For policy makers

When a city council votes to build a water plant or buy school buses, councillors don't need a degree in chemical engineering or diesel mechanics. They know the right civic questions to ask: Are the brakes independently tested? Can our own mechanics read the repair manual? Who is liable if a valve fails?

Public officials can govern AI with the exact same confidence. Vendor pitches often try to make software sound like weather, an unstoppable force you must accept on the seller's terms. In reality, software is plumbing. And public procurement is one of the strongest levers on earth for making sure that plumbing is safe, inspectable, and fair.

Five practical safeguards worth adopting now

1. Make public AI visible before it touches residents. Nobody would accept a city court that judged parking tickets using a secret rulebook locked in a private vendor's basement. Before an agency deploys an automated tool that affects benefits, housing, or licensing, it should publish a plain-English entry in a public register. That entry should state what the tool does, how it was tested, and who is accountable for it. Any contract amendment or software renewal that adds automated tools, including through outside contractors, must trigger mandatory assessment before reaching the public.^1,2,7,13,16

2. Give software agents their own badges, never a human clerk's login. Today, many commercial AI agents log into government databases using a human employee's password. That is like letting an automated delivery drone fly with a human pilot's licence: when a crash happens, the logbook blames the clerk who wasn't even at the desk. Agencies should require every software agent to carry its own distinct cryptographic badge tied to a named office. Short-lived permissions and signed handoff tokens then bind every sub-agent step back to the authorizing caseworker.^3,5,18

3. Write checkable receipts into every procurement contract. Before signing a software contract, require that every external action an AI system takes leaves a durable, tamper-evident receipt enforced outside the model so a clever prompt cannot erase its trail.⁹ Require suppliers to provide an itemized bill of materials and submit to independent evaluations on real public-sector workflows using a separate auditor model. Never rely on seller self-assessments or generic commercial benchmarks alone.^6,10,11 Read our guides on contracts, government AI, buying an agent, and AI agents should hold permissions that expire.

4. Guarantee a real human appeal with the power to reverse mistakes. An appeal process where a citizen complains to a clerk who simply stares at a screen and says "the computer says no" isn't an appeal at all.

When an automated system denies a benefit, disability claim, housing application, or permit, the resident deserves two things. First, they need a plain receipt showing the specific facts and rules used. Second, they need a timely review by a human official who has the authority and training to overturn the machine.^1,4 Read our guide on when software decides about you.

5. Invest in public computing the way cities invest in libraries and roads. If a municipality or national government spends its entire technology budget renting closed cloud services by the month, it ends up owning nothing at the end of the lease.

Public technology spending should build lasting shared capacity. That includes open weights, local hospital and university clusters, and open audit tools that local businesses, schools, and civic groups can rely on for years to come. Read our explainer on public computing.

Questions a councillor or committee staffer can ask in a five-minute hearing

When a vendor or agency department presents a new AI system, you can cut through forty slides of buzzwords with four plain questions:

"Show us a sample receipt." If this system makes a mistake next week, what exact record will the resident and our auditor see?
"How do we turn it off or switch vendors?" If we end this contract in two years, do we keep our data, our audit logs, and our workflows in an open standard?
"Was it tested by someone who doesn't work for the seller?" Can we read an independent evaluation of its failure rate on real cases like ours?
"What happens when the system isn't sure?" Does it pause and hand the file to a qualified staff member, or does it guess?

The four procurement gates protect public services and residents before any automated tool goes live. Each safeguard is enforced by legal contract and software architecture, never left as a voluntary vendor guideline.

What we can offer your office

We write concise, plain-language briefings on the policy and procurement questions crossing your desk, with every claim traced to a primary statute, standards draft, or peer-reviewed study. In Shared Horizon, we also track how dozens of public agencies, regulators, and international bodies are approaching these rules in practice.

Because we sell no software and take no vendor money, we can serve as a candid, independent sounding board on draft procurement rules or legislative language. And just as importantly, we want to hear where you run into practical roadblocks, our research only matters if it helps you protect the public.

Write to us at contact@collectiveintelligencenetwork.org. A person reads every note, and we will reply plainly.

For researchers

Our public-sector procurement architecture builds on the ten agent identity design tenets formulated by NIST and MITRE (Booth et al., 2026³). It incorporates verifiable cross-domain mandates under IETF WIMSE (Hulea et al., 2026⁵) and structured model templates for Fundamental Rights Impact Assessments under Article 27 of the EU AI Act (Mantelero, 2024⁷).

Treaty-level procurement alignment follows Article 3 and Article 14 of the Council of Europe Framework Convention on Artificial Intelligence (CETS No. 225, 2024), binding private contractors acting on behalf of public authorities to state-level transparency and human rights obligations.¹³

Supply-chain risk management follows the NIST Artificial Intelligence Risk Management Framework Generative AI Profile (NIST AI 600-1, GOVERN 6.1), mandating an AI Bill of Materials (AIBOM) and independent verification across third-party model dependencies.¹⁰

We pair these with client-side Object-Capability security boundaries (Dennis & Van Horn, 1966) and Proof-Carrying Code execution attestation (Necula, 1997). Auditor independence should be graded rather than treated as yes or no, along three axes: who the auditor answers to, which model it runs on, and what evidence it relies on (Ghanem, 2026⁶).

A review of more than 1,300 benchmark papers against four public-sector criteria (process-based, realistic, public-sector-specific, with suitable metrics) found that no single benchmark meets all four (Rystrøm et al., 2026¹¹). Mandating process-based audit logs and domain-specific stress tests in public tenders protects administrative bodies from unverified marketing claims.

Architectural tactics for public-sector agents further distinguish operational autonomy from agency via tool fencing, write staging, and escalation boundaries (Safin & Balta, 2026⁸). Moving the acknowledgment point ensures that policy-decision receipts survive crash failures and crash recoveries (Singh, 2026⁹), resolving durability-latency trade-offs without forfeiting audit evidence. This decouples runtime model reasoning from external capability authorisation, preventing indirect prompt injection from expanding privilege.

To prevent silent task failures, public tenders must mandate execution-grounded service agreements where independent control planes verify service-state predicates rather than trusting agent self-assessment (Orzechowski et al., 2026¹²). For automated regulatory and compliance reviews, procurement specifications should mandate statutory corpus grounding and threshold-triggered escalation chains, generating structured explainability reports and transferring files to caseworkers whenever automated confidence drops below threshold (Ismaili & Dessureault, 2026¹⁴).

To resolve the administrative law capability-accountability trap, public tenders must incorporate the three doctrines of the Fourth Settlement: Model and System Dossiers, Material-Model-Change Triggers, and judicial Deference to Audit standards (Caputo, 2026¹⁵). This guarantees that an agency's automated tools remain legally scrutable to courts and residents, requiring renewed impact assessments and administrative review whenever model weights, instructions, or capability integrations change materially.

Empirical public administration research shows that legacy procurement practices and purchasing channels often allow automated tools to bypass standard municipal governance (Johnson et al., 2024¹⁶). Top-down governance scaffolds fail without structural contestability and participatory procurement triage across civic departments (McKelvey et al., 2026¹⁷).

To eliminate accountability gaps in multi-agent workflows, public procurement mandates should incorporate the Human Delegation Provenance (HDP) protocol (Dalugoda, 2026¹⁸; IETF draft-helixar-hdp-agentic-delegation-03). HDP establishes lightweight cryptographic chain-of-custody tokens that bind human caseworker authorization events to downstream sub-agent execution paths, supporting offline verification without dependence on proprietary vendor cloud telemetry.

To bridge the coordination gap between statutory compliance and software engineering, public tenders should mandate structured compliance-by-design artifact models (Kosenkov et al., 2026¹⁹). Template-guided viewpoint coordination operationalizes legal statutes into machine-verifiable requirements, reducing compliance design latency and preventing legal requirements from degrading into unverified prose.

1. Treasury Board of Canada Secretariat, Directive on Automated Decision-Making (took effect April 1, 2019; regularly updated).

2. Executive Office of the President, Office of Management and Budget, Memorandum M-24-10: Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (March 28, 2024).

3. Harold Booth, Bill Fisher, Ryan Galluzzo and Tom Clancy, "Design Tenets for Agent Identity Management Systems," NIST Cybersecurity Insights (October 27, 2026), nist.gov/blogs/cybersecurity-insights/design-tenets-agent-identity-management-systems.

4. European Union, Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 14, 50 and 86 (August 2024).

5. Andrei Hulea et al., Verifiable Mandates for Agents Acting Across Administrative Domains, IETF WIMSE Working Group Internet-Draft (October 2026).

6. Mohamed Chahine Ghanem, Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AI, arXiv:2609.18272 (September 2026).

7. Alessandro Mantelero, "The Fundamental Rights Impact Assessment (FRIA) in the AI Act: Roots, legal obligations and key elements for a model template," Computer Law & Security Review 55 (2024): 106020, arXiv:2411.15149.

8. Damir Safin and Dian Balta, Autonomy and Agency in Agentic AI: Architectural Tactics for Regulated Contexts, arXiv:2605.12105 (May 2026).

9. Neeraj Kumar Singh B, The Acknowledgment Point Is the System: Durable Policy-Decision Receipts for AI Audit Evidence, arXiv:2608.17176 (August 2026).

10. National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (July 2024), doi:10.6028/NIST.AI.600-1.

11. Jonathan Rystrøm, Chris Schmitz, Karolina Korgul, Jan Batzner, and Chris Russell, Agent Benchmarks Fail Public Sector Requirements, arXiv:2601.20617 (January 2026).

12. Michał Orzechowski, Renata G. Słota, and Jacek Kitowski, When the Consumer Is an Agent: Execution-Grounded Service-Level Agreements, arXiv:2611.04182, accepted for ICSOC 2026 (November 2026).

13. Council of Europe, Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225, September 2024).

14. Soukaina Alaoui Ismaili and Jean-Sébastien Dessureault, An LLM-Based Agent for Legal Compliance Assessment: Architecture, Memory, and Evaluation in a Canadian and Quebec Context, arXiv:2610.27347 (October 2026).

15. Nicholas Caputo, Administrative Law's Fourth Settlement: AI and the Scrutable State, arXiv:2602.09678 (February 2026).

16. Brittany Johnson et al., Legacy Procurement Practices Shape How U.S. Cities Govern AI: Understanding Government Employees' Practices, Challenges, and Needs, arXiv:2411.04994 (November 2024; updated 2026).

17. Christelle Tessono, Nusrat Jahan Mim and Shion Guha, Infrastructure and its Discontents: Contestations of Power in Canada's AI Governance Scaffold, arXiv:2610.38077 (October 2026).

18. Asiri Dalugoda, HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems, arXiv:2604.04522 (April 2026); see also IETF Internet-Draft Human Delegation Provenance Protocol (2026).

19. Oleksandr Kosenkov, Davide Fucci, Michael Unterkalmsteiner, and Daniel Mendez, Supporting Viewpoint Coordination for Compliance by Design with an Artifact Model for Regulatory Requirements Engineering, arXiv:2611.03631 (November 2026).