Public bodies buy AI under constraints private firms rarely face: procurement law, public accountability, long contract horizons and a duty to avoid dependence on any one supplier. Over 2025 and 2026, governments turned those constraints into explicit AI policy. The result is a fairly consistent set of expectations across the US, UK and EU, and they can be translated into contract terms and architecture choices.
This article summarises the policies and offers a checklist for buyers.
What the policies say
United States. OMB memorandum M-25-22, issued on 3 April 2025, tells agencies to pay careful attention to vendor sourcing, data portability and long-term interoperability to avoid costly dependence on a single vendor. It asks agencies to include solicitation provisions that reduce lock-in risk, such as knowledge transfer, clear data and model portability practices, clear licensing terms and pricing transparency. It also directs that contracts permanently prohibit using non-public agency inputs and outputs to further train publicly or commercially available AI systems without agency consent.
United Kingdom. The AI Playbook for the UK Government, published in February 2025, sets ten principles for AI use in government and public bodies, including using AI securely, keeping meaningful human control at the right stage, managing the full life cycle, being open and collaborative, and working with commercial colleagues from the start.
European Union. Under the AI Act, Article 27 requires deployers that are bodies governed by public law, or private entities providing public services, to carry out a fundamental rights impact assessment before deploying certain high-risk AI systems. The Interoperable Europe Act requires interoperability assessments for public services across borders and encourages reuse of open, interoperable solutions.
The takeaway: portability, protection of government data, human control and impact assessment are now baseline expectations, not differentiators.
Lock-in has three layers
Buyers tend to think of lock-in as one thing. In AI it has three distinct layers, and a contract can protect one while leaving the others exposed.
- Interface lock-in. Applications written against one vendor's proprietary API. Mitigation: require a standard, widely implemented interface, so a different model or supplier can be swapped in.
- Model lock-in. Dependence on a model only one supplier can serve. Mitigation: where performance allows, prefer open-weight models that several suppliers, or the agency itself, can run; for closed models, keep evaluations that make a switch testable.
- Infrastructure lock-in. Dependence on one provider's capacity, region and terms. Mitigation: require that workloads can move between providers and to government-controlled hardware, with no data left behind.
A procurement checklist
Data
- Government inputs and outputs are not used to train any model offered to others, and the term survives contract end.
- Data location is declared per workload, and the declaration is verifiable, not just contractual.
- Retention is zero or explicitly bounded; deletion is certified.
Portability
- Standard interface for model calls; no proprietary SDK dependency.
- Evaluation sets and fine-tuned weights produced under the contract belong to the agency.
- An exit plan, tested before go-live: export, re-deploy elsewhere, cut over.
Accountability
- Per-call records naming the system, model version, time and authority, retained for the required period.
- Human override and stop procedures documented and tested.
- For EU deployers of high-risk systems: impact assessment completed before deployment.
Market health
- Pricing transparent per unit of work.
- More than one qualified supplier for each critical workload.
- Preference for open standards and open-source components where they meet requirements.
Open infrastructure as a procurement strategy
Open-weight models and open-source serving software change the economics of public procurement. When the model and the software are open, an agency can buy capacity from several providers, run the same stack on its own hardware, and switch without rewriting applications. The procurement question becomes "who serves this best today?" rather than "whose platform are we committing to for a decade?"
Open infrastructure does not remove the need for assurance. It moves assurance from trusting a single vendor's promises to verifying properties of each provider: where it runs, what model it serves, what it does with data.
Regional notes
US federal guidance is explicit on lock-in and government data. The UK relies on principles and commercial practice. The EU combines binding duties on high-risk deployment with interoperability requirements for cross-border services. In MENA and APAC, many governments are building national AI capacity, and the same lock-in layers apply whether the supplier is foreign or domestic.
What this means for public-sector buyers
Write portability and data protection into the requirement, not just the contract; ask suppliers to demonstrate an exit before award; and prefer architectures where verification replaces trust.
Where Tenzro fits
Tenzro is an open network where machines of every size serve AI to agents, apps and people. For public-sector buyers, what exists today:
- Open source and self-hostable. The node is published under the Apache 2.0 licence. An agency can join the public network, run private nodes that are never announced, or bootstrap a self-contained network of its own from the same software.
- Standard interface. Language inference is reachable through an OpenAI-compatible endpoint, so applications are not tied to a proprietary SDK.
- Open models with licence checks. The catalog lists open-weight models with their licence tier; non-commercial and custom-licence models are refused unless the operator explicitly accepts them.
- Verifiable placement and terms. Providers declare a coarse region and jurisdiction, and operators sign policies stating jurisdictions, data retention and whether they train on inputs. Serving outside a declared jurisdiction is provable from a signed receipt; retention and training declarations are filterable but not automatically enforced.
- No privileged channel. Every buyer and reseller meets the same fees and rules; no supplier holds a protocol privilege.
The network is live in preview. Its phases (preview, testnet and the stages to mainnet) are decided by on-chain governance on measured evidence, not on dates. See tenzro.com.
