Tendering an AI platform: the guide in seven steps

Which seven steps make up a tender?

1. Clarify needs: What will the AI be used for, how many people will work with it, which data will go into it (for example patient, social or personnel data) and which systems are to be connected?
2. Estimate the contract value: over the whole term, including extension options, rollout, training and operation. The procedure follows from this.
3. Research the market: get to know providers, pricing models and operating models without favouring any provider.
4. Describe the service: vendor-neutral, with mandatory and desirable criteria.
5. Set suitability and evidence: certificates, contracts, references.
6. Evaluate bids: by total cost and quality, backed by a trial.
7. Sign the contract: with a suitable model contract and clear rules for the end of the contract and the return of data.

The legal framework per country is explained in the guides on procurement law in Germany, Austria and Switzerland.

How do you estimate the contract value correctly?

What counts is the estimated total value excluding VAT over the whole term, including options and extensions (Section 3 VgV, the German Public Procurement Regulation; in Austria Section 13 BVergG 2018, in Switzerland Art. 15 BöB). A contract must not be split to stay below a threshold.

For AI platforms, the value is often set too low because only one year of licence is counted. Add up the licence for all years, hardware and service contract (when operated on your premises), rollout, training, operation and connectors.

Country	Threshold for EU-wide or international procurement (supplies and services, net)	As of
Germany	€216,000 for most public contracting authorities, €140,000 for supreme and higher federal authorities, €432,000 for sector contracting authorities	from 1 January 2026
Austria	€216,000, €140,000 for central public contracting authorities (Annex III BVergG 2018)	from 1 January 2026
Switzerland, federal level	Open or selective procedure from CHF 230,000	2026 and 2027
Switzerland, cantons and municipalities (IVöB 2019)	Open or selective procedure from CHF 250,000, scope of international agreements from CHF 350,000	2026 and 2027

Below these thresholds, national rules apply; in Germany usually the UVgO (rules for below-threshold procurement) in the version of your federal state.

How do you research the market without putting the procedure at risk?

Market research before the procedure is expressly permitted (Section 28 VgV, Section 24 BVergG 2018, Art. 14(3) BöB). Its purpose is to get to know the market, not to award a contract. Invite several providers, document the conversations and give all of them the same information.

Be careful with providers who help write the specification: anyone involved in the preparation may only bid if the advantage is offset, for example by giving all bidders the same documents and longer time limits (Section 7 VgV). More on this in the guide Proof of concept for AI.

What belongs in the specification?

The specification names requirements, not brands (Section 31(6) VgV). A split has proven useful:

• Mandatory criteria: processing in the EU, no training with your data, a data processing agreement under Art. 28 GDPR, permissions per person from your identity management, a log, return of data at the end of the contract. For health data in the cloud, the proof under § 393 SGB V (German Social Code Book V).
• Desirable criteria with points: sources in answers, connectors to your systems, apps for sharing, operation without an internet connection, training, support.
• Quantities and framework: number of people, term, options for more people or a later change of operating model.

If you want to keep both cloud and operation on your own premises open, describe both as variants or form lots. In Germany, dividing a contract into lots is the rule (Section 97(4) GWB). The tender generator creates a template with mandatory and desirable criteria. Public administrations in Germany also follow the standards of the Deutschland-Stack (the German federal government’s reference architecture for public-sector IT).

Which evidence should you ask for?

Ask for what your data protection and information security teams check anyway: certificates with their scope (for example ISO 27001), a data processing agreement with the list of sub-processors, technical and organisational measures, an agreement under § 203 StGB (German Criminal Code, professional and official secrecy) where professional or official secrets are involved, and references of a comparable size. Questions you can put to any provider are listed in the checklist for AI providers.

How do you evaluate bids fairly?

The contract is awarded to the most economically advantageous bid, meaning the best value for money (Section 127 GWB, Section 58 VgV; in Austria Section 91(4) BVergG 2018, in Switzerland Art. 29 BöB). Two points make AI bids comparable:

• Total cost over the term: licence per person or per server, hardware, operation, rollout, connectors and usage limits, calculated over five years.
• Trial: all bidders solve the same tasks with your sample documents. What is evaluated is answer quality, sources, permissions and ease of use.

How to weight criteria and award points is shown in the guide Criteria catalogue for evaluating providers. Methods for evaluation are described in the German federal government’s UfAB 2018.

Which contract fits?

In Germany, the public sector uses the EVB-IT Cloud for cloud services; for software on hardware on your own premises, other EVB-IT may apply, for example for the provision of standard software or for systems with installation. The current version is published by the Federal CIO (CIO des Bundes). In any case, set out which data you get back at the end of the contract, in which format, and when it is deleted. More on this in the guide Exit strategy and data portability.

Not legal advice: This guide does not replace review by your procurement office. Thresholds and model contracts change; research as of 11 October 2026.

How does this work with basebox?

The tender generator creates a vendor-neutral specification; it does not name basebox, and any provider can bid on it. For your review, the data processing agreement, TOMs, the list of sub-processors and the agreement under § 203 StGB are available for download on Security, and the licence agreement and annexes on the page Contract and annexes; you receive the price list with the quote. The calculator works out the list prices for cloud and server without registration, so you can estimate the contract value in advance.