Public Procurement Directive No. 44/2026 for Data Science and Artificial Intelligence Projects

Legal basis and authority

This directive is issued under several Chilean laws and decrees governing state administration, administrative procedures, and public procurement contracts, as well as authority from the Director of Public Purchasing and Contracting.

Context and objectives

The Public Purchasing and Contracting Directorate is authorized to issue guidelines for public entities planning data science and artificial intelligence acquisitions. The directive updates previous guidance to align with recent legislative changes and aims to prevent risks related to ethical data treatment while ensuring responsible, safe use of information in public procurement.

Resolution

The directive Public Procurement Directive 44/2026 is approved.

Directive title

Executive summary

The directive provides guidance for public entities acquiring data science and AI solutions to ensure responsible, ethical and secure data use aligned with legal, technical and equity standards. It applies to all public entities and contracting modalities involving data science or AI, identifying key risks such as algorithm opacity, AI model biases and cybersecurity gaps. Main recommendations include careful planning, multidisciplinary teams, ethical design, algorithmic audits and mechanisms for transparency and citizen participation to increase public trust in state AI use.

Introduction

Data science converts data into actionable information for decision-making. When projects follow good practices, they build citizen trust and address privacy, bias and transparency risks. International recommendations emphasize that AI acquisition requires deep understanding of the problem and assessment of the appropriate solution type, considering internal capabilities and risks.

Artificial intelligence

This part describes various risk categories in data science and AI procurement: multiple service types in a single contract, emerging technologies with intensive data use, cybersecurity risks from introducing technology to manual processes, complex goods or services creating lack of visibility, generative AI for citizen interaction or internal guidance, personal or sensitive data in prompts or training, data with base biases (sampling, measurement, or modeling bias), and lack of internal capacity to manage the provider and supervise system performance. The guideline offers recommendations to mitigate complex and risky procurement cases, but each organisation must ensure implementation of measures appropriate to its specific context and sector, as requirements may differ: for example, Defence sector procurement may require more stringent security standards than Education sector procurement.

Process flow to determine contracting object

A structured flow with consecutive stages and control points helps identify and develop procurement requirements for data science and AI projects, allowing determination of whether a packaged solution, packaged services (SaaS/API), or custom development is appropriate. The process includes steps to ensure rights protection, security and public value before final acquisition and contract management.

Phase 1: problem investigation

This phase requires forming a multidisciplinary project team with minimum roles of project leadership, area representatives, data analyst, data manager, and legal officer; describing the problem with focus on user impact rather than merely the absence of a model; analyzing prefactibility across political, economic, social, technological and legal dimensions; identifying actors at micro, meso and macro levels and their key activities; mapping all available data sources and their legal basis; and defining project objectives using SMART methodology. Understanding how the process currently functions and the specific activities involved is essential because the data science or AI model may modify, enrich, facilitate or replace these activities, and data sources must be sufficient to solve the problem and be legally justified for use.

Phase 2: solution proposal

Market research must gather and analyze information on available AI or data science models, delivery modalities, prices, trends and external factors; for complex evaluations or contracts above 5,000 UTM, obtaining market information is mandatory under article 31 of Law 19.886 regulations, and for data science projects the appropriate analysis type must be selected (descriptive, exploratory, inferential, predictive, causal, or mechanical), while for generative AI solutions the most proportionate approach must be chosen: retrieval augmented generation for official sources, language-model-assisted classification or extraction, text/audio/image generation for communication, or agents for integrated automated steps. Organizations must analyze ethical factors affecting a data science or AI project proposal using the Public Algorithms Platform's algorithmic impact evaluation tool or ethical formulization guide to assess risks across five dimensions: personal data use and protection, transparency and accountability, bias and discrimination, proportionality and social license, and cybersecurity; protecting personal data is a constitutional right in Chile, and public institutions must identify whether they have competence to process personal data, obtain it appropriately, and implement necessary safeguards such as data protection impact assessments. Organizations must classify institutional data as confidential, reserved or secret and prohibit its use for retraining AI models or improving models of third parties; contractual commitments must require non-training and record deletion, transparency and accountability are framed within Chilean laws on public information access, citizen participation, and administrative bases, and anonymized or pseudo-anonymized data should be delivered to contractors when possible to preserve privacy.

Transparency, auditing and bias considerations

Organizations must identify the transparency and explanation requirements for decision-making mechanisms based on impact to people's rights, conduct algorithmic audits to verify compliance with security, bias analysis and data protection, and account for systematic errors in data science and AI systems (sample bias, epistemic bias, measurement bias, modeling bias) that may affect vulnerable groups. They must analyze non-technological alternatives and perform cost-benefit analysis while communicating proportionality principles to build social license; for generative AI projects specifically, they must address factuality and traceability (accuracy verification and source citations to detect hallucinations), human-in-the-loop (human validation before decisions affecting people), and intellectual property (clarifying provenance and ownership of training data, models and outputs). Public institutions must implement technical and organizational measures for protection, availability, integrity, confidentiality and resilience of digital systems, with generative AI requiring prompt injection testing, data exfiltration prevention, confidential document or data management, and contractually defined incident notification timelines; procurement requirements must include detailed technical specifications and problem descriptions governed by Law 19.886, with public agencies prioritizing public tenders, competitive dialogues or innovation contracts when requirements are met.

Phase 3: managing a data science or AI contract

Contract management for AI and data science projects requires tracking deliverables, ethical data management, specification verification through testing, documentation of decisions and system transparency, and end-user training for both custom developments and existing solution purchases. For custom developments, activities include obtaining and loading data in compliance with personal data regulations, transforming data into analysis-ready formats through normalisation and cleaning, performing exploratory analysis to detect anomalies and pre-existing biases, building and testing multiple model versions against agreed fairness and robustness standards, validating the selected model through documentation and explainability mechanisms, and generating conclusions with monitoring and incident response plans plus optional pilot and implementation phases depending on budget and project scope. For existing solutions, contract activities focus on testing performance on the institution's specific data through pilots with defined performance metrics compared against baselines, performing cross-validation and adversarial testing to check for vulnerabilities and undesired behaviours, expert review, and verifying ethical compliance including bias assessments and algorithmic audits.

Contract Clauses

Contract terms for data science and AI projects should include clauses addressing identified risks through penalties for non-compliance, guarantee collection, early termination options or service level agreements, adapted to each public organization's institutional and contractual circumstances while respecting mandatory procurement base requirements under Chilean law.

Information and cybersecurity measures

Requires service providers to implement appropriate technical and organizational safeguards to prevent unauthorized access to procurement authority information, including data, metadata, and communications between provider and buyer. Providers must comply with the buyer's security policies and applicable Chilean standards on electronic document confidentiality, and institutions must determine security requirements based on the type of data involved.

Security incident notification

Requires providers to notify the buyer within 2 hours of discovering any unauthorized access to public entity data or systems, investigate the incident, and take reasonable measures to mitigate damage. Providers are responsible for maintaining accurate contact information for entity administrators, and the buyer must also notify the provider of any unauthorized use of credentials or related security incidents, with such notification not constituting admission of liability.

Data protection impact assessment

Requires providers to deliver an impact assessment identifying risks to individuals whose data will be processed, following international methodologies. The assessment must include descriptions of data operations, compliance analysis against data protection laws, security threat assessment, inappropriate use scenarios, staff training documentation, and risk analysis with mitigation recommendations.

Data processing by mandate

Establishes a framework whereby providers process personal data on behalf of the public entity, limited to the stated purpose and specified data types. Providers must safeguard data confidentiality, implement buyer-mandated security measures, return and securely destroy data after contract termination, notify the buyer of incidents within 2 hours, and are prohibited from subcontracting without explicit authorization or using data for purposes other than those specified.

Exploratory data analysis

Requires providers to conduct exploratory analysis of training data identifying sources, uses, and possible biases, occurring during data preparation phase. The analysis must evaluate quality, integrity, currency and consistency; assess representativeness across relevant demographic groups; identify anomalies and missing data; and for generative AI solutions, verify that sources are official, current and citable with appropriate licenses and metadata.

Bias analysis in models

Requires providers to evaluate model options using agreed standards including fairness metrics by relevant population subgroups, with results reporting, cause analysis, and mitigation proposals for traditional data science; and testing with diverse user profiles, source verification, and appropriate content measurement for generative AI. Selected models must meet agreed fairness thresholds or include an accepted improvement plan with periodic reevaluation mechanisms.

Transparency and explainable AI requirement

Public sector agencies acquiring custom-developed AI or data science systems must require providers to deliver the source code through a private version control repository, including data preparation scripts, system configurations, prompts, security rules, and trained model parameters; and must obtain model documentation covering objectives, data sources, selection criteria, performance and fairness metrics, evaluation results, known limitations, and risks. Providers must deliver a model card following standards such as Model Cards for Model Reporting, the Transparency Sheet, or equivalent standards; buyers may require mechanisms to explain how AI or data science systems reach decisions through global or local explanations and counterfactual reasoning, using tools such as LIME, SHAP, or What-if tool for black-box models.

Algorithmic audit requirement

Contracting agencies may request algorithmic audits by independent auditors to verify provider compliance, particularly for machine learning algorithms handling large datasets including personal and sensitive data, to detect bias and performance problems in protected groups under anti-discrimination law; providers must supply technical transparency and process transparency information, and must remedy identified defects within agreed timeframes or face breach of contract.

Algorithmic impact assessment

Requires the provider to conduct impact analysis before implementing an AI system to identify and reduce negative effects on people's rights, fairness and public interest, including identifying affected groups, discrimination risks, mitigation measures and ongoing monitoring during operation.

Confidentiality

Providers and their staff must keep confidential all information accessed during contract performance, including personal data, classified information, trade secrets, model configurations and interaction logs. For generative AI solutions, providers cannot use buyer data to train or improve models without written permission, and unauthorized disclosure can trigger legal action during the contract or up to five years after, or indefinitely for personal data.

Technical glossary

Glossary references

Related documents

This guideline must be interpreted consistently with public procurement legislation and administrative case law, as well as with technical guides and purchasing directives issued by ChileCompra. The section lists five reference resources covering ethical data science project formulation, responsible AI use in public policy, national AI policy, algorithmic transparency, and guidance on developing innovative data science projects in government.

Distribution