness assessment, an evaluation, or an ethics and assurance review.

The classification tells you this is happening even though it cannot tell you what it is. Division 73 — “Research and development services and related consultancy services”, whose child 73100000 is “Research and experimental development services” — appears on 62 of the 279 ML notices, which is 22% of them, and division 79, business services, on 26. [22] That is a substantial advisory tail sitting inside a market everyone describes as a software market.

01It is often the first contract, not the small one. A buyer who cannot specify the model buys the study that will let it specify the model. Winning the study puts you in the room for the build — and can also disqualify you from bidding for it, depending on how the authority handles the conflict, which is worth asking about before you price the study.

02The evaluation is about people, not product. Named individuals, their CVs, comparable engagements. There is no product demo to hide behind, and a generic capability statement scores badly.

03Assurance work is growing because the obligations are. ATRS records, DPIAs, bias testing and management-system implementation are all things a buyer can procure as advice, and all things the documents above have created demand for since 2024.

04The SME position is documented. DSIT’s own sector study records that interviews “noted significant challenges for smaller AI businesses when competing for public sector contracts” — procurement processes favouring larger established firms, difficulty demonstrating required scale, and subcontracting arrangements. [19] If you are small, that is not your imagination, and it is in a government publication you can cite back.

Machine learning procurement portal software

Two different products get called this, and conflating them is how organisations end up owning neither.

Sense one

A portal that uses machine learning

A tender platform applying ML to matching, deadline extraction, requirement classification or bid-decision scoring. The buyer of this is a supplier trying to find and win work. This is our category, and this page is on our site, so treat what follows accordingly.

Sense two

A portal for procuring machine learning

An e-procurement system used by a buying organisation to run ML procurements — the same portal it uses for everything else, with AI-specific assurance questions bolted into the workflow. The buyer of this is a procurement function.

What an ML procurement platform has to hold

In either sense, the same four things have to be in the system rather than in somebody’s inbox, and the classification gap is why the first one is hard.

01A search that does not depend on the code. If the platform’s ML coverage comes from a CPV filter, its coverage is bounded at roughly a third of the market by the numbers above. Ask which it uses. [22]

02Requirements with their evidence attached. Every extracted requirement should carry the sentence it came from. Without that you cannot audit the extraction, and an AI pack is exactly where an unaudited extraction goes wrong.

03An answer library with provenance. Which bid an answer came from, when, and whether the claim in it is still true. This is what makes drafting safe under PPN 017 para 15 rather than unsafe. [1]

04Dates that are the buyer’s, not the platform’s guess. Stated deadlines and stated contract end dates, kept separate from any forecast, so nobody plans a bid team around an inference.

Running machine learning bids in one place

The work behind this page is the work the product does: read both UK registers, index what the notice says rather than what it is coded as, and keep the requirements with their evidence.

rfp.quest ingests Find a Tender and Contracts Finder, so the below-threshold half of the market is searchable alongside the above-threshold half; extracts the requirements out of a pack with the sentence each was read from; and keeps your past answers in a library that can be matched to a new question. It is free to start and there is no card. Sign up free, or search live tenders first without an account.

Machine learning RFP classification on rfp.quest: how ML tenders scatter across generic CPV codes in UK public procurement — The measurement behind this page: 279 UK notices naming machine learning, and the share of them a watch on one, three or fifteen CPV codes would actually surface. Queried on the rfp.quest corpus, 15 August 2026.

We publish no time-saving multiple, no win-rate uplift and no coverage percentage for our own product. Every such benchmark we could find in this category is a vendor measuring itself, and we are a vendor in this category. The corpus figures on this page are about the UK market, not about us, and the query that produced each one is recorded.

Back to the surface — the questions, the glossary, and the record.

The sourced record

Questions people actually ask about machine learning RFPs

These are real search strings from this page’s own query data, reproduced as typed.

best ai bidding platform for government rfps

There is no answer to this that does not depend on which of four jobs you are failing at — finding opportunities, deciding what to bid for, extracting requirements from the pack, or drafting the response. Products are strong at one or two and sold as though they were strong at all four. For UK government work specifically, the questions that separate them are: does it carry both registers or only Find a Tender; does its coverage come from CPV filters (which for AI work caps out around a third of the market by our own measurement); does it show you the source sentence for every extracted requirement; and does it draft from your own past answers rather than generating claims. We publish a weighted comparison of eleven UK products, including where we come off worst, on AI tool for bids and tenders.

best ai for tender writing

The right question is which part of tender writing. A general-purpose model is good at re-expressing material you already own into the buyer’s vocabulary and length, and unreliable at anything it has to supply itself — case-study figures, certification scope, clause references, referees. UK government policy describes the failure mode precisely: PPN 017 warns that content created with the support of large language models “may include inaccurate or misleading statements; where statements, facts or references appear plausible, but are in fact false”. So the useful tool is the one wired to your own answer library with the provenance attached, not the one with the best open-ended generation.

government rfp artificial intelligence compliance fraud detection 2026

Fraud detection is one of the clearest cases of the classification problem on this page: it is bought by many different kinds of body, and it lands under general IT, data services, business services or research codes depending on who is writing the notice. Two compliance points attach to it specifically. If the tool has a significant influence on a decision with public effect, the buying organisation may be within the mandatory scope of the Algorithmic Transparency Recording Standard, and the AI Playbook says contracts can be drafted to require the supplier to provide that transparency information. And if you sell the same system into the EU it is likely to fall in the high-risk category, whose application dates were moved by Regulation (EU) 2026/1744 to 2 December 2027 for stand-alone systems and 2 August 2028 for systems embedded in products.

ai firms iso 42001 certification in rfps

It is asked for, and it is asked for far less often than the marketing around it suggests. Across the 753,083 UK notices we hold, the digits “42001” appear in the title or description of two, and one of those is a serial number on a dental-equipment contract. The genuine one is First Rail Holdings’ cyber security tooling tender of 18 May 2026, which requires certification to ISO/IEC 27001, ISO 22301, ISO/IEC 42001 and Cyber Essentials. That count is a floor rather than a census, because a requirement stated only in an attached ITT pack is invisible to it. What is worth knowing regardless is what the certificate means: ISO/IEC 42001 certifies an organisation’s AI management system, not any particular model, so holding it does not evidence that your algorithm has been tested.

iso 42001 artificial intelligence governance tender procurement 2026

ISO/IEC 42001:2023 is the certifiable management-system standard, published in December 2023; ISO/IEC 23894:2023 is the companion risk-management guidance, published February 2023, and it is guidance rather than something you can be certified against. In a UK tender context the honest position in 2026 is that 42001 is a differentiator rather than a gate: it is rarely a stated condition of participation, and where it appears it usually sits alongside 27001 and 22301 in a list of recognised standards. Be wary of any claim that the EU AI Act is forcing it into UK tenders from August 2026 — that premise stopped being true in July 2026, when Regulation (EU) 2026/1744 moved the high-risk application dates to December 2027 and August 2028.

gov.uk ai tender

Three GOV.UK documents do most of the work. PPN 017, “Improving Transparency of AI Use in Procurement”, is the note that says suppliers’ use of AI to write bids is not prohibited and sets out the disclosure questions buyers may ask. The AI Playbook for the UK Government (10 February 2025) has the twelve drafting points for AI requirements and the routes to market. The Guidelines for AI Procurement (8 June 2020) are still cited as current by both, and have not been revised since 2020, so date them when you rely on them. The notices themselves are on Find a Tender, and are not reliably findable by CPV code — which is the subject of most of this page.

evaluate the market for purpose-built ai tender response orchestration platforms.

Split the category before evaluating it, because “orchestration” hides four separable jobs: discovery, bid/no-bid qualification, requirement extraction and response drafting. Then evaluate each against something checkable. For discovery, ask what a product does about notices with no useful classification — on our corpus 17 of 279 machine-learning notices carry no CPV code at all and 261 distinct codes cover the rest. For extraction, ask to see the source sentence behind an extracted requirement. For drafting, ask what happens to uploaded buyer documents and whether they are used as training data, because PPN 017 names that as something buyers may control for. For qualification, ask what the score is computed from and refuse any number whose inputs are not shown.

open machine learning software tender rfp enterprise automation deadline 2026

Open procedures under the Procurement Act 2023 are single-stage: the tender notice is the invitation to tender, and your submission is assessed as written, with statutory minimum tendering periods rather than deadlines the buyer picks freely. For machine learning and enterprise automation work specifically, the practical difficulty is not the deadline but finding the notice in time, because the classification will not bring it to you — the commonest CPV code on ML notices in our corpus catches 31% of them. Watch the text, the buyers who have bought this before, and the commercial agreements the AI Playbook names, and treat any code-based alert as a supplement rather than the mechanism.

Machine learning procurement glossary

Sixteen terms you will meet in a UK ML procurement, each with the source that defines it where one exists.

AIMSArtificial Intelligence Management System — the thing ISO/IEC 42001 certifies. An organisational management system, not a model. [8]

ATRSAlgorithmic Transparency Recording Standard. Mandatory for in-scope central government bodies and arm’s-length bodies, for tools with significant influence on decisions with public effect. [12]

AIMEAI Management Essentials, a DSIT self-assessment tool. Planned for embedding in procurement frameworks; that plan was dropped in the government response of 6 February 2026. [17]

Conditions of participationWhat replaced the selection questionnaire under the Procurement Act 2023: proportionate requirements on legal, financial and technical capacity. Where a standard like ISO 42001 would be mandated if it is mandated at all. [2]

Contracting authorityThe body whose status makes the Procurement Act 2023 apply. Not decided by what the document is called. [2]

CPV code“A code used in the Common Procurement Vocabulary as adopted by Regulation (EC) No 2195/2002” — Procurement Regulations 2024, reg. 3. Retained EU law. [3]

Dynamic marketA list of qualified suppliers a buyer runs competitions inside; the Act’s successor to the dynamic purchasing system. Several AI routes to market are of this shape. [14]

Find a TenderThe UK central digital platform. Carries notices published under the Procurement Act 2023, above and below threshold.

High-risk AI systemThe EU AI Act category carrying the heaviest obligations. Application dates moved by Regulation (EU) 2026/1744 to 2 December 2027 (stand-alone) and 2 August 2028 (embedded in products). [10]

ISO/IEC 23894:2023“Guidance on risk management” for AI. Guidance, published February 2023 — not a certifiable standard. [9]

ISO/IEC 42001:2023“Information technology — Artificial intelligence — Management system”, Edition 1, December 2023. Certifiable, organisation-level. [8]

NIST AI RMFThe US AI Risk Management Framework 1.0. Four core functions: GOVERN, MAP, MEASURE, MANAGE. Voluntary, and American — useful vocabulary, not a UK obligation. [16]

PPNProcurement Policy Note. The Cabinet Office instrument that carries government procurement policy. As at 15 August 2026 the collection runs to PPN 026. [21]

PPN 017Improving Transparency of AI Use in Procurement. The only AI note in the Procurement Act series. Says suppliers’ use of AI is not prohibited. [1]

RFPRequest for proposal. A term of commercial practice, not of UK procurement law — it has no definition in the Procurement Act 2023. Explained here.

Tender noticeThe published opportunity under the Act. In an open procedure it is itself the invitation to tender. [2]

What the UK AI market actually looks like

Four numbers, each labelled with exactly what it measures, and one that does not exist.

37%

of government bodies had deployed AI — as at autumn 2023

Of 87 bodies responding to the National Audit Office’s survey. A further 37% had not deployed but were piloting or planning; 74 use cases were deployed in total; 21% had an AI strategy and 70% reported skills as a barrier. Published 15 March 2024, HC 612 — date-stamp it, the survey is from autumn 2023. [18]

5,862

UK AI firms in 2024, up 58% from 3,713 in 2023

DSIT’s Artificial Intelligence sector study 2024, published 3 September 2025. Revenue £23.9bn, GVA £11.8bn, employment 86,139. Figures are for 2024. [19]

35%

of UK businesses with 10+ employees report using AI — up from ~12%

ONS, released 20 July 2026, from the Business Insights and Conditions Survey. Self-reported. BICS excludes public administration and defence, so this is not a public-sector figure and must never be presented as one. [20]

279

UK notices naming machine learning, across 261 CPV codes

Of the 753,083 notices in the rfp.quest corpus, published 20 September 2005 to 14 August 2026. 17 carry no CPV code at all. Queried 15 August 2026; the SQL is in the ship note. A floor, not a census — it counts the phrase, not the field. [22]

And the number that does not exist. There is no official UK statistic for the volume or value of AI and machine-learning public-sector contracts. We looked for one and did not find it, and the reason is the subject of this page: without an AI classification, official spend data cannot be disaggregated that way. Several vendors publish figures of this shape. We are not reproducing one, because we cannot tell you how it was counted.

Sources

PPN 017: Improving transparency of AI use in procurement, Cabinet Office. Published on GOV.UK 17 February 2025; the note records “Originally issued: November 2023, Updated: February 2025”. Paragraphs 9 and 15 and Annex B quoted. Accessed 15 August 2026.
Procurement Act 2023 (c. 54), legislation.gov.uk. In force for procurements commenced on or after 24 February 2025.
The Procurement Regulations 2024 (SI 2024/692), legislation.gov.uk. Regulation 3 defines “CPV code”; the accompanying footnote records that this is the retained version of Regulation (EC) 2195/2002, as amended by SI 2020/1319.
Commission Regulation (EC) No 213/2008 of 28 November 2007 amending Regulation (EC) No 2195/2002 on the Common Procurement Vocabulary. The instrument that set the CPV’s current content.
Regulation (EC) No 2195/2002 on the Common Procurement Vocabulary, retained version, legislation.gov.uk.
NHS Shared Business Services Limited, “Healthcare AI Solutions”, Find a Tender. Notice identifier 2026/S 000-050314; procurement identifier ocds-h6vhtk-0695d5; published 11 May 2026, last edited 28 May 2026. Estimated total value £750,000,000 excluding VAT / £900,000,000 including VAT. Eight lots; twelve CPV codes across them, listed in full above.
First Rail Holdings Limited and others, “First Cyber Security Tooling & Managed Services Tender”, Find a Tender. Notice identifier 2026/S 000-045436; procurement identifier ocds-h6vhtk-069b2e; published 18 May 2026; estimated £3,433,993 excluding VAT. Requires ISO/IEC 42001; the Scope section carries the typo “CSO/IEC 42001”.
ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system, ISO. Edition 1, published 2023-12.
ISO/IEC 23894:2023, Information technology — Artificial intelligence — Guidance on risk management, ISO. Published 2023-02. Guidance, not a certifiable requirements standard.
Artificial Intelligence: Council gives final green light to simplify and streamline rules, Council of the EU press release, 29 June 2026 14:30. The Council’s final political approval of the package. Superseded as the citation for these dates by source [14], the regulation itself, verified on 17 August 2026 — this entry recorded that OJ publication was still pending at the date of the release, and it no longer is. Kept because it is the trail that led to the instrument, not because it is the authority for it.
Regulation (EU) 2024/1689 (the EU AI Act), EUR-Lex. OJ L, 2024/1689, 12.7.2024. The base regulation. The amending instrument — which this page could not verify on EUR-Lex as at 15 August 2026 and therefore declined to name — verified on 17 August 2026 and is now cited directly as source [14].
Algorithmic Transparency Recording Standard (ATRS) Mandatory Scope and Exemptions Policy, Government Digital Service. Published 17 December 2024.
Algorithmic transparency records, GOV.UK. 142 records when read on 15 August 2026. This figure moves.
Regulation (EU) 2026/1744 (the Digital Omnibus on AI), amending Regulation (EU) 2024/1689, EUR-Lex. Dated 8 July 2026, OJ L, 24.7.2026, in force 27 July 2026. Quoted at article level from the OJ text: “(i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and (ii) 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I”. This is the authority for the moved deadlines; the Council press release at [10] is not. Verified 17 August 2026. Note for anyone re-checking: there was no official act on 29 June 2026, only the Council’s political approval, so “adopted June 2026” is the wrong provenance for a correct pair of dates.
Artificial Intelligence Playbook for the UK Government, Government Digital Service, published 10 February 2025. Source for the twelve drafting points, the £10m business-case and £100,000 / £1m spend-control thresholds, Principle 8 on ATRS through the contract, and the named routes to market.
Guidelines for AI procurement, Office for AI / DSIT / Cabinet Office with the World Economic Forum. Published 8 June 2020; no revision or withdrawal notice as at 15 August 2026. Guideline 8 quoted.
NIST AI Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023. doi.org/10.6028/NIST.AI.100-1. United States, and voluntary.
Guidance for using the AI Management Essentials tool: government response, DSIT. Updated 6 February 2026.
Use of artificial intelligence in government, National Audit Office, Session 2023-24, HC 612, 15 March 2024. Survey of 87 government bodies, as at autumn 2023.
Artificial Intelligence sector study 2024, DSIT, published 3 September 2025. Firm count, revenue, GVA and employment for 2024; the SME public-procurement finding is in the market-dynamics section.
Artificial intelligence in UK businesses: 2023 to 2026, Office for National Statistics, released 20 July 2026. Based on the Business Insights and Conditions Survey, which excludes public administration and defence.
Procurement policy notes, GOV.UK collection. Read 15 August 2026: the Procurement Act 2023 series runs to PPN 026, and PPN 017 is the only note in it about AI. PPN 02/24 is listed under the Public Contracts Regulations 2015 heading.
rfp.quest corpus, queried 15 August 2026. 753,083 UK notices ingested from Find a Tender and Contracts Finder under the Open Government Licence v3.0, published 20 September 2005 to 14 August 2026. Machine-learning population: notices whose title or description matches the phrase “machine learning”, case-insensitive — 279 notices, of which 262 carry at least one CPV code and 17 carry none, spanning 261 distinct codes in 23 divisions. Vocabulary sweep: CPV code and description pairs extracted from the raw OCDS of the 261,272 notices published on or after 1 January 2024, giving 7,206 distinct codes, none of whose official descriptions contains “machine learning”, “artificial intelligence”, “AI”, “algorithm” or “neural”. The exact SQL for every figure on this page is recorded in its ship note so it can be re-run rather than trusted.