Business case and benefits
- Bid director
- A · Accountable
- Bid manager
- R · Responsible
- Solutions architect
- C · Consulted
- Technical PM
- C · Consulted
- Engineers
- I · Informed
- Legal & DPO
- I · Informed
- Security
- I · Informed
First drafts of every answer in days, not weeks, each claim linked to the evidence behind it. The bid manager checks, decides and signs off what is submitted.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
A typical tender arrives as a bundle of documents on a buyer's portal: a specification, a list of questions with word limits and scoring criteria, mandatory requirements, contract terms and a deadline three or four weeks away. The bid team builds a compliance matrix by hand, then chases engineers, consultants and directors for answers, CVs and case studies, while those same people are busy delivering for existing clients.
Most of what a good answer needs already exists somewhere: in a winning bid from two years ago, a case study, a certificate, a policy or a CV. Finding the right, current version is the hard part. People copy old answers that quote out-of-date figures, name staff who have left, or describe a project the client never agreed could be mentioned.
Getting it wrong is costly. A public buyer can exclude a supplier that provided incomplete, inaccurate or misleading information in a procurement, and every statistic, KPI and social value promise in a winning bid can become a contract commitment. Buyers are also asking whether AI was used to write the bid and how its output was checked, so 'we used AI' needs a better answer than a shrug.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
From tender download to a draft of every question that the team can work from.
ExampleFrom two weeks to three days
Share of factual claims in the submitted bid that link to a current source in the library.
ExampleEvery one, at submission
Claims the evidence check flagged before review, and how many reached the bid manager unflagged in a sample audit.
ExampleRising caught, zero missed in the audit
Missed mandatory requirements, breached word limits, missing attachments or late submissions.
ExampleZero
Time subject matter experts spend on each bid, taken from timesheets.
ExampleDown by a third
Average quality score from buyers' feedback and the win rate, tracked over a year. Many things affect both, so read them as a trend.
ExampleMeasured against last year
Cross-sector rules are on the UK regulation map.
A buyer may exclude a supplier that acted improperly in a procurement, which includes providing incomplete, inaccurate or misleading information, or for professional misconduct that brings its integrity into question. Every claim is traced to evidence, and the bid manager signs off each answer, so there is a record of who checked what.
Suppliers' use of AI isn't prohibited, but buyers may ask whether AI was used, for what, and how its output was checked, and may restrict the use of their confidential information to train AI. The platform records which answers were AI-assisted and who checked them, so any such question can be answered accurately. Tender documents are never used for training.
In-scope central government buyers must use the Social Value Model for Act procurements from 1 October 2025, usually with at least 10% of the score. Social value commitments become contract obligations, so the AI drafts from the firm's real programmes and data and never proposes a new commitment. People decide what the firm promises.
Core supplier information, connected persons and exclusion declarations are held on the platform, and the supplier confirms they are accurate. They come from the firm's official records, owned by the company secretary or legal team, and are never drafted by the AI.
A knowingly false claim made to win work can be fraud by false representation, and large organisations can now be liable if someone working for them commits fraud intended to benefit them, unless they had reasonable procedures to prevent it. The evidence check and the sign-off log form part of those procedures. In private bids, a false statement that induces a contract can also be a misrepresentation.
CVs and staff details are personal data. Staff are told how their CVs are used in bids, only bid-relevant details are indexed, CVs are refreshed from the HR system rather than copied, and leavers drop out of the index. Clearance levels and anything sensitive stay out of the library unless a bid needs them.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Intake: tender packs and clarificationsOne store per bid. Buyers' tender documents are often confidential, so they stay with that bid and are deleted on the agreed date. | API Gateway, S3 | API Management, Blob Storage | Kong or your existing API gateway; Ceph or IONOS S3 Object Storage |
| Reading the tender packQuestions hide in spreadsheets, annexes and clarification logs. Test on real packs, not one tidy PDF. | Amazon Textract | Azure Content Understanding (includes Document Intelligence) | Open-source parsing (e.g. Docling) plus an open-weight vision model |
| DraftingBoth clouds offer a choice of models, including Claude. Drafts are written to the buyer's word limits and scoring criteria. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| Evidence library (retrieval)Only approved, in-date content: case studies tagged with whether the client can be named, CVs, certificates, policies and agreed figures. Each item has an owner and an expiry date. | Bedrock Knowledge Bases | Foundry IQ, built on Azure AI Search | OpenSearch, or PostgreSQL with pgvector |
| Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| WorkflowTracks every question from draft to sign-off against the deadline. | AWS Step Functions | Logic Apps or Durable Functions | Temporal, or n8n |
| Middleware and events | Amazon EventBridge, SQS | Event Grid, Service Bus | Apache Kafka or RabbitMQ |
| Link to CRM, HR and document systemsLeavers and certificate expiries arrive as events, so the library is current without anyone remembering to tidy it. | API Gateway, plus your existing integration platform if you have one | API Management, plus your existing integration platform if you have one | Kong or your existing API gateway, plus your existing integration platform if you have one |
| Human reviewEach answer shows its claims side by side with their evidence. | In the bid team's existing document and bid tools | In the bid team's existing document and bid tools | In the bid team's existing document and bid tools |
| GuardrailsBlocks drafts that state a figure, client name or accreditation not found in the library. | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Identity, keys, data protectionBid teams see only the bids they're working on. Pricing stays in a separate, restricted area the AI can't read. | IAM Identity Center, KMS, Macie | Entra ID, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog every draft, every source used, every edit and every sign-off, kept with the bid record. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyIONOS AI Model Hub runs in German data centres: EU, not UK, residency. Some buyers' terms require UK processing of tender documents. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
The CRM, the HR system, the document management system and the pricing models stay where they are. Bids for defence or other sensitive buyers can stay entirely on the firm's own servers and GPUs.
Uses cloud AI
Reading tender packs, the evidence library and drafting can run in a UK cloud region for most bids, under a contract that rules out training and limits retention. A bid can be marked on-prem only when the buyer's terms require it.
How they connect
A private link (AWS Direct Connect or Azure ExpressRoute) and the API layer. CVs and library updates flow out as events; drafts come back into the bid workspace.
If the link drops
The bid team carries on writing in their usual tools from the last drafts and the library they already have. The deadline is managed by the bid manager, not the pipeline, and nothing waits on the AI to be submitted.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Drafting agent
Where a person signs offThe answer owner edits and approves each answer, and the bid manager signs it off. The agent's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
Evidence checker
Where a person signs offEvery flag is cleared by a person, with a reason. The bid director approves the final submission.
The evidence library is only as good as the systems that feed it. Leavers come from the HR system, certificate and insurance expiries from the policy register, and project facts from the CRM and finance. Each arrives as an event, and the library item it affects is updated or withdrawn, so the AI can't quote what is no longer true.
Pricing stays separate. Rates, discounts and cost models live in a restricted area with its own access, and the AI has no route to them. Pricing is assembled by the commercial team and joined to the bid at the end.
Submission stays manual. The buyer's portal or the Central Digital Platform is used by a named person, with the share code and declarations handled by the people responsible for them. If the AI is paused, bids are written exactly as they were before.
Map today's bid process, measure the baseline on recent bids, audit the content library, and agree the evidence rules with legal and the bid director.
Gate · must be true to passBaseline agreed, library owners named, DPIA started, client-naming permissions checked.
Live bids in one sector, in shadow mode at first: the AI drafts alongside the team, and drafts are compared with what was submitted.
Gate · must be true to passEvery claim in pilot submissions linked to evidence, zero unsupported claims in the audit sample, bid director sign-off.
AI drafting becomes the starting point for every bid in that sector, with monitoring, support and a rollback plan.
Gate · must be true to passMonitoring, support, library upkeep and bid team training in place.
Add sectors and bid types one at a time, then reuse the library for proposals, framework call-offs and capability statements.
Gate · must be true to passEach new sector passes the same evidence audit.
| Activity | Bid director | Bid manager | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | Legal & DPO | SecurityI can fill this |
|---|---|---|---|---|---|---|---|
| Business case and benefits | Accountable | Responsible | Consulted | Consulted | Informed | Informed | Informed |
| Evidence rules and library ownership | Accountable | Responsible | Consulted | Informed | Informed | Consulted | Informed |
| Target architecture and integration | Informed | Consulted | Accountable and Responsible | Consulted | Consulted | Consulted | Consulted |
| DPIA and procurement compliance review | Consulted | Consulted | Consulted | Informed | Informed | Accountable and Responsible | Consulted |
| Build and integration | Informed | Consulted | Accountable | Responsible | Responsible | Informed | Consulted |
| Pilot testing on live bids | Accountable | Responsible | Consulted | Responsible | Responsible | Consulted | Informed |
| Go-live decision | Accountable | Responsible | Consulted | Responsible | Informed | Consulted | Consulted |
| Run, monitor and improve | Informed | Accountable | Consulted | Consulted | Responsible | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the evidence library and its feeds from HR, CRM and the policy register, the drafting and evidence checks, and the gates. I'd work closely with your bid director and legal team, and report to your programme board.
Option B
If your partner or your own team already has an architect, I'd take on the library, the agents and the integration with your HR and CRM systems under their lead, and give them a second senior opinion on security and the audit trail.
Goes wrong
The AI writes fluent answers with figures nobody can source.
How the design avoids it
Drafts come only from the approved library, every claim links to its evidence, and unsourced claims are flagged, not smoothed over.
Goes wrong
The library is full of old bids, so drafts quote leavers, lapsed certificates and old numbers.
How the design avoids it
An owner and an expiry date on every item, and HR and policy changes fed in as events.
Goes wrong
A case study names a client who never agreed to it.
How the design avoids it
Client permission recorded against each case study, and a guardrail that blocks names the library doesn't allow.
Goes wrong
Promises in the bid become contract terms nobody planned to deliver.
How the design avoids it
The AI never proposes commitments, KPIs or social value pledges. Delivery leads approve every one.
Goes wrong
The firm can't say how AI was used when the buyer asks.
How the design avoids it
A record of AI-assisted answers and who checked them, kept with the bid.
Changes already announced or under way that affect this design. More in the UK horizon scan.
Engineering bids will be asked for steel origin data from the supply chain. Add it to the library as evidence with an owner, not a figure written fresh for each bid.
Point opportunity monitoring and CRM feeds at the Central Digital Platform, so smaller opportunities aren't missed during the switch.
Firms bidding for managed IT or digital work should expect new security questions in tenders. Build the evidence now, with owners and dates.
Keep the DPIA and the record of how staff data is used in bids current, so the library can be shown to meet it.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.