Skip to content

GoAI 101 · Module 7

Government AI Procurement and Requirements Specification

How do you avoid writing "the AI is smart" into a requirements document and then not knowing how to accept it?

Start Section 1
0 / 5 completed
Sync my progressJoin a session to keep progress across devices and share it with your instructor

Info

After you join, your completed lesson numbers are sent to your instructor together with your learner code, so they can see your progress. Use the codes your instructor gave you, and do not enter your name, company secrets or other personal data. Progress is kept with the rest of that session's data.

Learning objectives

  • Translate an AI use case into functional, workflow, data, knowledge, model, tool, permission, security, logging, performance, and operational requirement categories.
  • Understand conceptual considerations such as cloud vs. on-prem models, third-party AI services, and vendor lock-in.
  • Distinguish ownership questions for Prompt, Knowledge Base, and data.
  • Write a verification method and acceptance criterion for each requirement, and understand the relationship between deliverables and acceptance evidence.

Specify: functional and workflow requirements

10 min

Turning a use case into something you can accept (1): function and workflow

Translating an AI use case into a procurement requirement means breaking "what this system should do" into concrete categories, each of which must be verifiable, not just an adjective like "deploy a smart AI system" that can never actually be accepted.

  • Functional requirements: what concrete tasks the system must complete, mapping to Module 1's use case.
  • Workflow requirements: how step order, routing, and human gates operate, mapping to Module 2's workflow canvas.
  • Data and knowledge requirements: what data sources are needed, how the knowledge base is built and updated, mapping to Module 3's context & data canvas.
Check yourself

A procurement document says: "The system shall have smart AI capabilities to improve administrative efficiency." Which judgment is most correct?

A procurement document says: "The system shall have smart AI capabilities to improve administrative efficiency." Which judgment is most correct?

Key takeaway: Functional and workflow requirements directly carry forward the output of Modules 1-2: break the use case card and workflow canvas into acceptable line items, rather than reinventing a set of adjectives.

Model, permission, and operations requirements

12 min

Turning a use case into something you can accept (2): model, permission, operations

  • Model and tool requirements: which model is used, which systems it must connect to, mapping to Module 4's tool & permission matrix.
  • Permission and security requirements: Read/Write scope, access control, security requirements, mapping to the governance design from Modules 4-5.
  • Logging and performance requirements: log retention, response time, reliability metrics, mapping to Module 6's test and evaluation results.
  • Operations and versioning requirements: who operates it, how model/system updates are handled, portability considerations, which affect whether the system stays acceptable over the long run.
  • Maintainability: whether the system can be diagnosed and fixed in time when something goes wrong, rather than requiring a full rebuild.

Info

These five categories together map exactly onto what Modules 1-6 already produced; writing a procurement requirements document is really organizing the first six modules' design into acceptable clauses, not imagining things from scratch.
Check yourself

A requirements document only says "the system shall have a good operations mechanism," with no further detail. Which addition would best make this requirement acceptable?

A requirements document only says "the system shall have a good operations mechanism," with no further detail. Which addition would best make this requirement acceptable?

Key takeaway: The five categories, model, permission, logging, performance, and operations, turn the governance and test design from Modules 4-6 into concrete clauses a procurement document can check.

Conceptual-level considerations

12 min

Conceptual considerations: cloud, third parties, and ownership

Conceptual-level considerations (teaching only, not a procurement clause template)
ItemKey consideration
Cloud model vs. on-prem modelWhether data may leave the agency, latency, and cost
Third-party AI serviceContract terms, scope of data use, service-interruption risk
Vendor lock-in and model substitutionWhether the vendor or model can be swapped in future without being locked in
Prompt / Knowledge Base / data ownershipWhether the agency retains the right to use and export these assets
API / system integrationHow the new system interfaces with existing systems, and whether the integration boundary is clear (maps to Module 4)

Info

Actual procurement clauses, security requirements, and contract terms should follow the agency's applicable laws, policies, procurement documents, and procedures. This course teaches the requirement-translation method, not legal advice or a formal contract template.
Check yourself

A procurement uses a third-party AI service, but the contract says nothing about whether the agency can export the knowledge base content it built. What kind of risk is this mainly?

A procurement uses a third-party AI service, but the contract says nothing about whether the agency can export the knowledge base content it built. What kind of risk is this mainly?

Key takeaway: Conceptual-level considerations are not legal advice, they are a reminder to ask before signing: where does the data live, who can get it back, and what happens if the vendor changes.

Deliverables and acceptance evidence

12 min

Deliverables and acceptance evidence

If a requirement cannot be matched to a Deliverable and Acceptance Evidence, it usually means the requirement is not concrete enough yet. A deliverable is "what the vendor must hand over"; acceptance evidence is "what the agency uses to confirm the deliverable actually meets the requirement."

  • Deliverable examples: system source code or license, an operations manual, test reports, knowledge-base build documentation, permission-configuration documentation.
  • Acceptance evidence examples: test-case results from Module 6, log samples, permission-configuration screenshots or files, a regression-test report.
  • Every requirement should be able to answer: what is the verification method, who performs it, and what counts as passing.
Check yourself

A requirement says "the system's response time shall be reasonable," with no deliverable or acceptance evidence defined. Which revision best fixes this?

A requirement says "the system's response time shall be reasonable," with no deliverable or acceptance evidence defined. Which revision best fixes this?

Key takeaway: Every requirement must be able to answer both "what is delivered" and "how is it proven," missing either one means the requirement is not ready for acceptance.

Practice and application

14 min

Practice: From Use Case to Procurement Requirement

Activity 7 translates one workflow requirement from Module 2 into a concrete procurement requirement, filling in the Government AI Procurement Requirements Sheet, preparing the requirement basis Module 8's acceptance decision needs.

  1. Pick a workflow requirement
    Reuse the workflow design from Module 2.
  2. Write it as a concrete requirement
    Avoid unverifiable adjectives like "smart" or "intelligent."
  3. Define a verification method
    How will you confirm this requirement is met?
  4. Define the acceptance criterion and required evidence
    What condition counts as passing? What evidence is required?
  • Government AI Procurement Requirements Sheet minimum schema: Requirement ID, Category, Requirement, Rationale, Priority, Risk, Verification Method, Acceptance Criterion, Required Evidence, Owner, Supplier Responsibility, Agency Responsibility, Change / Version Rule.
Check yourself

Why does the Procurement Requirements Sheet split "Supplier Responsibility" and "Agency Responsibility" into two separate columns?

Why does the Procurement Requirements Sheet split "Supplier Responsibility" and "Agency Responsibility" into two separate columns?

Key takeaway: This Requirements Sheet turns every judgment from Modules 1-6 into something Module 8's acceptance can check item by item; if you can't write a verifiable requirement, you can't write an acceptable system.

What next?