The real objective
NCIA’s consultation shows that NATO is no longer looking only for tools that find more information. It is looking for an infrastructure that can organise analytic work at Alliance scale.
Artificial intelligence is important, but it remains a processing layer. The decisive value will come from source quality, analyst protection, interoperability, logging, governance and the method used to move from an observed signal to a justified conclusion.
An AI system can produce an answer in seconds. An intelligence capability must show why that answer deserves to be trusted.
Further work on artificial intelligence, augmented analysis and analytic method is available through Exmergere https://www.exmergere.info.
In fact, NATO’s future Open Source Intelligence capability will be far more than a search engine enhanced with artificial intelligence. Documents released by the NATO Communications and Information Agency, NCIA, describe an end to end intelligence production environment. It must support non attributable research, collection of public and commercial data, detection of emerging signals, analysis of text, images and video, collaboration among teams, report production and full recording of the operations performed.
The proposed architecture reveals an important shift. NATO does not necessarily want to build a completely new analytic platform on its own. It wants to integrate proven commercial services that can evolve with the market. Artificial intelligence is becoming a capability that can be bought, connected, evaluated, replaced and supervised.
Industrialising AI does not, however, solve the central problem of intelligence analysis. A machine can summarise more quickly, translate more languages and expose relationships that are difficult to see manually. It cannot guarantee that the underlying sources are reliable, that the relevant hypotheses have been considered, that a correlation is meaningful or that the final judgement will survive scrutiny.
The real strategic capability will therefore lie in the connection between technology, data governance and analytic method.
A market consultation, not yet a competition
On 23 October 2026, NCIA issued a market engagement notice under reference IFB CO 424330 OSINT. Written responses are due by noon Central European Time on 4 November 2026. Industry can also contribute during an OSINT Data Exploitation and Visualization Workshop at NATO Edge 26, held in Izmir from 17 to 19 November.
This is not yet a request for bids. Its purpose is to understand the market, available capabilities, acquisition options, industrial risks and conditions for effective competition. NCIA may incorporate industry comments into a future solicitation.
The invitation for bids is expected by the first quarter of 2027. Delivery of the capability to NATO analysts is targeted from the first quarter of 2028. No estimated contract value has been published. The schedule and requirements may still change because the technical problem statement is explicitly marked as a draft. Official NCIA opportunity https://www.ncia.nato.int/business/procurement/current-opportunities/424330-2 Calling notice and draft problem statement https://www.ncia.nato.int/systems/file_download.ashx?pg=2899&ver=1
Only companies from NATO member countries may respond or participate in the workshop.
A common capability for about 820 analysts
The platform is intended to support approximately 820 users across three access levels.
Around 400 generalist analysts would receive managed attribution capabilities. About 300 fusion analysts would also gain access to alerts generated from publicly and commercially available information. A further 120 trained OSINT specialists would use the more advanced tools and services.
This structure shows that NATO is not planning unrestricted access to every function. Access will reflect roles, competence and operational risk. The platform will therefore be a system for governing analytic activity as well as a system for processing information.
Managed attribution comes before artificial intelligence
The first capability described in the draft is managed attribution.
An analyst browsing the Internet leaves more than a network address. Operating system language, keyboard layout, browser configuration, screen properties, time zone, installed fonts and other characteristics can identify a device or link separate sessions.
NCIA therefore wants an environment that can create a coherent digital presence. If a session appears to originate in a particular country, its language, keyboard, device profile and technical behaviour should support that identity. Protection must extend beyond a virtual private network and the removal of browser cookies.
This protects individual analysts and the wider operation. Poorly protected research can reveal NATO’s subjects of interest, alert a monitored actor or help an adversary place deceptive content in the analyst’s path.
Three functional layers
The proposed capability has three broad components.
The analyst environment
The user environment must include managed attribution, a secure unclassified OSINT site, collaboration facilities, report writing, querying, alerts and task management.
The secure site will support discussion, the sharing of tradecraft and the exchange of releasable information. Collaboration facilities must work within teams and across teams.
The reporting environment must provide automated summaries, formatting, translation, annotation and referencing. Task management must support the allocation of work, the movement of requests through the chain and quality review before release.
NCIA is therefore seeking more than a collection of analytic applications. It is seeking to digitise the intelligence production process from the initial question to the final product delivered to a decision maker.
The data layer
The intended source universe includes traditional media, blogs, forums, periodicals and grey literature. It also includes the deep web, the dark web, major and specialist social platforms, secure messaging, advertising technology data, connected device data, financial records, blockchains, cryptocurrencies, cached or deleted pages and cyber threat information.
The distinction between publicly available information and commercially available information matters. Modern OSINT increasingly depends on paid databases, specialised archives, commercial interfaces, data brokers and providers that maintain their own access agreements.
NCIA expects the future provider to integrate emerging sources as the information environment changes. This favours a modular architecture with stable interfaces and replaceable services.
It also creates significant legal and ethical questions. Advertising data, location information, connected devices and messaging platforms may involve personal data at scale. Collection and retention rules will therefore be as important as technical access.
The analytic layer
The requested functions include query design, automated summarisation, translation, transcription, screen capture, optical character recognition, synthetic media detection, named entity recognition, automatic classification, network analysis, automated geolocation, location extraction, heatmap production, anomaly detection and data enrichment.
Together, these functions create a multimodal analytic chain. A video could be transcribed, translated, searched for entities, associated with a location, compared with other sources and added to a relationship graph. Alerts could then be generated when the same person, place or pattern appears again.
The operational value lies in this combination. It also creates a need to preserve the history of every transformation. Otherwise, an analyst may see a compelling relationship without knowing which original evidence supports it.
One prime contractor, many specialist suppliers
NCIA is considering one main contract covering the entire capability. One prime contractor would integrate products and services supplied by several companies.
This gives NATO a clear point of contractual responsibility. It also places considerable power and responsibility in the integration layer. The prime contractor would need to manage interfaces, identities, permissions, logs, formats, product updates, cyber security controls and the behaviour of services owned by different suppliers.
NCIA is inviting responses from companies that address only part of the requirement. The agency wants visibility of strong specialist offerings before it defines the final structure of the competition.
The most revealing procurement objective is the intention to maximise participation by the data services market instead of operating a proprietary analytic platform. NCIA also wants to limit custom development and concentrate on proven commercial solutions.
This points toward a service based model. Transcription, synthetic media detection, geolocation or translation could be consumed as specialised services and replaced without rebuilding the entire platform.
Such modularity can reduce development risk. It can also create dependence on the prime contractor, proprietary formats, opaque models and usage based pricing. Meaningful control will depend on open interfaces, portable data, documented evaluation criteria and the ability to replace individual components.
Why the documented log matters
NCIA requires a documented log for all services. The stated purposes are security, monitoring, secure automation and orchestration.
A useful log should make it possible to reconstruct the source consulted, the collection time, the content version, the transformations applied, the service used, the model version, relevant parameters, the responsible user, human validation and the evidence incorporated into the final report.
This requirement directly supports NATO’s Principles of Responsible Use for artificial intelligence. These cover lawfulness, responsibility, accountability, explainability, traceability, reliability, governability and bias mitigation. NATO’s revised artificial intelligence strategy https://www.nato.int/en/news-and-events/articles/news/2024/07/10/nato-releases-revised-ai-strategy
It also supports NATO’s Data Exploitation Framework, which treats data as a strategic asset and calls for governed analytics, registered quality data, interoperability by design and appropriate handling of unattributed data. NATO Data Exploitation Framework Policy https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2022/11/23/summary-of-natos-data-exploitation-framework-policy
NATO’s Data Quality Framework gives particular importance to provenance and lineage. Provenance records where data came from, its context and its authenticity. Lineage records how it moved and changed. Both are necessary if analysts and decision makers are to understand the distance between original evidence and an automated output. NATO Data Quality Framework https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2025/08/29/data-quality-framework-for-the-alliance
Technical traceability is not analytic justification
A technically complete log does not explain an intelligence judgement.
Knowing that a model summarised twenty documents does not explain why those documents were selected. Recording the model version does not show whether an alternative hypothesis was rejected too early. Saving the output of a synthetic media detector does not prove that its confidence score was properly calibrated for the language, format and circumstances concerned.
The platform therefore needs two connected forms of traceability.
The first concerns systems and data. It records sources, transformations, models and user actions.
The second concerns reasoning. It records the intelligence question, the hypotheses considered, supporting and conflicting evidence, assumptions, information gaps, confidence and the indicators that could change the conclusion.
Without the second layer, NATO could obtain an information system that is technically auditable but analytically unaccountable.
Structured analysis as a control mechanism
AI is particularly effective at expanding collection, accelerating triage and suggesting relationships. It can also amplify biases in the underlying data or in the analyst’s original query.
A rigorous process should therefore distinguish source reliability from information credibility. It should separate observed facts, machine generated inferences and human judgements. It should require several plausible hypotheses before a preferred explanation is selected. It should actively search for missing information, contradictions and alternative explanations.
Analysis of competing hypotheses is especially relevant. It requires analysts to compare several explanations against the available evidence and to focus on evidence that weakens each explanation. Its main contribution is not certainty. It is a visible reasoning process that can be reviewed, challenged and updated.
The United Kingdom’s professional framework for intelligence assessment requires source evaluation, falsifiable hypotheses, structured analytic techniques, confidence judgements and a robust analytic audit trail. Professional Development Framework for intelligence assessment https://www.gov.uk/government/publications/intelligence-analysis-professional-development-framework/the-professional-development-framework-for-all-source-intelligence-assessment
Classic work on competing hypotheses makes the same point. Structured comparison does not guarantee the right answer, but it improves discipline and leaves an audit trail showing how evidence was interpreted. Psychology of Intelligence Analysis https://www.cia.gov/resources/csi/static/Pyschology-of-Intelligence-Analysis.pdf
Questions the future solicitation will need to answer
Several major issues remain unresolved.
The first is performance measurement. A summary should be tested for fidelity, coverage and preservation of important caveats. Translation should preserve uncertainty and meaning. Geolocation should present supporting indicators and confidence. Synthetic media detection should be tested against current and representative material.
The second is model change. Commercial providers may update their models with limited customer control. NATO will need version records, regression testing and a recovery mechanism.
The third is industrial dependence. Data, metadata, logs and processing rules must remain exportable in formats that another provider can use.
The fourth is adversarial manipulation. Hostile actors can manufacture content, poison datasets, coordinate accounts and design material intended to mislead automated systems.
The fifth is evidence preservation. Online material can disappear quickly. The platform must preserve content, time, context and authentication information while complying with applicable policies.
The sixth is training. NCIA requires training for users, administrators and future trainers. This should cover more than interface operation. It should include model limitations, source evaluation, bias, operational security and the communication of probability and confidence.
Sovereignty of method
For European actors, sovereignty cannot be reduced to owning a model or hosting a server in Europe.
It means being able to understand what the system does, determine which data it uses, define quality rules, change supplier, reproduce a result, challenge an automated output and justify a conclusion before a decision maker.
In a commercial service architecture, control over interfaces, formats, metadata and evaluation methods can be as important as ownership of source code. An organisation may use foreign components while preserving genuine autonomy if it can assess and replace them. It may also buy a European product and remain dependent if it cannot audit the system, recover its data or reconstruct its analysis.
The most durable form of sovereignty is therefore intellectual and organisational. It is the ability to turn data into defensible judgements.