Procurement Process for GenAI

How do I procure GenAI?

There are some ways in which a GenAI procurement differs from a standard procurement. This section explains those differences, including the guided workflow that state entities must take to procure goods and services that include GenAI. It includes materials to help shape the GenAI solicitation, including standardized disclosure language, bidder documentation requirements, and special provisions for GenAI solicitations. It also specifies department responsibilities for moderate/high risk GenAI use cases, and the California Department of Technology’s role.

Introduction

As with any procurement, GenAI procurement starts with pre-procurement activities, moves through an acquisition phase that culminates in awarding a contract, and then enters a post-award phase of reporting and contract management.

The process differs for new GenAI contracts and existing contracts with GenAI included as part of the contract work.

There are some ways in which a GenAI procurement differs from a standard procurement. The rest of this section includes detailed information about the additional requirements for a GenAI procurement. A high-level overview is below:

• California Department of Technology (CDT) Consultation: Once GenAI is identified in the procurement process, the state entity’s Chief Information Office and/or Agency Information Officer (CIO/AIO) may be required to consult with CDT.
  • Based on the state entity’s risk assessment covered in the GenAI Risk Assessment and Management module, if the procurement is determined to be a moderate or high risk, consultation with CDT is required. State entities may consult with CDT for low risk GenAI purchases.
  • Submit a Case via the New Technology Consultation and Assessment request, in the CDT IT Service Portal for all risk levels.
    • When the request has been processed, a CDT Customer Engagement Services (CES) Account Lead will be in contact with instructions to provide:
      • Required Generative Artificial Intelligence Risk Assessment (SIMM 5305-F)
      • Required Generative Artificial Intelligence (GenAI) Reporting and Factsheet (STD 1000), once received from the Bidder / Offeror / Contractor Information
        • IT procurements, submit both Yes and No answers.
        • Telecommunications procurements, submit both Yes and No answers.
        • Non-IT procurements, submit only Yes answers.
      • If completed, Privacy Threshold Assessment and Privacy Impact Assessments (SIMM 5310-C).
  • For questions email CDTGenAIIntakeRequest@state.ca.gov.
• Solicitation language:

  • All written solicitations must include GenAI disclosure language and a requirement for Bidder / Offeror / Contractor to disclose the use of GenAI in any responses to state entities.

    Additionally, special provision language may be included in the solicitation for “Intentional” GenAI purchases determined to be moderate/high risk from the onset of a procurement, if required by CDT.

• Contract language:

  • All written contracts must include GenAI reporting language and a requirement for Contractors to report the use of GenAI.

    • Moderate/high risk GenAI purchases regardless of acquisition type, dollar value, or method must include

    GenAI Special Provisions as identified through CIO/AIO consultation with CDT.

• Evaluation and selection of vendors: Bidder / Offeror / Contractor must submit completed GenAI Reporting and Factsheet (STD 1000) for all procurements. See Purchases Exempt from GenAI Procurement Procedures for a list of limited exceptions.
• Contract Management of GenAI technology: All GenAI contracts require a contract manager to continuously oversee and evaluate the GenAI technology through contract administration for risk considerations. Moderate/high risk GenAI cases that received a CDT consultation may require additional evaluation and monitoring per CDT requirements.
• Reporting: Each state entity is required to report all GenAI purchases into FI$Cal as specified in the State Contracting Manual. See Reporting section for more details.

The State Contracting Manual (SCM) is the primary source of guidance for state contracting and procurement. Existing contracting laws, policy, and procedures still apply to purchases that include GenAI. When a state department is considering purchasing GenAI (both intentional and incidental purchases), additional steps must be included in the procurement process to properly assess and mitigate the risk associated with the GenAI tool or service. This applies to IT, non-IT (e.g., consultants using GenAI), or telecom purchases.

It is important to understand that GenAI may be introduced at different phases of the acquisition process. Below are scenarios indicating when GenAI may be identified:

Regardless of where GenAI is identified in the procurement process, risk will need to be assessed. The level of risk associated with the purchase will determine a state entity’s path forward. CDT reserves the right to audit and consult on "Low" GenAI Risk Levels with potential higher risk concerns.

See the Procurement Process Flows section for a more detailed overview.

Procurement Process Flows

Procurement process flow for new contracts where GenAI technology functions or services are identified by the GenAI Reporting and Factsheet (STD 1000):

*GenAl Special Provisions only required for moderate and high risk GenAl purchases.

**Resubmission to CDT for changes to the terms, scope, or complexity of GenAl technology functions or services that were not evaluated or considered in the initial consultation.

Procurement process flow for new contracts where GenAI technology functions or services are identified by the GenAI Reporting and Factsheet (STD 1000):

*Applicable to moderate and high risk GenAl transactions.