Purchasing adds AI policy questions to every software solicitation checklist before award. What governance practice is this?

Embedding AI governance requirements into municipal procurement processes is the correct practice when purchasing adds AI policy questions to every software solicitation checklist before award. That works because many shadow-AI and high-risk tools enter the city through ordinary purchase orders and renewals; if governance starts only after go-live, the city has already accepted vendors, data flows, and contractual terms that are expensive to unwind. Putting policy questions on the solicitation checklist forces every buy—SaaS, GenAI add-ons, analytics suites—through the same rails for purpose, data handling, human oversight, and risk tier before award.

Skipping policy review for any tool labeled innovative fails by concept: marketing labels are not a risk classification and create an express lane around civic controls. Letting vendors self-certify with no city questions asked fails by concept because vendor attestations optimize for sales, not municipal duties, and leave no city-owned record of what was asked or answered. Removing AI clauses so contracts stay short fails by concept: brevity without AI terms leaves residency, training-data use, subprocessors, and incident duties undefined when something goes wrong.

Exam caveat: procurement embedding is necessary but not sufficient—post-award monitoring and change control still matter when vendors add AI features mid-contract. Keep purchasing / municipal solicitation framing. Operational check: add mandatory AI policy questions to solicitation and renewal checklists; route affirmative AI uses to the AI program/risk review before award; retain Q&A in the procurement file; and refuse awards that cannot meet city AI, privacy, and records requirements.