AnswerVault for Central Government

Departmental knowledge is scattered across systems that can't see each other

A policy officer needs the current guidance on a casework decision. The authoritative version sits in a SharePoint library three teams maintain differently; an older copy is pinned in a Teams channel; a PDF that may or may not be superseded is attached to an email from last spring. No one is certain which version a tribunal, an ombudsman, or a select committee would accept as the department's settled position. This is the daily reality of knowledge work across central government, and it is the problem AI is now expected to solve without introducing a new one.

The obstacle is rarely the technology. A department can see the value of letting staff get an accurate, source-backed answer instead of hunting across four systems. The obstacle is that a public body cannot adopt AI the way a private firm can: it has to buy through an approved route, satisfy a security and data-handling regime that most commercial AI tools were never designed for, and answer the sovereignty question before any other. Procurement, assurance, and jurisdiction are where adoption succeeds or stalls.

What central government has to satisfy before it can buy AI

Three things have to line up before a department, agency, or arm's-length body can put a governed AI knowledge tool into service. They are independent, and a tool can clear one while failing another.

The full procurement-route detail, including when a G-Cloud call-off fits better than a dynamic purchasing system and how to keep an award defensible, is in our guide to AI knowledge management for the UK public sector. AnswerVault, a governed AI knowledge layer, is listed on G-Cloud, which is what makes it directly buyable through this route.

Agencies and arm's-length bodies: the same route, their own accountability

Much of central government's operational knowledge work sits outside the ministerial departments, in executive agencies, non-ministerial departments, and non-departmental public bodies (NDPBs). These arm's-length bodies (ALBs) run the casework, licensing, inspection, and regulatory functions where staff most often need the current approved answer, and they buy AI under the same constraints as their sponsor department, with two differences that shape the purchase.

• They buy through the same frameworks. G-Cloud and the other Crown Commercial Service (CCS) frameworks are open to agencies and ALBs as well as departments, so an ALB can award directly without waiting for a departmental contract to cover it.
• They carry their own accountability. An ALB typically has its own board and its own accounting officer, answerable for how it spends public money and handles its records, while working within a framework agreement set by its sponsor department. The assurance case has to satisfy both: the ALB's own governance and the sponsor department's expectations, including any central digital spend controls that apply.
• Their knowledge is often the most heavily scrutinised. Regulatory decisions, inspection findings, and licensing outcomes are challenged through appeals, tribunals, and judicial review, so the "which guidance applied on this date, and who approved it" question is sharper for an ALB than for most policy teams.

That last point is where a governed knowledge layer earns its place. An ALB can approve its own source set, keep it separate from the sponsor department's material, and still evidence every answer back to a named, versioned document.

Why most AI tools don't clear the bar

The gap rarely shows in a demo. It shows in the data-handling assessment and the procurement file, and it fails in predictable places.

• No version-controlled source of truth. General-purpose AI search answers from whatever it can index, with no concept of an approved, current version. For a body that may have to defend a decision against the guidance as it stood at the time, an answer drawn from a superseded document is a liability, not a convenience.
• No defensible audit trail. Freedom of Information requests, tribunal evidence, and public-records duties all demand that a department can show which document an answer came from and when. A tool that produces a confident summary but cannot evidence its source fails the duty.
• Residency mistaken for sovereignty. Selecting a UK region addresses data residency, where data physically sits. It does not address data sovereignty, whose laws can compel access. Many tools achieve UK residency for documents at rest while sending the actual AI inference to a US-controlled model.
• Permission flattening. Government content carries classifications and need-to-know boundaries. A tool that ignores the source systems' permission model and answers from everything it can reach breaks those boundaries.

The jurisdiction point narrows a shortlist most sharply. The US CLOUD Act (2018) compels US-headquartered companies to produce customer data on demand, regardless of where it physically sits, because the Act follows corporate control rather than data location. For a department handling citizen data, casework, or classified material, that residual exposure is a legitimate procurement concern. AnswerVault answers it with a UK-controlled Enterprise sovereign tier, described below; the standard tiers run on AWS and the Act applies to them, which a business case should state plainly. The residency-versus-sovereignty distinction is unpacked in full in our sovereign AI guide.

How AnswerVault fits central government

AnswerVault is a governed AI knowledge layer that connects an organisation's existing document sources, including SharePoint, Google Drive, and Confluence, and delivers accurate, source-backed answers through web chat, Microsoft Teams, Slack, CLI, and API. It was originally built for a global pharmaceutical company with strict data governance requirements, and the same architecture answers the audit, version-control, and jurisdiction demands of government knowledge work.

The central artefact is the audit trail. A document does not become answerable because it sits in a connected library; it becomes answerable because a named owner approves it as the current, authoritative version, with that approval written into the record. When guidance is superseded, the old version stops being used for answers and the change is preserved, so the question "which version was the department's settled position on this date, and who approved it" has an answer a tribunal or an ombudsman can read. Answers are cited at the sentence level, and the platform respects the existing permission and classification model of the connected sources rather than flattening it.

On jurisdiction, the department should match the tier to the data. The standard tiers provide UK or EU data residency on AWS infrastructure; the Enterprise sovereign tier is UK-controlled, with the AI processing layer inside the sovereign boundary, for the material whose classification or citizen-data sensitivity makes jurisdiction a procurement-blocking concern. Catapult CX Ltd, AnswerVault's operating entity, is certified to ISO 27001. AI is included in every plan with no per-query charges or separate model keys required, and customer data is never used to train AI models. The detail a data-handling assessment needs, including hosting, subprocessors, attestations, and audit rights, is on our security and compliance page for direct reference in a framework assessment.

What the data-handling assessment will ask

By the time a governed AI knowledge tool reaches a department's procurement and information-assurance teams, there is a standard set of questions. A tool built for government work should answer all of them in the assurance pack, not a sales deck.

• Where does the AI processing run, and under whose jurisdiction? If any inference step is US-controlled, the department has to accept or document the residual CLOUD Act exposure. The Enterprise sovereign tier keeps the processing layer inside a UK-controlled boundary for the material that needs it.
• Can you produce the approved source set as it stood on a given date? Defensible casework requires the platform to know which documents were eligible to answer from on a specific day, and who approved each of them.
• Are answers cited at the sentence level? FOI responses and tribunal evidence need a clause-by-clause link to a specific document and version, not a citation block appended to a summary.
• Does it respect our classifications and need-to-know boundaries? The platform reads the permission model of the connected sources rather than flattening it, so a query cannot surface content the user could not already open.
• Who are the subprocessors, and what is the exit path? Any third-party model the AI tier depends on has to be named and assessable, and the department needs a clean route to recover its data, both documented on the security and compliance page.
• Is customer data used to train models? It is not, by AnswerVault or by the underlying providers, and that belongs in the contract rather than the conversation.

Where departments and agencies put it to work

• Policy and guidance lookup. Caseworkers and policy staff get an answer from the latest approved guidance, with a citation, instead of acting on a stale copy or queuing for a subject-matter expert.
• Casework consistency. The same question returns the same approved answer across teams and over time, which is the foundation of defensible, consistent decisions.
• FOI and records support. When a request or a review asks how a position was reached, the department can produce the source set, the approver, and the per-answer citation rather than reconstructing it after the fact.
• Onboarding and continuity. New and rotating staff self-serve from the institutional record instead of depending on the colleague who remembers, and the knowledge stays in the indexed source when people move on.

In government the conversation usually starts with the procurement route, the assurance regime, and the sovereignty constraint, not the AI features, and that is the right order. If you are scoping AI knowledge for a department or an arm's-length body, the most useful first step is to write the requirement in capability terms, decide the sovereignty tier the data actually demands, and confirm the supplier is on a framework you can award through. Book a scoping call and we'll work through it, or compare tiers on the pricing page.