Victoria's Buying Guidance Suggests Listing a Supplier's Permitted AI Uses in the Contract

A government buyer hires a professional services supplier to deliver a report. It expects the report to be prepared by the skilled staff listed in the tender. The report arrives with serious problems, including "factual errors and fake references." The supplier later admits that AI hallucinations led to them. It had no approval to use AI to write the report. And it did not keep proper oversight of the AI.

That is an example in guidance the Victorian Government in Australia gives its own buyers. It names no supplier. The result, the guidance says, can be legal issues, data security risks, significant rework and project delays.

The guidance is Navigating AI in procurement, from Victoria's Department of Government Services. It sits on the state's Buying for Victoria site and was updated on August 3, 2026. It helps buyers see how AI can affect a procurement and what to do at each stage. It says it is not an exhaustive list of all legal, policy or risk considerations. Parts of it follow, not the whole.

AI the Buyer Did Not Know About

Buyers who do not know they are procuring AI can be exposed to its risks, the guidance says. That includes when suppliers add AI to existing goods or services after the contract is signed. It also includes AI a supplier uses to deliver a service without the buyer knowing.

AI may be brought into existing goods or services during the life of a contract without the buyer's knowledge, the guidance says. That may create risks if the contract has no proper safeguards for AI use.

Buyers going to market should find out whether suppliers intend to use AI to deliver the goods or services, now or in the future. That matters more and more, the guidance says, as AI becomes easier to get and more built into suppliers' business practices.

How Buyers Can Safeguard

Buyers can guard against these risks through their procurement documents, the guidance says. In the invitation to supply, a buyer can require suppliers to disclose if and how AI is proposed to deliver the goods and services. Or the buyer may instead prohibit any use of AI to deliver them.

The contract can carry more. The guidance suggests a schedule of permitted AI uses. Suppliers can then use AI only as the contract states. Other terms can stop suppliers from bringing in new AI without the buyer's approval. And terms can require the supplier to give the buyer a way to opt out of new AI, or to switch it off.

Contracts already signed are covered too. If AI is a concern for one, the guidance says, the buyer should consider whether to change the contract to reduce the risk, with legal advice. A buyer may also use an existing contractual right to audit, or to request information about, the supplier's use of AI.

Offers Written With AI

Suppliers are more and more using AI to prepare offers, the guidance says. Buyers should think about the risks that may bring.

One is information security. A supplier may misuse information in procurement documents, the guidance says. That could mean using it to train AI, or entering sensitive information into publicly available AI. If this is a concern, buyers should take legal and security advice and put safeguards in their documents, the guidance says. That could include limits on using the information with publicly available AI.

Another is capability. AI use may make a supplier appear more capable than it is, the guidance says. Buyers may need to do more checking of the supplier. That checking could include site visits, presentations, reference checks and questions to the supplier.

Another is fraud. AI can be used to produce false but realistic documents, like certificates of compliance or insurance. If fraudulent documentation is suspected, the guidance says to check public databases or contact the organization concerned to verify that it is authentic.

The Buyer's Own Use of AI

Buyers may use AI to support a procurement, the guidance says. But they remain accountable for their decisions and outcomes. They should keep oversight and be able to explain the reasoning behind their decisions or recommendations. They should be able to put things right where the AI is not working as intended, or gives inaccurate outputs.

Buyers should also keep robust records of their AI use, in line with the state's recordkeeping policy for AI. And where a buyer's use of AI could significantly affect suppliers, the buyer should say so in the procurement documents.

The guidance says it will be updated as AI continues to evolve. When a report arrives with a fake reference in it, will the contract say whether AI was allowed to write it?