How Scottish public sector procurement rules shape AI marketing platforms

What to take away

How Scottish procurement frameworks govern platform buying

Scottish public bodies buy most marketing technology through Scottish procurement frameworks. These national arrangements, run by the Scottish Government and its agencies, include the Software Application Products and Services 2 (SPAS 2) and Digital Technology Services 2 (DTS2) frameworks. They set terms suppliers must accept before a public body can call off a contract.

If an AI marketing platform is not on a framework, a council or health board usually cannot simply buy it with a card. It must run a competitive tender or use an allowed route such as a framework call-off.

The main framework for digital and technology buying is run through Public Contracts Scotland, the national advertising portal. A marketing team that wants an AI content tool will first check whether the tool is on a relevant framework. Options include SPAS 2 for software products and reseller services, or DTS2 for digital technology services.

If it is not, the team may need to run a mini competition among framework suppliers.

Framework rules also shape contract length, pricing and exit terms. A public body cannot agree to a three-year lock-in if the framework only allows a one-year call-off with extension options. Scottish digital frameworks typically set call-off terms of one year plus one or two one-year extensions, but the framework documents are the authority.

This matters for AI marketing platforms because platforms update and data processing terms change quickly. A short call-off with clear break points is usually safer than a long commitment.

The procurement route also decides who carries risk. Under a framework call-off, the framework owner has already checked basic financial standing and some compliance. Under a full tender, the public body must run those checks itself. That is why marketing teams often prefer framework routes even when a platform is available outside them.

Scottish procurement frameworks also require transparency. Contract awards at or above £50,000 are published on Public Contracts Scotland. A marketing team should assume that the platform name, contract value and supplier will be public. That can affect how a supplier negotiates on price and terms.

For AI tools specifically, framework call-offs may not cover every use case. A general software framework may allow a marketing automation platform but not the AI features added later. The team should check whether the framework scope includes AI processing, content generation and data enrichment. If it does not, a separate approval may be needed.

The Scottish Government digital strategy and AI expectations

The Scottish Government digital strategy sets out how public bodies should use digital technology, including AI. It expects organisations to be open about how AI is used, to assess risk before deployment and to keep human oversight where decisions affect people.

For marketing teams, that means an AI tool that writes or targets campaign content still needs a named person responsible for what it publishes.

The strategy also encourages public bodies to share data and reuse platforms where possible. In practice, that pushes marketing teams towards shared services and common platforms rather than many small tools.

A health board and a local council may both use the same AI marketing platform if a national arrangement exists, which can simplify data protection and training.

The strategy does not name specific AI marketing products. It sets expectations: understand the use case, check the data, test the output and monitor for harm. A public body that cannot explain how its AI marketing tool works, or who is accountable for its output, is not meeting those expectations.

Digital strategy also links to Scotland's AI strategy, which focuses on trustworthy AI and economic benefit. A short record of what the tool does, what data it uses and who approved it is often enough to satisfy audit and governance teams.

The strategy expects public bodies to consider the environmental and social impact of digital tools. AI marketing platforms can consume significant computing power, so some bodies ask suppliers about energy use and data centre location. That is not yet a standard scoring criterion, but it appears in more tenders.

Finally, the digital strategy supports skills development. Marketing teams that buy AI tools are expected to train staff to use them properly. A platform that is hard to learn or lacks training materials may score lower in evaluation, even if its features are strong.

Data protection rules public bodies must apply

Public sector data protection rules in Scotland come from UK GDPR and the Data Protection Act 2018. The Information Commissioner's Office (ICO) enforces them across the UK, including Scotland. A public body must have a lawful basis for processing personal data, and marketing campaigns often rely on public task or consent.

AI tools that profile individuals or infer preferences need extra care.

A data protection impact assessment (DPIA) is required when processing is likely to result in high risk. Many AI marketing uses trigger that test, especially if the tool segments people by behaviour or predicts response.

The DPIA should cover what data goes into the tool, where it is stored, how long it is kept and what rights people have.

Public bodies must also follow the data protection principles. These cover lawfulness, fairness and transparency, plus purpose limitation, data minimisation and accuracy. They also cover storage limitation, integrity and confidentiality, and accountability.

An AI marketing platform that learns from customer data without clear consent may breach purpose limitation. A tool that keeps data indefinitely may breach storage limitation.

Supplier contracts must include data processing terms. The public body remains the data controller, and the AI platform is usually a data processor. The contract must set out what the processor can do, how it handles breaches and how it deletes data at the end.

If the supplier wants to use public sector data to improve its own systems, that must be explicit and lawful.

International transfers are a common issue. Many AI marketing platforms store data outside the UK. The public body must check that transfers rely on an adequacy regulation or appropriate safeguards such as the International Data Transfer Agreement. The ICO provides guidance on this.

Public sector data protection also covers automated decision-making. If an AI tool makes decisions about individuals with legal or significant effects, Article 22 of UK GDPR applies.

Marketing segmentation rarely reaches that threshold, but it can if it determines access to services or benefits. Teams should document why Article 22 does not apply, or put safeguards in place.

Which AI marketing platforms public bodies can buy through Scottish frameworks

Named AI marketing platforms available to Scottish public bodies usually come through framework resellers. The table below gives the route to check for each platform. Availability depends on the framework and the reseller, not just the vendor.

Evaluation and scoring under public sector procurement

Evaluation under public sector procurement uses published criteria and weightings. For AI marketing platforms, common criteria include functional fit, data protection, integration, usability, support and price. The weighting decides which supplier wins, so a low price cannot compensate for a weak data protection answer.

For example, a Scottish Government framework call-off such as DTS2 publishes its own award criteria. A typical split is 60 per cent quality and 40 per cent price, but only the framework documents state the exact method. Some frameworks use a fixed price and evaluate only quality. Others use a price-quality ratio.

Social value is often a scored criterion in Scotland. Suppliers may be asked how they will create training or employment opportunities. An AI marketing platform supplier that can show local support and skills work may score higher.

Evaluation panels should include someone who understands data protection and someone who understands marketing. A panel of only procurement staff may miss risks in how the AI tool handles personal data. A panel of only marketers may miss compliance gaps.

Scoring should be evidence-based. If a supplier claims its AI is ethical, the panel should ask for documentation. The UK AI Playbook for the UK Government includes evaluation questions that can be reused. It suggests asking about data sources, bias checks, human oversight and incident reporting.

A supplier comparison without weightings often fails because it treats all criteria as equal. A platform that is strong on price but weak on data protection should not win if data protection carries a high weighting. The weighting should reflect the public body's risk appetite and the sensitivity of the data.

After award, the public body should monitor performance. AI marketing platforms change, and a supplier that met the criteria at award may not continue to do so. Contract management should include regular checks on data processing, platform updates and security.

Worked example: a Scottish council assessing an AI marketing tool

A Scottish council marketing team wants an AI tool for email content and audience segmentation. It checks Public Contracts Scotland for a SPAS 2 or DTS2 call-off. The platform is listed on SPAS 2, so procurement runs a mini competition among resellers.

The team scores responses on functional fit, data protection, integration, usability and price. Data protection answers carry 30 per cent of the total. The winning bid must meet the data protection requirements set out above before launch. The team records who approves the tool and reviews output monthly.

Where UK AI procurement guidance fits in

UK AI procurement guidance applies across the UK, including Scotland. The main documents are the GOV.UK guide to using AI in the public sector and the guidelines for AI procurement. They set out principles such as understanding the problem, checking the data, testing the system and keeping humans in the loop.

The A guide to using artificial intelligence in the public sector - GOV.UK explains how public bodies should assess AI use cases and manage risk. It is useful when writing a business case for an AI marketing platform.

The Guidelines for AI procurement - GOV.UK set out what to ask suppliers about data, performance and accountability. They can be turned into tender questions and evaluation criteria.

The AI Playbook for the UK Government - GOV.UK includes practical guidance on evaluation and assurance. It is written for central government but is widely used by other public bodies.

These documents do not replace Scottish procurement frameworks. They sit alongside them. A Scottish public body must still follow framework rules and Scottish Government digital strategy, but the UK guidance helps with the technical and ethical questions.

For marketing teams, the guidance means three practical steps:

A selection checklist can turn those steps into a repeatable process. It should cover procurement route, data protection, evaluation and contract management.

UK guidance also links to the UK regulations to verify before running a campaign. Those include UK GDPR, the Privacy and Electronic Communications Regulations and advertising rules enforced by the Advertising Standards Authority. An AI marketing tool that sends emails or targets ads must comply with all of them.

Finally, the AI procurement guidance for software selection helps teams ask the right questions early. It is better to rule out a platform at the framework check than after a three-month tender.

Common questions