10. Procurement Checklist
An operational scorecard for technology leaders and procurement teams.
KSA decision chapter
Vision, execution, and evidence
11. Strategic Recommendation
Vision 2030 & Sovereignty
Provides a scoring checklist for Saudi procurement officers to evaluate AI vendor bids, ensuring all systems support sovereign execution standards.
Autonomous AI Procurement
Autonomous AI procurement can evaluate more than model capability alone. For high-impact environments, KSA procurement teams can ask for proof that AI systems operate through structured intent, local policy, scoped identity, execution contracts, tamper-evident evidence, replayable audit, and protocol admissibility for generated artifacts.
Procurement is where architecture becomes enforceable. Alongside "How capable is the model?", KSA procurement teams can ask, "How governable is its execution path?" The checklist applies to autonomous AI platforms, agent frameworks, AI cloud services, government workflow tools, smart-city automation, regulated-sector AI, and AI-generated software pipelines.
Recommended Minimum Requirements
Minimum Requirements for Autonomous AI Procurement
-
Can your system submit structured intents instead of directly executing actions? High-impact AI systems can expose a governable intent boundary rather than requiring direct shell, API, or database write access.
-
Can execution be blocked by local policy? Procurement teams can require enforcement of national, sectoral, organizational, and workflow-specific policies before execution.
-
Can sensitive context be minimized before model reasoning? The system can support data minimization, redaction, anonymization, and policy-filtered task context.
-
Can actions be bound to short-lived credentials? Autonomous agents do not need permanent administrative privilege.
-
Can high-risk actions require human approval? Citizen-impacting, infrastructure-impacting, physical-world, or regulated actions can support escalation.
-
Can every action produce tamper-evident evidence? Evidence can bind intent, context, policy, approval, contract, identity, execution, and result.
-
Can auditors replay the decision path? Operators and auditors can reconstruct why an action was allowed and what happened.
-
Can the system operate across domestic and foreign models? Execution governance can be model-agnostic and vendor-agnostic.
-
Can generated code, workflows, and IaC be checked against invariants? AI-generated artifacts can pass structural, behavioral, and operational admissibility checks before deployment.
-
Can the platform operate inside Saudi data, cloud, and compliance boundaries? Deployment can respect local infrastructure, data, policy, and operational requirements.
-
Can all mutative actions be routed through a verified control-plane pathway? High-impact changes can be routed through the execution-governance layer.
-
Can the institution independently verify execution evidence? Evidence can support institutional audit, regulator review, incident response, and dispute handling.
Procurement Scoring Model
The scorecard below converts the checklist into evaluation categories that procurement teams, platform leaders, and architecture review boards can use during RFPs, pilots, and vendor reviews.
| Capability Area | What to look for | Red Flag |
|---|---|---|
| Intent governance | Structured intent schemas and no required direct write access. | Vendor requires broad API, shell, or database permissions. |
| Policy control | Local policy evaluation before execution. | Policy is hardcoded, vendor-controlled, or post-hoc only. |
| Context minimization | Redaction, anonymization, minimized task context. | Vendor requires raw sensitive context for routine reasoning. |
| Identity & privilege | Short-lived, task-scoped credentials. | Persistent administrative service accounts for agents. |
| Execution contracts | Machine-enforceable bounds on approved actions. | Approval grants broad runtime authority. |
| Evidence & replay | Tamper-evident evidence and replayable decision path. | Logs only, no intent/policy/contract linkage. |
| Generated software | Invariant checks for code, workflow, IaC, and configuration. | Generated artifacts deploy after shallow tests only. |
| Vendor/model agnosticism | Works with domestic, hyperscaler, open-source, and domain models. | Governance only works inside one vendor's model stack. |
How Procurement Teams Can Use This Checklist
Embed this checklist in RFPs, vendor evaluations, pilot exit criteria, architecture reviews, and compliance reviews. Ask vendors to demonstrate the full path from model proposal to governed execution, including sample evidence records and human escalation for high-impact workflows. Score execution governance alongside model accuracy, user experience, and benchmark performance.
“Do not procure autonomous execution without evidence.”
Conclusion
This checklist turns the white paper's architecture into procurement action. The final chapter summarizes the strategic recommendation: treating sovereign execution as a national AI infrastructure layer and building an open ecosystem around governed autonomous AI.