The AI Tender Workflow

Set AI up once — with your reference material as a standing base — so every tender analysis is fast, safe, and comprehensive. Two prompts to copy, below.

Two paths — the trust boundary decides

Path A · Set up a Project (consumer web UI)

A Project (Claude Projects, ChatGPT Projects, Gemini Gems) is a chat workspace with its own reference docs + standing instructions. Set it up once; every tender chat inside inherits the base.

1. Create the Project — call it "BMS Tender Response".
2. Upload your Vault as the Project's reference docs — buckets 1–3 of the Tender-Prep Kit (product-capability matrix, posture/anchor library, CCoP map, 7 Pillars). No live client data here.
3. Paste the standing instructions (below) into the Project's custom-instructions box.
4. Per tender: anonymise first (Path B), start a new chat inside the Project, paste the de-identified tender, ask it to triage + set a posture per clause against your Vault.

You are helping a Mitsubishi Electric BMS salesperson respond to building tenders.
Use the reference documents in this Project as ground truth about our products,
our standard postures (anchors), and the CCoP / 7-Pillars / IEC 62443 mappings.

For any tender I paste:
  1. Triage every cybersecurity clause: Must-have / Nice-to-have / Risky red-herring.
  2. Set a posture per clause: Comply / Not-comply (+ a better alternative) / Clarify / N/A,
     each with a one-line rationale that CITES the relevant reference doc.
  3. Flag any clause that is indefensible to "Comply" to, contradicts itself, or is a
     drafting slip.

Rules:
  - Ground every "Comply" in a product capability or an anchor from the reference docs.
    If it isn't supported there, say "Not supported in refs - [UNVERIFIED]", don't invent it.
  - Never use a forbidden phrasing (100% secure, CCoP-certified product, "mandatory" to a
    non-CII client).
  - You draft and compare; I set the final posture and sign it.
Always show your plan first and wait for my "go" before drafting the full response.

Path B · Anonymise — the safe bridge

Have a private agent? Paste the raw tender into your Co-Work / own Claude Code instance and run the prompt below; take the clean extract to your consumer Project. No private agent? Anonymise by hand — find-and-replace the client name, authority, reference number, project name and address — before pasting anywhere.

Here is a real client tender. Produce a DE-IDENTIFIED, exportable extract I can safely
analyse in a consumer AI tool.

Do this:
  - Replace the client/authority name with "[CLIENT]", the project name with "[PROJECT]",
    the contract/tender reference with "[REF]", and any address/site name with "[SITE]".
  - Remove names of individuals, phone numbers, and emails.
  - KEEP the clause numbers and the full clause text (they carry no identity).
  - KEEP the sector/building type in generic form (e.g., "a healthcare + data-hall building")
    because it drives whether CCoP applies.
Output ONLY the cleaned extract, clause by clause, ready to copy. Then list, separately,
every substitution you made so I can verify nothing identifying slipped through.

Then verify the substitution list by eye before the extract leaves your control.

The per-tender flow

1. Anonymise → clean, exportable extract.
2. New chat inside your Project → paste the extract.
3. "Triage + set a posture per clause, using my reference docs."
4. Verify every posture by hand — especially every "Comply" and anything it sounds too sure about (the Eloquence Trap).
5. Transcribe verified postures into your Posture Ledger on the client's own file.

Take-home

Practise the analysis step on the fictional tender → bms.ethanseow.com/practice-tender.html