Legal and professional services · Playbook 36

Proposal and bid drafting

First drafts of every answer in days, not weeks, each claim linked to the evidence behind it. The bid manager checks, decides and signs off what is submitted.

  • Retrieval (RAG)
  • Generative AI
  • Human in the loop
  • Procurement Act 2023
  • PPN 017 (AI in procurement)
  • Failure to prevent fraud
  • UK GDPR

At a glance

The problem
Every tender is written largely from scratch by people who also have client work to deliver
Typical volume
Around 120 bids a year, each with 20–60 questions, half of them public sector
Who's involved
Bid team, subject matter experts, directors, legal and commercial, HR, marketing, data protection
Pilot
8–10 weeks on live bids in one sector, after a 3–4 week discovery
Platforms
AWS, Azure, or a sovereign or on-prem stack

An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.

The business problem

A typical tender arrives as a bundle of documents on a buyer's portal: a specification, a list of questions with word limits and scoring criteria, mandatory requirements, contract terms and a deadline three or four weeks away. The bid team builds a compliance matrix by hand, then chases engineers, consultants and directors for answers, CVs and case studies, while those same people are busy delivering for existing clients.

Most of what a good answer needs already exists somewhere: in a winning bid from two years ago, a case study, a certificate, a policy or a CV. Finding the right, current version is the hard part. People copy old answers that quote out-of-date figures, name staff who have left, or describe a project the client never agreed could be mentioned.

Getting it wrong is costly. A public buyer can exclude a supplier that provided incomplete, inaccurate or misleading information in a procurement, and every statistic, KPI and social value promise in a winning bid can become a contract commitment. Buyers are also asking whether AI was used to write the bid and how its output was checked, so 'we used AI' needs a better answer than a shrug.

What AI changes

  • The tender pack is read within an hour of download, and a compliance matrix is built: every question, word limit, scoring criterion, mandatory requirement, deadline and any rule the buyer sets on AI use.
  • A first draft of each answer is written from the firm's approved library only, not from general knowledge, and tailored to the buyer's scoring criteria.
  • Every factual claim in a draft links to the evidence behind it: a case study, a certificate, a CV, a policy or a figure from finance. Claims without evidence are highlighted, never smoothed over.
  • Out-of-date certificates, people who have left, and case studies the client hasn't agreed to be named are caught before a person reads the draft.
  • Subject matter experts spend their time improving answers rather than starting from a blank page.
  • The bid manager signs off every answer and the bid director approves the submission. Pricing, commitments and declarations are always written by people.

How success is measured

Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.

Time to first full draft

From tender download to a draft of every question that the team can work from.

ExampleFrom two weeks to three days

Claims with linked evidence

Share of factual claims in the submitted bid that link to a current source in the library.

ExampleEvery one, at submission

Unsupported claims caught

Claims the evidence check flagged before review, and how many reached the bid manager unflagged in a sample audit.

ExampleRising caught, zero missed in the audit

Compliance failures

Missed mandatory requirements, breached word limits, missing attachments or late submissions.

ExampleZero

Expert hours per bid

Time subject matter experts spend on each bid, taken from timesheets.

ExampleDown by a third

Quality score and win rate

Average quality score from buyers' feedback and the win rate, tracked over a year. Many things affect both, so read them as a trend.

ExampleMeasured against last year

UK regulation and controls

Cross-sector rules are on the UK regulation map.

  • Cabinet OfficeProcurement Act 2023 (in force 24 February 2025): exclusion grounds

    A buyer may exclude a supplier that acted improperly in a procurement, which includes providing incomplete, inaccurate or misleading information, or for professional misconduct that brings its integrity into question. Every claim is traced to evidence, and the bid manager signs off each answer, so there is a record of who checked what.

  • Cabinet OfficePPN 017: Improving transparency of AI use in procurement (replaces PPN 02/24 for Act procurements)

    Suppliers' use of AI isn't prohibited, but buyers may ask whether AI was used, for what, and how its output was checked, and may restrict the use of their confidential information to train AI. The platform records which answers were AI-assisted and who checked them, so any such question can be answered accurately. Tender documents are never used for training.

  • Cabinet OfficeNational Procurement Policy Statement and PPN 002: the Social Value Model

    In-scope central government buyers must use the Social Value Model for Act procurements from 1 October 2025, usually with at least 10% of the score. Social value commitments become contract obligations, so the AI drafts from the firm's real programmes and data and never proposes a new commitment. People decide what the firm promises.

  • Cabinet OfficeThe Central Digital Platform (Find a Tender)

    Core supplier information, connected persons and exclusion declarations are held on the platform, and the supplier confirms they are accurate. They come from the firm's official records, owned by the company secretary or legal team, and are never drafted by the AI.

  • Home OfficeFraud Act 2006 and the failure to prevent fraud offence (Economic Crime and Corporate Transparency Act 2023, in force 1 September 2025)

    A knowingly false claim made to win work can be fraud by false representation, and large organisations can now be liable if someone working for them commits fraud intended to benefit them, unless they had reasonable procedures to prevent it. The evidence check and the sign-off log form part of those procedures. In private bids, a false statement that induces a contract can also be a misrepresentation.

  • ICOUK GDPR and the Data Protection Act 2018

    CVs and staff details are personal data. Staff are told how their CVs are used in bids, only bid-relevant details are indexed, CVs are refreshed from the HR system rather than copied, and leavers drop out of the index. Clearance levels and anything sensitive stay out of the library unless a bid needs them.

The solution

Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.

Proposal and bid drafting: reference architecture
  1. 01Channels

    • Buyer portals and Find a Tender
    • Private client RFPs by email
    • Clarification questions and answers
  2. 02Intake

    • API GatewayAPI ManagementKong, or your existing API gatewayTender pack upload
    • Amazon S3Blob StorageCeph, or IONOS S3 Object StoragePer-bid document store
  3. 03Intelligence

    • Amazon TextractContent Understanding (Document Intelligence)Docling plus an open-weight vision modelRead the tender pack
    • Bedrock Knowledge BasesFoundry IQ (Azure AI Search)OpenSearch, or PostgreSQL with pgvectorEvidence library
    • Agent
      Bedrock AgentCoreFoundry Agent ServiceLangGraph on Kubernetes, with open-weight models via vLLMDrafting agent
    • Agent
      Bedrock AgentCoreFoundry Agent ServiceLangGraph on KubernetesEvidence checker
  4. 04Orchestration

    • Step FunctionsLogic Apps / Durable FunctionsTemporal, or n8nBid workflow
    • EventBridge + SQSEvent Grid + Service BusApache Kafka or RabbitMQEvents and queues
  5. 05Systems of record

    • CRM and bid pipeline
    • HR system (CVs and leavers)
    • Document management and policy register
  6. 06People

    • Person
      Answer owners: edit and approve
    • Person
      Bid manager: signs off every answer
    • Person
      Bid director: approves submission
  • Cloud or platform service (AWSAzuresovereign / on-prem)
  • AI agent
  • A person decides
  • Your existing systems
  • Outside your organisation

Components, side by side

Proposal and bid drafting: components on AWS, Azure and a sovereign or on-prem stack
LayerAWSAzureSovereign / on-prem
Intake: tender packs and clarificationsOne store per bid. Buyers' tender documents are often confidential, so they stay with that bid and are deleted on the agreed date.API Gateway, S3API Management, Blob StorageKong or your existing API gateway; Ceph or IONOS S3 Object Storage
Reading the tender packQuestions hide in spreadsheets, annexes and clarification logs. Test on real packs, not one tidy PDF.Amazon TextractAzure Content Understanding (includes Document Intelligence)Open-source parsing (e.g. Docling) plus an open-weight vision model
DraftingBoth clouds offer a choice of models, including Claude. Drafts are written to the buyer's word limits and scoring criteria.Amazon BedrockMicrosoft FoundryOpen-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub
Evidence library (retrieval)Only approved, in-date content: case studies tagged with whether the client can be named, CVs, certificates, policies and agreed figures. Each item has an owner and an expiry date.Bedrock Knowledge BasesFoundry IQ, built on Azure AI SearchOpenSearch, or PostgreSQL with pgvector
Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore.Amazon Bedrock AgentCoreFoundry Agent ServiceAn open-source agent framework (e.g. LangGraph) on Kubernetes
WorkflowTracks every question from draft to sign-off against the deadline.AWS Step FunctionsLogic Apps or Durable FunctionsTemporal, or n8n
Middleware and eventsAmazon EventBridge, SQSEvent Grid, Service BusApache Kafka or RabbitMQ
Link to CRM, HR and document systemsLeavers and certificate expiries arrive as events, so the library is current without anyone remembering to tidy it.API Gateway, plus your existing integration platform if you have oneAPI Management, plus your existing integration platform if you have oneKong or your existing API gateway, plus your existing integration platform if you have one
Human reviewEach answer shows its claims side by side with their evidence.In the bid team's existing document and bid toolsIn the bid team's existing document and bid toolsIn the bid team's existing document and bid tools
GuardrailsBlocks drafts that state a figure, client name or accreditation not found in the library.Bedrock GuardrailsFoundry guardrails (Azure AI Content Safety)Open-source guardrails (e.g. NeMo Guardrails, Llama Guard)
Identity, keys, data protectionBid teams see only the bids they're working on. Pricing stays in a separate, restricted area the AI can't read.IAM Identity Center, KMS, MacieEntra ID, Key Vault, PurviewKeycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM
Monitoring and auditLog every draft, every source used, every edit and every sign-off, kept with the bid record.CloudWatch, CloudTrailAzure Monitor, Log AnalyticsPrometheus, Grafana, OpenTelemetry
UK data residencyIONOS AI Model Hub runs in German data centres: EU, not UK, residency. Some buyers' terms require UK processing of tender documents.eu-west-2 (London)UK South / UK WestYour own UK data centre, or a UK or EU provider

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

Hybrid and on-prem

Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.

Stays on-prem

The CRM, the HR system, the document management system and the pricing models stay where they are. Bids for defence or other sensitive buyers can stay entirely on the firm's own servers and GPUs.

Uses cloud AI

Reading tender packs, the evidence library and drafting can run in a UK cloud region for most bids, under a contract that rules out training and limits retention. A bid can be marked on-prem only when the buyer's terms require it.

How they connect

A private link (AWS Direct Connect or Azure ExpressRoute) and the API layer. CVs and library updates flow out as events; drafts come back into the bid workspace.

If the link drops

The bid team carries on writing in their usual tools from the last drafts and the library they already have. The deadline is managed by the bid manager, not the pipeline, and nothing waits on the AI to be submitted.

The agents

What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.

Drafting agent

May do

  • Read the tender pack and build the compliance matrix
  • Search the approved evidence library
  • Draft answers to the buyer's word limits and scoring criteria
  • Suggest which CVs and case studies fit each question
  • Mark each claim with the evidence it came from

May not do

  • Read pricing, or draft prices, rates or discounts
  • Propose new commitments, KPIs or social value pledges
  • Fill in declarations, exclusion questions or the buyer's AI-use questions
  • Name a client the library doesn't mark as nameable
  • Upload or submit anything to a buyer's portal

Where a person signs offThe answer owner edits and approves each answer, and the bid manager signs it off. The agent's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.

Evidence checker

May do

  • Match every factual claim in a draft to a library source
  • Flag claims with no source, an expired certificate or an out-of-date figure
  • Flag named staff who have left or whose CV is out of date
  • Check word limits, mandatory requirements and missing attachments

May not do

  • Rewrite an answer to make a claim pass
  • Clear its own flags
  • Add or change library content

Where a person signs offEvery flag is cleared by a person, with a reason. The bid director approves the final submission.

Middleware and integration

The evidence library is only as good as the systems that feed it. Leavers come from the HR system, certificate and insurance expiries from the policy register, and project facts from the CRM and finance. Each arrives as an event, and the library item it affects is updated or withdrawn, so the AI can't quote what is no longer true.

Pricing stays separate. Rates, discounts and cost models live in a restricted area with its own access, and the AI has no route to them. Pricing is assembled by the commercial team and joined to the bid at the end.

Submission stays manual. The buyer's portal or the Central Digital Platform is used by a named person, with the share code and declarations handled by the people responsible for them. If the AI is paused, bids are written exactly as they were before.

Process and people

  • A named owner and an expiry date for every item in the evidence library.
  • Written client permission recorded against every case study that names the client.
  • A bid/no-bid decision by people before drafting starts, so the AI never makes bidding cheaper than deciding not to bid.
  • A record of which answers were AI-assisted and who checked them, ready for any buyer question on AI use.
  • A monthly audit of a sample of submitted answers against their evidence.
  • Bid staff and experts trained before go-live, including how to challenge a confident but unsupported draft.

Delivery plan

  1. 3–4 weeks

    Discovery

    Map today's bid process, measure the baseline on recent bids, audit the content library, and agree the evidence rules with legal and the bid director.

  2. Gate · must be true to passBaseline agreed, library owners named, DPIA started, client-naming permissions checked.

  3. 8–10 weeks

    Pilot

    Live bids in one sector, in shadow mode at first: the AI drafts alongside the team, and drafts are compared with what was submitted.

  4. Gate · must be true to passEvery claim in pilot submissions linked to evidence, zero unsupported claims in the audit sample, bid director sign-off.

  5. 4–6 weeks

    Production

    AI drafting becomes the starting point for every bid in that sector, with monitoring, support and a rollback plan.

  6. Gate · must be true to passMonitoring, support, library upkeep and bid team training in place.

  7. Ongoing

    Scale

    Add sectors and bid types one at a time, then reuse the library for proposals, framework call-offs and capability statements.

  8. Gate · must be true to passEach new sector passes the same evidence audit.

Roles and RACI

Who is responsible, accountable, consulted and informed, by activity
ActivityBid directorBid managerSolutions architectI can fill thisTechnical PMI can fill thisEngineersI can fill thisLegal & DPOSecurityI can fill this
Business case and benefitsAccountableResponsibleConsultedConsultedInformedInformedInformed
Evidence rules and library ownershipAccountableResponsibleConsultedInformedInformedConsultedInformed
Target architecture and integrationInformedConsultedAccountable and ResponsibleConsultedConsultedConsultedConsulted
DPIA and procurement compliance reviewConsultedConsultedConsultedInformedInformedAccountable and ResponsibleConsulted
Build and integrationInformedConsultedAccountableResponsibleResponsibleInformedConsulted
Pilot testing on live bidsAccountableResponsibleConsultedResponsibleResponsibleConsultedInformed
Go-live decisionAccountableResponsibleConsultedResponsibleInformedConsultedConsulted
Run, monitor and improveInformedAccountableConsultedConsultedResponsibleConsultedConsulted

Business case and benefits

Bid director
A · Accountable
Bid manager
R · Responsible
Solutions architect
C · Consulted
Technical PM
C · Consulted
Engineers
I · Informed
Legal & DPO
I · Informed
Security
I · Informed

Evidence rules and library ownership

Bid director
A · Accountable
Bid manager
R · Responsible
Solutions architect
C · Consulted
Technical PM
I · Informed
Engineers
I · Informed
Legal & DPO
C · Consulted
Security
I · Informed

Target architecture and integration

Bid director
I · Informed
Bid manager
C · Consulted
Solutions architect
A/R · Accountable and Responsible
Technical PM
C · Consulted
Engineers
C · Consulted
Legal & DPO
C · Consulted
Security
C · Consulted

DPIA and procurement compliance review

Bid director
C · Consulted
Bid manager
C · Consulted
Solutions architect
C · Consulted
Technical PM
I · Informed
Engineers
I · Informed
Legal & DPO
A/R · Accountable and Responsible
Security
C · Consulted

Build and integration

Bid director
I · Informed
Bid manager
C · Consulted
Solutions architect
A · Accountable
Technical PM
R · Responsible
Engineers
R · Responsible
Legal & DPO
I · Informed
Security
C · Consulted

Pilot testing on live bids

Bid director
A · Accountable
Bid manager
R · Responsible
Solutions architect
C · Consulted
Technical PM
R · Responsible
Engineers
R · Responsible
Legal & DPO
C · Consulted
Security
I · Informed

Go-live decision

Bid director
A · Accountable
Bid manager
R · Responsible
Solutions architect
C · Consulted
Technical PM
R · Responsible
Engineers
I · Informed
Legal & DPO
C · Consulted
Security
C · Consulted

Run, monitor and improve

Bid director
I · Informed
Bid manager
A · Accountable
Solutions architect
C · Consulted
Technical PM
C · Consulted
Engineers
R · Responsible
Legal & DPO
C · Consulted
Security
C · Consulted

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

Option A

Lead the architecture

If there's no architect on the programme, I'd own the design end to end: the evidence library and its feeds from HR, CRM and the policy register, the drafting and evidence checks, and the gates. I'd work closely with your bid director and legal team, and report to your programme board.

Option B

Support your architect

If your partner or your own team already has an architect, I'd take on the library, the agents and the integration with your HR and CRM systems under their lead, and give them a second senior opinion on security and the audit trail.

Where this goes wrong

  1. Goes wrong

    The AI writes fluent answers with figures nobody can source.

    How the design avoids it

    Drafts come only from the approved library, every claim links to its evidence, and unsourced claims are flagged, not smoothed over.

  2. Goes wrong

    The library is full of old bids, so drafts quote leavers, lapsed certificates and old numbers.

    How the design avoids it

    An owner and an expiry date on every item, and HR and policy changes fed in as events.

  3. Goes wrong

    A case study names a client who never agreed to it.

    How the design avoids it

    Client permission recorded against each case study, and a guardrail that blocks names the library doesn't allow.

  4. Goes wrong

    Promises in the bid become contract terms nobody planned to deliver.

    How the design avoids it

    The AI never proposes commitments, KPIs or social value pledges. Delivery leads approve every one.

  5. Goes wrong

    The firm can't say how AI was used when the buyer asks.

    How the design avoids it

    A record of AI-assisted answers and who checked them, kept with the bid.

On the horizon

Changes already announced or under way that affect this design. More in the UK horizon scan.

  1. From 1 October 2026
    PPN 022 on steel: central government buyers must state in the contract details notice whether UK-produced steel will be used, for procurements of £10 million or more, or over 500 tonnes of steel.

    Engineering bids will be asked for steel origin data from the supply chain. Add it to the library as evidence with an owner, not a figure written fresh for each bid.

  2. 1 May 2027
    Below-threshold contract notices move from Contracts Finder to Find a Tender, deferred from October 2026 by the Procurement (Amendment) (No. 2) Regulations 2026.

    Point opportunity monitoring and CRM feeds at the Central Digital Platform, so smaller opportunities aren't missed during the switch.

  3. Late 2026–2028
    The Cyber Security and Resilience Bill brings medium and large managed service providers into regulation, with duties set by secondary legislation.

    Firms bidding for managed IT or digital work should expect new security questions in tenders. Build the evidence now, with owners and dates.

  4. 2026–2027
    The ICO's statutory code of practice on AI and automated decision-making, required since May 2026.

    Keep the DPIA and the record of how staff data is used in bids current, so the library can be shown to meet it.

Questions to ask your partner or vendor

Good answers are specific. Vague answers to any of these are worth following up.

Copy them into your next supplier meeting

  1. How does each claim in a draft link to its evidence, and what happens to a claim with none?
  2. How does the library learn that someone has left or a certificate has lapsed?
  3. Can the AI see our pricing, and where is that enforced?
  4. How will we answer a buyer who asks whether and how AI was used in this bid?
  5. Where are buyers' tender documents processed and stored, and is any of it used to train a model?
  6. Who owns the library, the prompts and the test sets after you leave?

Planning something like this?

Whether you need someone to lead the design or to support the architect you already have, let's talk it through.

Sam Naseem
Sam NaseemBirmingham, UK · UK & Europe
Available now