SURF Procurement & Contracting assists members in the responsible use of AI and negotiates sector-level agreements with AI suppliers. These agreements cover product features, privacy guarantees and purchasing conditions, including price. Current efforts include Google Gemini, IBM WatsonX, Microsoft Copilot for M365 and OpenAI ChatGPT Edu.

At the end of 2024, SURF Procurement & Contracting conducted a Data Protection Impact Assessment on Microsoft Copilot for M365. This revealed high risks. The education sectors share the view that no institution should purchase Microsoft 365 Copilot on a large scale until Microsoft has eliminated these high privacy risks. Small-scale purchases – the purchase of a limited number of licences – by each institution are possible for institutional use in pilot form. SURF is also organising pilots for the other products mentioned above and is working on a balanced offering with AI services developed by the sector and a mix of larger and smaller providers from the market to guarantee the sector's autonomy.

SURF Procurement & Contracting coordinates the Data Protection Impact Assessment (DPIA) for the (future) EduGenAI platform. An initial DPIA was carried out at the start of the development phase, resulting in 12 low risks being identified as development goals. View the full DPIA report from early September 2025 on the SURF Vendor Compliance website.