'Government Cloud Procurement' as precursor of procurement gatekeeping? -- re McGillivray (2022)

I have started reading K McGillivray, Government Cloud Procurement. Contracts, Data Protection, and the Quest for Compliance (Cambridge University Press 2022), which promises to be a big addition to the literature on the procurement of digital technologies. One of the key issues the book explores at length is the central role that public contracts play in filling (some of the) regulatory gaps left by the absence of legislation addressing the challenges of cloud computing.

This got me thinking that this gap-filling function of public contracts in the cloud sphere is reflective of the broader role that procurement procedures and the ensuing public contracts are starting to develop in relation to other types of digital technology—notably, artificial intelligence (AI).

Procurement regulation will increasingly (be expected to) play a crucial gatekeeping role in the adoption of digital technologies for public governance and public service delivery. As rightly stressed: ‘The rules governing the acquisition of algorithmic systems by governments and public agencies are an important point of intervention in ensuring their accountable use’ [Ada Lovelace Institute, AI Now Institute and Open Government Partnership, Algorithmic Accountability for the Public Sector (August 2021) 33]. Ultimately, contracts and other arrangements for the development and acquisition of digital solutions are the entry point into the public sector for these innovations, and the procurement rules can be either a catalyst or a hindrance to co-production and experimentation with digital governance solutions.

The gatekeeping role of procurement underpinned eg one of the recommendations of the UK’s Committee on Standards in Public Life, in its report on Artificial Intelligence and Public Standards: ‘Government should use its purchasing power in the market to set procurement requirements that ensure that private companies developing AI solutions for the public sector appropriately address public standards. This should be achieved by ensuring provisions for ethical standards are considered early in the procurement process and explicitly written into tenders and contractual arrangements’ (2020: 51). A variation of the gatekeeping approach can concentrate on procurement practice and the embedding of specific controls as a matter of public buyer deontology [see P Oluka Nagitta et al., ‘Human-centered artificial intelligence for the public sector: The gate keeping role of the public procurement professional’ (2022) 200 Procedia Computer Science 1084-1092].

There is thus a growing recognition of the pragmatic utility of leveraging procurement mechanisms to ensure transparency and accountability in algorithmic systems, particularly considering that these systems play a crucial role in policymaking and decision-making by public agencies [DK Mulligan and KA Bamberger, ‘Procurement as policy: Administrative process for machine learning’ (2019) 34(3) Berkeley Technology L. J. 773-851]. Consequently, there is increasing interest in a reassessment of the existing procurement rules as they apply to contracts for digital technologies; as well as in the redesign of procurement to foster reliability, sustainability, and public trust in AI [see e.g. UK Government, BEIS, DCMS and Office for AI, Guidelines for AI procurement (8 June 2020); also W Naudé and N Dimitri, ‘Public Procurement and Innovation for Human-Centered Artificial Intelligence’ (2021)].

However, the challenges in effectively mobilising procurement for this gatekeeping function are yet to be properly conceptualised and understood [See e.g. P Nowicki, ‘Deus Ex Machina?: Some Remarks on Public Procurement in the Second Machine Age’ (2020) 1 EPPPL 53-60; see also K Mcbride et al, ‘Towards a Systematic Understanding on the Challenges of Procuring Artificial Intelligence in the Public Sector’ (2021)].

As I keep thinking about this (see here for earlier thoughts), I am realising that the emerging discussion or conceptualisation of public procurement (or procurement professionals) as gatekeepers of the adoption of AI by the public sector (and more broadly) can fall into the same trap of partiality as the equivalent discussion of financial gatekeepers in the corporate governance sphere years ago.

As Prof Coffee brightly pointed out [Gatekeepers: The Professions and Corporate Governance (OUP, 2006) 2-3] in the context of financial markets, there are two important dimensions of gatekeeping at play: one concerns ‘strict’ gatekeeping in terms of veto capacity (eg an audit firm can decline providing an opinion on corporate accounts, or a lawyer can decline to provide an opinion required for the closing of a specific corporate transaction). The other dimension, however, concerns a reputational aspect of gatekeeping that can generate reliance by third parties (eg an investment bank acquiring shares of a target company can lead others to also invest in that company).

In the procurement context, it seems to me that there is also a strict gatekeeping function (procurement requirements determine which technology/provider cannot get a public contract, eg to protect a specific public interest or avoid a specific public harm; or which one can provided it abides by specific contractualised requirements), as well as a reputational gatekeeping function (eg procurement of specific technologies/from specific providers can have a signalling effect that triggers further procurement by other public buyers and/or adoption by the private sector).

While in financial markets the reputational aspect is dependent on market-based issues (such as repeat transactions), in procurement settings reputation is almost a given due to a presumption of strict scrutiny of public providers (and thus the importance of ‘past performance’, or other signals such as being able to disclose that a technology or provider is used by Department X, or in some other settings ‘by appointment to HM the Queen’). This compounds the importance of procurement gatekeeping, as it not only concerns the specific decision adopted by a given public buyer, but also the broader access of technologies and providers into the public sector (and beyond).

However, a significant difference between gatekeeping in financial markets and in procurement however stems from the likely main source of potential failure of the gatekeeper. While in financial markets gatekeepers can be expected to be high-skilled but subject to structural conflicts of interest, in particular due to the way they are remunerated (which impinges on their independence), in procurement markets there is a real risk that public buyers are not only subject to potential conflicts of interest (an enduring issue in procurement regulation, and the source of incomplete attempts at the regulation of conflicts of interest and integrity in procurement), but also underprepared for the gatekeeping task.

In other words, the asymmetry of information seems to operate in reverse in both settings. While in financial markets the superior information and related skills belong to the gatekeeper (as compared to the retail, or even (passive) institutional investors), in procurement markets the information and skills disadvantage plays against the gatekeeper (public buyer) and in favour of those seeking to sell their technology.

And this is where the analysis by McGillivray is again interesting, as it highlights compliance challenges and gaps resulting from the parallel procurement-based gatekeeping of data protection law in the government cloud procurement sphere. Plenty food for thought (at least for me).

Flexibility, discretion and corruption in procurement: an unavoidable trade-off undermining digital oversight?

Magic; Stage Illusions and Scientific Diversions, Including Trick Photography (1897), written by Albert Allis Hopkins and Henry Ridgely Evan.

As the dust settles in the process of reform of UK public procurement rules, and while we await for draft legislation to be published (some time this year?), there is now a chance to further reflect on the likely effects of the deregulatory, flexibility- and discretion-based approach to be embedded in the new UK procurement system.

An issue that may not have been sufficiently highlighted, but which should be of concern, is the way in which increased flexibility and discretion will unavoidably carry higher corruption risks and reduce the effectiveness of potential anti-corruption tools, in particular those based on the implementation of digital technologies for procurement oversight [see A Sanchez-Graells, ‘Procurement Corruption and Artificial Intelligence: Between the Potential of Enabling Data Architectures and the Constraints of Due Process Requirements’ in S Williams-Elegbe & J Tillipman (eds), Routledge Handbook of Public Procurement Corruption (Routledge, forthcoming)].

This is an inescapable issue, for there is an unavoidable trade-off between flexibility, discretion and corruption (in procurement, and more generally). And this does not bode well for the future of UK procurement integrity if the experience during the pandemic is a good predictor.

The trade-off between flexibility, discretion and corruption underpins many features of procurement regulation, such as the traditional distrust of procedures involving negotiations or direct awards, which may however stifle procurement innovation and limit value for money [see eg F Decarolis et al, ‘Rules, Discretion, and Corruption in Procurement: Evidence from Italian Government Contracting’ (2021) NBER Working Paper 28209].

The trade-off also underpins many of the anti-corruption tools (eg red flags) that use discretionary elements in procurement practice as a potential proxy for corruption risk [see eg M Fazekas, L Cingolani and B Tóth, ‘Innovations in Objectively Measuring Corruption in Public Procurement’ in H K Anheier, M Haber and M A Kayser (eds) Governance Indicators: Approaches, Progress, Promise (OUP 2018) 154-180; or M Fazekas, S Nishchal and T Søreide, ‘Public procurement under and after emergencies’ in O Bandiera, E Bosio and G Spagnolo (eds), Procurement in Focus – Rules, Discretion, and Emergencies (CEPR Press 2022) 33-42].

Moreover, economists and political scientists have clearly stressed that one way of trying to strike an adequate balance between the exercise of discretion and corruption risks, without disproportionately deterring the exercise of judgement or fostering laziness or incompetence in procurement administration, is to increase oversight and monitoring, especially through auditing mechanisms based on open data (see eg Procurement in a crisis: how to mitigate the risk of corruption, collusion, abuse and incompetence).

The difficulty here is that the trade-off is inescapable and the more dimensions on which there is flexibility and discretion in a procurement system, the more difficult it will be to establish a ‘normalcy benchmark’ or ‘integrity benchmark’ from which deviations can trigger close inspection. Taking into account that there is a clear trend towards seeking to automate integrity checks on the basis of big data and machine learning techniques, this is a particularly crucial issue. In my view, there are two main sources of difficulties and limitations.

First, that discretion is impossible to code for [see S Bratus and A Shubina, Computerization, Discretion, Freedom (2015)]. This both means that discretionary decisions cannot be automated, and that it is impossible to embed compliance mechanisms (eg through the definition of clear pathways based on business process modelling within an e-procurement system, or even in blockchain and smart contract approaches: Neural blockchain technology for a new anticorruption token: towards a novel governance model) where there is the possibility of a ‘discretion override’.

The more points along the procurement process where discretion can be exercised (eg choice of procedure, design of procedure, award criteria including weakening of link to subject matter of the contract and inclusion of non(easily)measurable criteria eg on social value, displacement of advantage analysis beyond sphere of influence of contracting authority, etc) the more this difficulty matters.

Second, the more deviations there are between the new rulebook and the older one, the lower the value of existing (big) data (if any is available or useable) and of any indicators of corruption risk, as the regulatory confines of the exercise of discretion will not only have shifted, but perhaps even lead to a displacement of corruption-related exercise of discretion. For example, focusing on the choice of procedure, data on the extent to which direct awards could be a proxy for corruption may be useless in a new context where that type of corruption can morph into ‘custom-made’ design of a competitive flexible procedure—which will be both much more difficult to spot, analyse and prove.

Moreover, given the inherent fluidity of that procedure (even if there is to be a template, which is however not meant to be uncritically implemented), it will take time to build up enough data to be able to single out specific characteristics of the procedure (eg carrying out negotiations with different bidders in different ways, such as sequentially or in parallel, with or without time limits, the inclusion of any specific award criterion, etc) that can be indicative of corruption risk reliably. And that intelligence may not be forthcoming if, as feared, the level of complexity that comes with the exercise of discretion deters most contracting authorities from exercising it, which would mean that only a small number of complex procedures would be carried out every year, potentially hindering the accumulation of data capable of supporting big data analysis (or even meaningful econometrical treatment).

Overall, then, the issue I would highlight again is that there is an unavoidable trade-off between increasing flexibility and discretion, and corruption risk. And this trade-off will jeopardise automation and data-based approaches to procurement monitoring and oversight. This will be particularly relevant in the context of the design and implementation of the tools at the disposal of the proposed Procurement Review Unit (PRU). The Response to the public consultation on the Transforming Public Procurement green paper emphasised that

‘… the PRU’s main focus will be on addressing systemic or institutional breaches of the procurement regulations (i.e. breaches common across contracting authorities or regularly being made by a particular contracting authority). To deliver this service, it will primarily act on the basis of referrals from other government departments or data available from the new digital platform and will have the power to make formal recommendations aimed at addressing these unlawful breaches’ (para [48]).

Given the issues raised above, and in particular the difficulty or impossibility of automating the analysis of such data, as well as the limited indicative value and/or difficulty of creating reliable red flags in a context of heightened flexibility and discretion, quite how effective this will be is difficult to tell.

Moreover, given the floating uncertainty on what will be identified as suspicious of corruption (or legal infringement), it is also possible that the PRU (initially) operates on the basis of indicators or thresholds arbitrarily determined (much like the European Commission has traditionally arbitrarily set thresholds to consider procurement practices problematic under the Single Market Scorecard; see eg here). This could have a signalling effect that could influence decision-making at contracting authority level (eg to avoid triggering those red flags) in a way that pre-empts, limits or distorts the exercise of discretion—or that further displaces corruption-related exercise of discretion to areas not caught by the arbitrary indicators or thresholds, thus making it more difficult to detect.

Therefore, these issues can be particularly relevant in establishing both whether the balance between discretion and corruption risk is right under the new rulebook’s regulatory architecture and approach, as well as whether there are non-statutory determinants of the (lack of) exercise of discretion, other than the complexity and potential litigation and challenge risk already stressed in earlier analysis and reflections on the green paper.

Another ‘interesting’ area of development of UK procurement law and practice post-Brexit when/if it materialises.