Procurement Cycle

The procurement cycle is the full sequence a purchase passes through inside an organisation: identifying a need, finding candidates, evaluating them, clearing security and legal review, obtaining budget approval, signing, and finally provisioning. For a small tool it can be an afternoon. For anything touching customer data at a company of any size, it is a process with several independent queues, and the elapsed time is dominated by waiting rather than working. Understanding where the queues are is what makes the cycle shorter. Security review waits on a completed questionnaire and supporting evidence. Legal waits on a redline exchange, which waits on whichever side has the more inflexible template. Finance waits on a budget line and an approval chain that may be seasonal. Data protection waits on knowing exactly what personal data flows where. None of these steps is long in itself; they are long because each begins only when the previous one finishes and someone remembers to start it. The single largest saving is running the reviews in parallel and starting them early. A security questionnaire can be sent while the trial is still running. A data-flow description can be written before legal is engaged. A vendor's standard terms can be read by legal while the evaluation continues, so the redlines are known rather than discovered. This costs a little wasted effort on tools you end up rejecting and routinely removes weeks from the ones you buy. Buyers underestimate how much of the delay they cause themselves. Vendors are frequently blamed for a slow cycle when the actual bottleneck was an internal approval nobody had identified, a security team that never received the questionnaire, or a requirement discovered late because the eventual users were not consulted at the start. Writing the path down once, with named owners and typical durations, turns an unpredictable process into a schedule. AI purchases add steps that traditional software does not. Where inference happens and under whose control. Whether prompts and outputs are retained or used for training. Whether the vendor's own subprocessors change the jurisdictional picture. What happens when the underlying model is deprecated. These questions often need an answer from someone who does not normally sit in procurement, and identifying that person at the start rather than the end is worth more than any negotiation tactic. The end of the cycle deserves as much attention as the start. A signed contract that nobody provisions, assigns an owner, or records a renewal date for is the beginning of shelfware and of the renewal that arrives as a surprise. Closing the loop — owner, budget code, renewal date, review date — is what makes the next cycle shorter than this one.