AnswerVault for Central Government

Departmental knowledge is scattered across systems that can't see each other

A policy officer needs the current guidance on a casework decision. The authoritative version sits in a SharePoint library three teams maintain differently; an older copy is pinned in a Teams channel; a PDF that may or may not be superseded is attached to an email from last spring. No one is certain which version a tribunal, an ombudsman, or a select committee would accept as the department's settled position. This is the daily reality of knowledge work across central government, and it is the problem AI is now expected to solve without introducing a new one.

The obstacle is rarely the technology. A department can see the value of letting staff get an accurate, source-backed answer instead of hunting across four systems. The obstacle is that a public body cannot adopt AI the way a private firm can: it has to buy through an approved route, satisfy a security and data-handling regime that most commercial AI tools were never designed for, and answer the sovereignty question before any other. Procurement, assurance, and jurisdiction are where adoption succeeds or stalls.

What central government has to satisfy before it can buy AI

Three things have to line up before a department can put a governed AI knowledge tool into service. They are independent, and a tool can clear one while failing another.

The full procurement-route detail, including when a G-Cloud call-off fits better than a dynamic purchasing system and how to keep an award defensible, is in our guide to AI knowledge management for the UK public sector. AnswerVault, a governed AI knowledge layer, is listed on G-Cloud, which is what makes it directly buyable through this route.

Why most AI tools don't clear the bar

The gap rarely shows in a demo. It shows in the data-handling assessment and the procurement file, and it fails in predictable places.

• No version-controlled source of truth. General-purpose AI search answers from whatever it can index, with no concept of an approved, current version. For a body that may have to defend a decision against the guidance as it stood at the time, an answer drawn from a superseded document is a liability, not a convenience.
• No defensible audit trail. Freedom of Information requests, tribunal evidence, and public-records duties all demand that a department can show which document an answer came from and when. A tool that produces a confident summary but cannot evidence its source fails the duty.
• Residency mistaken for sovereignty. Selecting a UK region addresses data residency, where data physically sits. It does not address data sovereignty, whose laws can compel access. Many tools achieve UK residency for documents at rest while sending the actual AI inference to a US-controlled model.
• Permission flattening. Government content carries classifications and need-to-know boundaries. A tool that ignores the source systems' permission model and answers from everything it can reach breaks those boundaries.

The jurisdiction point narrows a shortlist most sharply. The US CLOUD Act (2018) compels US-headquartered companies to produce customer data on demand, regardless of where it physically sits, because the Act follows corporate control rather than data location. For a department handling citizen data, casework, or classified material, that residual exposure is a legitimate procurement concern. AnswerVault answers it with a UK-controlled Enterprise sovereign tier, described below; the standard tiers run on AWS and the Act applies to them, which a business case should state plainly. The residency-versus-sovereignty distinction is unpacked in full in our sovereign AI guide.

How AnswerVault fits central government

AnswerVault is a governed AI knowledge layer that connects an organisation's existing document sources, including SharePoint, Google Drive, and Confluence, and delivers accurate, source-backed answers through web chat, Microsoft Teams, Slack, CLI, and API. It was originally built for a global pharmaceutical company with strict data governance requirements, and the same architecture answers the audit, version-control, and jurisdiction demands of government knowledge work.

The central artefact is the audit trail. A document does not become answerable because it sits in a connected library; it becomes answerable because a named owner approves it as the current, authoritative version, with that approval written into the record. When guidance is superseded, the old version stops being used for answers and the change is preserved, so the question "which version was the department's settled position on this date, and who approved it" has an answer a tribunal or an ombudsman can read. Answers are cited at the sentence level, and the platform respects the existing permission and classification model of the connected sources rather than flattening it.

On jurisdiction, the department should match the tier to the data. The standard tiers provide UK or EU data residency on AWS infrastructure; the Enterprise sovereign tier is UK-controlled, with the AI processing layer inside the sovereign boundary, for the material whose classification or citizen-data sensitivity makes jurisdiction a procurement-blocking concern. AnswerVault is ISO 27001 aligned and ISO 42001 underway, AI is included in every plan with no per-query charges or separate model keys required, and customer data is never used to train AI models. The detail a data-handling assessment needs, including hosting, subprocessors, attestations, and audit rights, is on our security and compliance page for direct reference in a framework assessment.

What the data-handling assessment will ask

By the time a governed AI knowledge tool reaches a department's procurement and information-assurance teams, there is a standard set of questions. A tool built for government work should answer all of them in the assurance pack, not a sales deck.

• Where does the AI processing run, and under whose jurisdiction? If any inference step is US-controlled, the department has to accept or document the residual CLOUD Act exposure. The Enterprise sovereign tier keeps the processing layer inside a UK-controlled boundary for the material that needs it.
• Can you produce the approved source set as it stood on a given date? Defensible casework requires the platform to know which documents were eligible to answer from on a specific day, and who approved each of them.
• Are answers cited at the sentence level? FOI responses and tribunal evidence need a clause-by-clause link to a specific document and version, not a citation block appended to a summary.
• Does it respect our classifications and need-to-know boundaries? The platform reads the permission model of the connected sources rather than flattening it, so a query cannot surface content the user could not already open.
• Who are the subprocessors, and what is the exit path? Any third-party model the AI tier depends on has to be named and assessable, and the department needs a clean route to recover its data, both documented on the security and compliance page.
• Is customer data used to train models? It is not, by AnswerVault or by the underlying providers, and that belongs in the contract rather than the conversation.

Where departments put it to work

• Policy and guidance lookup. Caseworkers and policy staff get an answer from the latest approved guidance, with a citation, instead of acting on a stale copy or queuing for a subject-matter expert.
• Casework consistency. The same question returns the same approved answer across teams and over time, which is the foundation of defensible, consistent decisions.
• FOI and records support. When a request or a review asks how a position was reached, the department can produce the source set, the approver, and the per-answer citation rather than reconstructing it after the fact.
• Onboarding and continuity. New and rotating staff self-serve from the institutional record instead of depending on the colleague who remembers, and the knowledge stays in the indexed source when people move on.

In government the conversation usually starts with the procurement route, the assurance regime, and the sovereignty constraint, not the AI features, and that is the right order. If you are scoping AI knowledge for a department or an arm's-length body, the most useful first step is to write the requirement in capability terms, decide the sovereignty tier the data actually demands, and confirm the supplier is on a framework you can award through. Book a scoping call and we'll work through it, or compare tiers on the pricing page.