The public sector, answered in full.

Not yet, in the sense a department would mean by it. Almost none of Tenhaw's work is public sector. Our evidence here is delivery-transformation exposure to public sector programmes through a supplier, not agentic delivery to a department: at Tecknuovo, a consultancy, we built a centralised portfolio management office from nothing over nine months and ran it live across 19 projects, including engagements delivering to HMRC, the MOD and Thames Water, while coaching the junior delivery leads who took it over. Tecknuovo's own teams delivered those projects. Our work was the office that made them visible, comparable and manageable. Nothing in that portfolio was a model and we make no AI governance claim from it. If you want a supplier who has taken an agentic system through a department's own assurance, we are not that supplier today.

Strictly, nothing: the standard binds the organisation, not the supplier. In practice it decides what a supplier has to produce. The standard is mandatory for central government departments and for arm's length bodies that deliver public services or engage directly with the public, and it asks for a published record of what the algorithmic tool is, why the organisation is using it, how it works, the data behind it and the human oversight around it. That means the facts have to exist inside delivery: purpose, data sources, models and versions, human oversight points and named owners, all current rather than as at launch. The test to apply to a supplier is simple. Ask whether their build produces those fields as outputs, and what happens to the published record when a prompt or a retrieval corpus changes next month.

It depends on whether the decision is significant and whether a human is meaningfully involved. Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D. A significant decision is one with a legal effect or a similarly significant effect on the person, and whether it counts as solely automated turns on meaningful human involvement, judged including by how far the decision is reached through profiling. Where there is no meaningful human involvement, safeguards are required: information about the decision, the ability to make representations, human intervention by the controller and the ability to contest the outcome. Special category data narrows it further, needing explicit consent or a specific legal footing. The design consequence is that a caseworker with a recommendation, a score and a handling time target is probably not meaningful involvement, so the reviewer has to see the evidence, be able to disagree, and have that disagreement recorded. Tenhaw is not your DPO and this is not legal advice.

Through the same routes as other digital work, and the route shapes the engagement. G-Cloud 14 (RM1557.14) is a catalogue for cloud hosting, cloud software and cloud support. Digital Outcomes and Specialists 7 (RM1043.9) went live on 30 January 2026 as an open framework under the Procurement Act 2023, with four lots covering digital outcomes, capability and delivery partners, specialists, and user research, and it requires a further competition rather than a direct award. Both are run by the Government Commercial Agency, which Crown Commercial Service became on 1 April 2026. Over the top sits the Digital, Data and Technology Playbook, which asks for outcome-based specifications and a delivery model assessment on a comply or explain basis. The practical advice is to settle the route before the design, because an outcomes lot and a specialists lot produce different teams, different pricing and different evidence.

Most Cabinet Office spend controls ceased as a requirement on 1 April 2026, with the advertising, marketing and communications control the exception. Digital and technology assurance did not end with them: it moved to the Digital Assurance Playbook, published by the Department for Science, Innovation and Technology on the same date, under which organisations design their own assurance across three levels, operational, senior management and independent review, and still share a forward pipeline of digital and technology spend above £5 million whole life cost, with a £0 threshold for cryptographic products. For AI specifically, assurers are asked to check that the initiative follows the AI Playbook for the UK Government. So the gate is now inside your organisation rather than in the centre, it is not identical between departments, and a delivery plan that has not mapped it is planning against a process that no longer exists.

Five things, all of which should exist before a contract is signed. Which decisions the agent may take and which need a human, written down as an inventory rather than described in a workshop. Where the human sits, what they see at that point, and how their disagreement is recorded, because meaningful human involvement is a design property and not a claim. How the transparency record will be produced and kept true when prompts, corpora and model versions change. What the system emits as evidence while it runs, as opposed to what can be reconstructed from logs afterwards. And what happens on exit: whose the prompts, evaluation sets and retrieval corpora are, and what breaks if the model provider changes its terms. Ask every supplier, us included, which of those they have done inside a department and which they have only designed.

No. Tenhaw has not delivered an agentic system inside a government department, and we have not produced an Algorithmic Transparency Recording Standard record on a live engagement. Our agentic evidence is proofs of concept: an AI voice-insights proof of concept at HSBC, and a live specialty insurance engagement running a two-week proof of concept into a team standing up to productionise it. Our public sector evidence is the Tecknuovo portfolio office, which is delivery-transformation exposure to public sector programmes through a supplier, not agentic delivery to a department.