Artificial Intelligence in Public Procurement and Contract Processes: Internal Workflow and Control Points

Summary

For firms that work on public contracts, artificial intelligence is a useful aid for reading tender documents quickly, preparing checklists, extracting tables and producing internal training material. In the tender and contract process, however, an action with consequences is more than producing text: documents, time limits, EKAP declarations, guarantees and correspondence are all linked. The benefit of AI for a firm therefore depends on setting out in advance where it will be used, what data it will be given, who will check its output and who will take the decision.

This article deals with AI in the tender unit's workflow and its control points. The legal risks of acting on AI output are a separate subject and are outside the scope of this article.

1. Artificial intelligence and generative AI

Under the current definition adopted by the OECD, an AI system is a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions. Generative AI refers to systems that can produce text, tables, summaries and drafts from instructions given in natural language.

From a workflow point of view, the decisive point is this: AI produces text, summarises documents and offers direction, but it does not take responsibility for the action. Its output does not replace an expert report, a signed opinion or a decision by an authorised person in the firm. If this distinction is not written into the workflow, AI stops being an aid and becomes the source of decisions that nobody has approved.

2. Tasks AI can help with

• Summarising documents: summarising lengthy notices, administrative and technical specifications and draft contracts under headings.
• Building tables: separating technical specification items and the provisions on delivery periods, warranties, penalties, price adjustment and inspection and acceptance into separate lists.
• A first checklist: listing the qualification documents in the administrative specification, the economic and financial criteria and the work experience requirements.
• Question lists: a first draft of questions for a pre-bid meeting, such as "Does the technical specification point to a particular brand?", "Is the delivery period in line with market conditions?", "Does the subject of the work experience certificate match the subject of the tender?" or "Will price adjustment apply?".
• Internal briefings: short notes and training material that help the bid team, accounting, the technical team and management use a common checking language.

Each of these outputs is a starting draft. It should not be used until it has been checked against the current legislation, the specific tender documents and by the person responsible for the subject.

3. A suggested workflow

Step	Role of AI	Human check	Record
1. Obtaining the documents	None	The tender unit downloads the latest version of the documents and any addenda from EKAP	List of documents, download date
2. Separating data	None	Data that may and may not be uploaded to the system are separated (see section 4)	List of uploaded files
3. Summaries and tables	Summary, table of provisions, first checklist	The tender unit links each item to its place in the documents (clause number, page)	Summary linked to sources
4. Specialist review	Draft question list	Technical points in the technical office, cost points in finance; points requiring legal assessment in the legal department or with a lawyer	Reviewer and date
5. Decision	None	The decision to bid is taken by an authorised person	Decision note and reasons
6. EKAP transactions	Checklist only	The e-signature holder checks the declaration and documents on their own screen and submits them	Date of transaction, authorised person
7. Archiving	Organising the file summary	The unit keeps the file and the review records	Institutional memory record

The workflow has two rules. First, no information produced by AI is used until it has been traced back to its source in the documents or the legislation; information whose source cannot be found is deleted. Second, actions with consequences (EKAP declarations, bid submission, explanations, applications, contract correspondence) are not left to AI; they are carried out by an authorised person.

4. Data security and trade secrets

A common mistake is to upload the bid schedule, price analyses, supplier quotes, staff lists, payroll data, social security and tax documents, work experience certificates, draft contracts and correspondence with the contracting authority to public AI services together with the tender documents.

The Turkish Personal Data Protection Authority's Guide on Generative AI and the Protection of Personal Data, published in November 2025, states that personal data processing carried out through these systems must be assessed under Law No. 6698 and stresses the importance of human verification of outputs. Price analyses, supply chains, discount rates, labour costs, technical solutions, work schedules and subcontractor information may also be trade secrets; uncontrolled sharing may expose the bid strategy.

Suggested internal rules:

• Only publicly available documents (notice, specifications, draft contract) are uploaded to public services.
• Documents containing bid prices, cost analyses, supplier quotes or personal data are used only in corporate accounts whose data processing terms are known and approved by the firm, and are anonymised where necessary.
• A written list states which tool may be used with which data, and it is updated together with the IT department.

5. Chain of responsibility and records

When action is taken on the basis of an AI answer, the chain of responsibility within the firm can become unclear: which document was uploaded, what data the system used, who checked the answer, who took the decision and who signed the final document? These questions are often not recorded.

The AI Risk Management Framework of the US National Institute of Standards and Technology (NIST) provides a structure for organisations to identify and manage AI risks. For a tender unit, the equivalent is simple: for every file, record at which step AI was used, who checked the output on which date and who took the decision. "That is what the AI said" does not protect the firm against exclusion from a tender or the loss of a guarantee.

6. Correspondence and document control

In tender and contract processes, a claim has to be made within the time limit and with the right documents. Requests for time extensions, delays caused by the contracting authority, force majeure, unpaid progress payments, price adjustment claims, inspection and acceptance problems and termination proceedings all depend on written documents. AI can prepare a draft letter, but it cannot keep track by itself of which site record needs to be made, which letter must be sent on which date, or how a registered e-mail (KEP), EKAP or hand-delivered notice should be documented. This should be followed through a deadline and correspondence schedule with a named person responsible in the workflow.

7. Points that should not be left to AI

On the following matters AI can at most prepare a checklist; the assessment is made by people:

• applying the current legislation and its amendments,
• calculating time limits and determining the remedy,
• citing decisions of the Public Procurement Board and the courts (every decision number should be verified separately against the official source),
• explaining an abnormally low tender and its supporting documents,
• assessing qualification documents and work experience,
• interpreting contract provisions and the risks of forfeiture of guarantees and debarment.

The legal assessment of these matters is a legal service provided by a lawyer.

Conclusion

AI is not a tool to be excluded from tender and contract processes; used in the right place, it brings speed, order and early awareness. For the benefit to last, three things should be written into the workflow: which data may be entered into the system, who checks each output by tracing it to its source, and who carries out actions with consequences. With this in place, AI does not replace the tender unit; it increases the time the unit can devote to the documents and the timetable.

Sources

• OECD, AI Principles — definition of an AI system
• Personal Data Protection Authority (KVKK), Guide on Generative AI and the Protection of Personal Data (in 15 Questions), November 2025 (kvkk.gov.tr, in Turkish)
• NIST, AI Risk Management Framework
• Public Procurement Authority, announcement on the entry into force of the Implementing Regulation on Conducting Public Procurement Electronically (in Turkish)
• Legal risk review of this subject: Kılıç Hukuk, "Legal Risks of the Use of Artificial Intelligence by Firms in Public Procurement and Contracts", first published 22 June 2026

This article was prepared on 14 October 2026 from the workflow sections of the article "Benefits and Drawbacks of the Use of Artificial Intelligence by Firms in Public Procurement and Contracts", published on kilichukuk.org on 22 June 2026.