Ghana put every public AI purchase behind one technical gate

THE SIGNAL IN ONE SENTENCE

Ghana has decided that a public institution should not be able to buy an AI system as if it were ordering another office printer. Every AI acquisition across the public sector is now meant to pass through a central technical review. Samuel Nartey George, Ghana's Minister for Communication, Digital Technology and Innovations, announced the mechanism at the U.S. Embassy AI Forum in Accra. Ghana's Information Services Department published the details on October 2. The ministry will coordinate the technical requirements. The National Information Technology Agency, commonly called NITA, will lead technical scoping for proposed systems. Existing public procurement law still applies. The new review is supposed to sit beside that process rather than replace it. The government named five areas every acquired system will be assessed against: interoperability, data protection, cybersecurity, sustainability and mandatory local skills transfer. That list is the story. The plain signal is that AI governance often becomes real at the purchase order. A national strategy can promise sovereignty. A procurement specification decides whether a hospital can retrieve its data, whether a ministry can change suppliers, whether an outside company must train local staff, whether a model update receives another test and who gets called when the system fails. Ghana is trying to move those questions to the front door. The mechanism forms part of the country's eight-pillar National Artificial Intelligence Strategy, launched in April. The strategy identifies finance, agriculture, fisheries, education, health and communications for phased AI adoption. Those are not harmless demonstration zones. An AI system in finance can affect credit, fraud investigations and public revenue. An agriculture system can shape advice about crops, inputs and weather. A health tool can influence triage or access to care. A system used in education can affect learning materials, assessment and student data. The state therefore has more to buy than software. It is buying an operating relationship. The supplier may host the model, store prompts, change the system, subcontract parts of the service, set the export format and decide how long technical support continues. The public agency may own the data while lacking a practical way to remove it. It may receive an application without the documentation, evaluation suite or trained staff needed to run it independently. That is vendor lock-in with a helpful dashboard. Central review can make the government a more disciplined buyer. Interoperability requirements can force vendors to use documented interfaces and exportable formats instead of building a beautiful cul-de-sac. Data-protection review can require a clear inventory of what enters the system, where it goes, how long it stays and which other organizations can reach it. Cybersecurity review can test identity, permissions, incident response and the supply chain behind the visible product. Sustainability can mean more than asking whether a model has an environmental brochure. The review can require expected computing demand, hosting location, energy use, hardware life, network cost and a plan for a smaller model when the largest one is unnecessary. Local skills transfer may be the most important line and the easiest to fake. A contract can promise training and deliver three webinars, a glossy certificate and one afternoon with a sales engineer. Meaningful transfer looks different. Ghanaian technical staff receive architecture documents, deployment access, test procedures, incident practice and enough authority to operate, challenge, repair or replace the system. The useful question is not how many people attended a session. It is what they can do after the supplier leaves the room. Can the public team reproduce the acceptance test? Can it investigate a bad output? Can it rotate credentials, change a data source and verify a model update? Can it export records in a usable form? Can it run a competitive replacement process without starting again from an empty folder? If the answer is no, skills transfer has become another line item that photographs well. The central gate also creates its own risks. One technical review can reduce duplicated mistakes across ministries. It can also become a slow queue, a political choke point or a checklist that approves familiar vendors faster than smaller local firms. Ghana's announcement does not publish the directive itself, the full assessment rubric, the review staff, service deadlines, appeal process, waiver rules or decisions already made. It does not say whether emergency purchases receive a separate route or whether local companies receive practical support to meet the same standards as multinational suppliers. Those details decide whether centralization produces leverage or paperwork. The review needs a visible operating ledger. For each proposed acquisition, the government could publish the public purpose, responsible institution, risk level, data categories, hosting arrangement, interoperability plan, security conditions, local-capacity commitments and final decision. Sensitive security details can remain protected without hiding the existence of the review or the reasons behind a public purchase. The ledger should also show waivers. If one system is allowed to keep data in a proprietary format, use foreign hosting or skip an ordinary requirement, the exception needs a named authority, reason, duration and corrective plan. Otherwise the rule will be strongest on paper precisely where the largest contract is asking to bend it. Review before purchase is not enough. AI services change after the contract is signed. Models are replaced. Safety settings move. Subprocessors change. Costs grow with use. A vendor may introduce agent features that can take actions instead of only providing answers. The approved system can therefore become a different system without a new procurement ceremony. Every contract should define which changes trigger another review. A new model version, new data category, new automated decision, new external tool or new hosting location should not arrive through ordinary release notes when the original approval depended on the earlier boundary. The government also needs an exit test. Before a system is accepted, the agency should demonstrate that it can retrieve its data, preserve required records, transfer the workflow and shut down the vendor's access. The safest time to test an exit is while the supplier still wants the contract. This matters for sovereignty because local control is not the same as local storage. A database can sit inside Ghana while its keys, model, support contract and essential interfaces remain controlled elsewhere. A foreign service can sometimes be operated under strong Ghanaian rules. A locally branded platform can still trap the state in undocumented components. Control is a bundle of practical rights: inspect, test, correct, export, interrupt, replace and hold somebody accountable. The October 2 announcement connects the review mechanism to larger infrastructure plans. Ghana is investing in an AI Compute Centre and upgrades to the National Data Centre. The government says the One Million Coders Programme has recorded more than 141,950 registrations. A planned 10-year National AI Delivery Framework is intended to guide implementation and make international partnerships contribute to local capacity. Those are commitments and programme figures, not proof that the procurement gate already works. The compute centre, upgrades and delivery framework remain future-facing in the announcement. Registration in a skills programme does not show completion, employment or technical readiness. A list of review benchmarks does not show that a contract has been rejected, repaired or made portable. That evidence should come next. The first useful case study would be boring in exactly the right way. A ministry proposes a system. The review identifies that records cannot be exported and the vendor's security documentation is incomplete. The supplier changes the interface, adds an incident clause, names the Ghanaian team that will receive operational training and agrees to a retest after the next model update. The government publishes the conditions and later reports whether they were met. That is what a working gate looks like. It does not merely stop technology. It improves the deal before public money and public data cross the line. Citizens need a route into the process too. Technical review can test systems, but it does not automatically answer whether a use is legitimate. A perfectly interoperable system can still make an unfair decision. A secure model can still be deployed where a person deserves explanation, appeal or a human decision. Local operation can still reproduce discrimination found in local records. For high-impact uses, the procurement file should connect to a public impact assessment, affected-community consultation, complaint route and named human authority. People should know when AI materially influences a public service and how to challenge the result. The central review is therefore a floor, not the whole building. Ghana has made a smart move by treating purchasing power as policy power. A government buying across several ministries can demand documentation, portability and training that one small agency might struggle to negotiate alone. The next test is whether the gate leaves receipts. Publish the rule. Publish the rubric. Publish the decisions and waivers. Test the exit before signing. Recheck the system when it changes. Measure whether local teams can operate it and whether people receiving public services can challenge it. Then data sovereignty will mean more than keeping the server nearby. It will mean Ghana can still steer the system after the invoice is paid.