Ask where policy is made and you will point to parliament, the cabinet room, perhaps a party manifesto. You probably would not point to a procurement office. Yet the people who write tender documents decide, often years in advance, how a citizen will be identified, which data the state will own, which firms will be locked in and how easily any of it can be changed. They make policy. They just don’t call it that.
How much is at stake
Across the OECD, public procurement came to 12.7 percent of GDP in 2023, and 14.8 percent in the OECD countries that are also EU members. Measured against what governments spend, it is 29.9 percent of total government expenditure, which means close to 30 cents of every public dollar leaves the state through a contract. The World Bank put global public procurement at about $11 trillion in 2018, out of a world economy of nearly $90 trillion. That is roughly one dollar in every eight the planet produces.
The spread between countries is wider than most people assume. In the same World Bank estimates, Botswana procured 28 percent of its GDP, while Sri Lanka procured 6 percent, a gap of almost five to one. Those are very different states with very different problems. They share one question, though: does anyone in government treat the contract as the instrument of policy that it is?
What a contract decides
Consider HealthCare.gov, the website at the centre of the Affordable Care Act. It opened on 1 October 2013 for a programme expected to be measured in millions of sign-ups. On the first day, six people managed to enroll from start to finish.
The Government Accountability Office’s review in July 2014 did not mainly blame programmers. It found that task orders were issued before key requirements, such as the number of states and potential enrollees, were known. It found that the agency never developed the acquisition strategy that would have identified risks. It found that the agency used cost-reimbursement contracts, under which the government pays allowable costs whether or not the system is finished, and that it launched the site without verifying that it met performance requirements. Obligations for the federal marketplace system rose from $56 million in September 2011 to more than $209 million by February 2014, nearly four times the starting figure.
Every one of those was a procurement choice. Together they amounted to a policy: build fast, specify later, and leave the risk on the public balance sheet.
Did anyone vote for that policy? Nobody had to. It was written into contract structures that sat well below the level of political debate.
Who owns the rails
India is often held up as proof that a state can build technology well. Look closely at how it bought. When UIDAI contracted the biometric de-duplication system for Aadhaar in 2010, it did not hand the job to a single supplier. Three biometric solution providers worked in parallel, and transactions were divided among them according to each system’s performance, an approach UIDAI said was being tried for the first time in identity resolution systems anywhere. Competition was written into the architecture as well as the tender.
UPI went further. It is run by the National Payments Corporation of India, a not-for-profit company set up by the Reserve Bank of India and the Indian Banks’ Association. A not-for-profit sets the rules of the network, and banks and apps compete on top of it. In September 2026, UPI processed 24.07 billion transactions, around 802 million a day. Annual volumes grew from about 2 crore (20 million) in 2016-17 to more than 24,000 crore (240 billion) in 2025-26, roughly twelve thousand times over, and the number of participating banks went from 44 to 703. UPI now operates in several other countries, Sri Lanka among them.
Estonia made the same bet with X-Road, its data exchange layer. The software is released under the MIT open-source licence, and its development is managed by the Nordic Institute for Interoperability Solutions, a non-profit created by the governments of Estonia, Finland and Iceland. More than 20 countries have adapted it to their own needs.
What do these have in common? The state bought, or built, the rails and kept them. It did not rent them.
Where the rules stand
Slowly. On 3 April 2025 the US Office of Management and Budget issued memorandum M-25-22, which tells federal agencies to buy AI under contracts that protect against vendor lock-in through knowledge transfer and data and model portability, and that bar vendors from using government data to train or develop AI systems without the agency’s explicit consent. In March 2025 the EU’s Community of Practice on Public Procurement of AI published updated model contractual clauses, one version for high-risk systems and a lighter one for everything else. They are non-binding.
Europe’s AI Act, meanwhile, gives providers and deployers of high-risk AI systems used by public authorities until 2 August 2030 to comply. The Digital Omnibus, in force since 27 July 2026, has moved the main deadline for stand-alone high-risk systems from August 2026 to 2 December 2027.
Read those dates as a buyer would. The contracts you sign this year will run for five, seven, perhaps ten years. Many of them will be negotiated and in operation before the strongest rules apply. If the protections are not in the contract, where exactly will they come from?
What buying well looks like
It starts by admitting that a procurement office is a policy office. India’s Government e-Marketplace recorded about ₹5 lakh crore in purchases in 2025-26, and micro and small enterprises won 68 percent of the orders but only 47.1 percent of the value. That gap is not an accident of software. It reflects choices about lot sizes, eligibility and evaluation, which is to say choices about who gets to grow on public money.
Technology is no different. You specify outcomes before you specify tools. You keep the data, the interfaces and the right to switch. You pay for performance you can test, not for effort you cannot see. You find out what a system cannot do before you sign for what it can. And you put someone at the table whose only interest is yours.
That last point is why our Tech Advisory practice works only for the buyer and has no software to sell. A government sitting across from a vendor’s bid team deserves at least one adviser who is not hoping for the follow-on contract.
The tender is the policy. Write it like one.
