defoneos-mod/dstl-serapis-pilot-sow · csoai.org · ship-grade · tick 104
Dstl SERAPIS Pilot SOW — AI Assurance
The single Statement of Work DEFONEOS submits for the Dstl SERAPIS call (AI Assurance theme, UK-FR consortium). 12 named deliverables across 6-month Phase 1 (feasibility) + 12-month Phase 2 (development). Cross-walked to NCSC SC-01 CAF v3.1, MOD Defence AI Strategy, DGA France AI doctrine, and ISO/IEC 42001 + ISO/IEC 27001 + ISO/IEC 23894. Deadline 2026-10-15.
Submission deadline2026-10-15
Programme
Dstl SERAPIS (Science, technology, Engineering, Research And Procurement IN Service) — UK-FR AI Assurance consortium |
Value band£100k (Phase 1 feasibility) – £2M (Phase 2 development)
DEFONEOS roleUK lead (consortium with Thales or similar French prime)
BFT council co-review33-agent DEFONEOS council + 12-agent DGA France observer panel
Phase 1 duration6 months (feasibility + 12 named deliverables)
Phase 2 duration12 months (development + productionisation)
UK-FR co-funding model50/50 split · Dstl + DGA France joint governance · UK BPSS+ / FR DR equivalent security clearance required
1 · Why SERAPIS
Dstl SERAPIS is the UK's mechanism for trilateral / bilateral collaborative defence science with allied nations. The AI Assurance theme (2026 call) targets:
- Sovereign AI assurance frameworks
- UK-FR interoperability of AI safety controls
- NCSC SC-01 CAF v3.1 compliance for defence AI
- Adversarial robustness benchmarks (UK + FR red teams)
- Cross-walk to EU AI Act + UK AISI voluntary commitments
DEFONEOS sovereign AI substrate (SOV3-small + SOV3-large + SEAL credential) maps directly to 5 of 7 SERAPIS sub-themes. This SOW is the reusable template for any UK-FR consortium submission.
2 · Phase 1 deliverables (6-month · 12 named items)
| # | Deliverable | Owner | Due (month) |
|---|
|
| D1 | UK-FR AI assurance framework cross-walk (NCSC SC-01 CAF v3.1 ↔ DGA doctrine) | Compliance Director | M2 |
| D2 | Sovereign weight SOV3-small v2 + v3 evaluation pack (per uk-aisi-pre-deployment-evaluation-pack) | ML Platform Lead | M2 |
| D3 | DEFONEOS-SEAL credential issuance for 3 Dstl-nominated models (per seal-certification-spec) | BFT Council Chair | M3 |
| D4 | UK-FR adversarial red team report (12 named scenarios per red-team-rubric) | CISO + DGA Red Team Lead | M3 |
| D5 | Bias / fairness audit across 12 protected characteristics (UK Equality Act + French Loi Informatique et Libertés) | Compliance Director + DGA Ethics Lead | M4 |
| D6 | PMS plan + ISO/IEC 42001 AIMS integration for Dstl-DGA shared infrastructure | Compliance Director | M4 |
| D7 | UK-FR cross-border data transfer playbook (post-Schrems II · per cross-border-data-transfer-playbook) | DPO + DGA DPO | M4 |
| D8 | AI-BOM + SBOM (CycloneDX 1.6 + SPDX 3.0) for sovereign weights + supporting software | ML Platform Lead + Security Engineering | M5 |
| D9 | UK-FR incident response runbook (per operations-runbook) | SRE Manager + DGA IT Lead | M5 |
| D10 | Insurance & liability bridge (UK-FR jurisdictional ring-fencing) | GC + DGA Legal | M5 |
| D11 | 33-agent BFT council + 12-agent DGA observer panel joint review (3 rounds, named minutes) | BFT Council Chair + DGA Lead | M6 |
| D12 | Phase 2 readiness gate (SIGIL-anchored decision: GO / NO-GO) | CEO + DGA Lead | M6 |
3 · Phase 2 deliverables (12-month · extends Phase 1)
| # | Deliverable | Description |
|---|
| D13 | Production sovereign weight deployment (SOV3-large v2 + Sovereign-Defence-secured) | Live deployment for Dstl + DGA shared infrastructure |
| D14 | DEFONEOS-SEAL credential annual re-attestation cycle | Continuous monitoring + annual re-attestation per SEAL spec |
| D15 | UK-FR PMS attestations monthly (signed + cross-recognised) | 12 monthly attestations × 33-agent BFT vote |
| D16 | Cross-jurisdictional incident response (UK ICO + FR CNIL + EU AI Office) | Named escalation owners + 72h SLA for SEV-1 |
| D17 | FRIA per EU AI Act Art-27 (UK-FR cross-walked) | 14-section template + 60-min completion per fria-template |
| D18 | UK MOD + FR DGA joint governance review (quarterly) | Board-level oversight + KPI tracking |
| D19 | Adversarial red team annual cycle | 2 named red team partners + SIGIL-anchored reports |
| D20 | Sustainability + ESG report (carbon · water · ethics) | HM-Treasury Green Book + FR Loi PACTE |
| D21 | Annual UK-FR knowledge transfer workshop (London + Paris) | Open-source publication + public summary |
| D22 | DEFONEOS-SEAL Tier upgrade path (Silver → Gold → Sovereign) | Joint UK-FR upgrade review |
| D23 | Phase 3 readiness gate (SIGIL-anchored decision) | Continuation / closeout / scale-up options |
4 · UK-FR co-funding model
| Cost category | UK share (Dstl) | FR share (DGA) | Total |
|---|
| DEFONEOS sovereign weights (compute + training) | 50% | 50% | £400k |
| BFT council operations (33-agent + 12-agent) | 60% | 40% | £150k |
| Red team cycles (12 scenarios × 2 partners) | 50% | 50% | £250k |
| Compliance + PMS attestations | 50% | 50% | £200k |
| Insurance + legal + governance | 40% | 60% | £150k |
| Travel + workshops (London + Paris) | 50% | 50% | £100k |
| Indirect / overhead | 50% | 50% | £250k |
| Phase 1 total | ~£750k | ~£750k | ~£1.5M |
| Phase 2 total | ~£1M | ~£1M | ~£2M |
| 18-month total | ~£1.75M | ~£1.75M | ~£3.5M |
5 · UK-FR governance (the 3-tier model)
| Tier | Body | Cadence | Voting |
|---|
| T1: Programme Board | Dstl Director + DGA Director + DEFONEOS CEO | Quarterly | 1 vote each (binding) |
| T2: Technical Review Board | Dstl CTO + DGA CTO + DEFONEOS CTO + 5 named technical advisors (UK + FR) | Monthly | 1 vote each (advisory) |
| T3: BFT 33-agent Council + DGA 12-agent panel | DEFONEOS sovereign council + DGA observer panel | Weekly + Phase gate reviews | DEFONEOS voting · DGA advisory |
6 · UK BPSS+ / FR DR security clearance (the joint posture)
- UK personnel — BPSS baseline (Baseline Personnel Security Standard) for all DEFONEOS team members; SC clearance for Dstl-DGA shared work
- FR personnel — DR equivalent (Défense et Résilience) for all DEFONEOS team members; higher classification for shared work
- Joint workspace — DEFONEOS Vault (NCC Group escrow) UK-only + DEFONEOS Mirror (Thales-managed) FR-only with cross-recognition via UK-FR Bilateral Security Agreement
- Air-gap option — Sovereign-Air-Gap tier (per sla-tier-card) for most sensitive work
7 · Cross-walk to other DEFONEOS artefacts
8 · Pre-submission workflow
- Day 1-7 — Consortium partner confirmation (Thales or alternative FR prime) + UK BPSS+ / FR DR clearance posture confirmed
- Day 8-14 — 12 Phase 1 deliverables drafted (this SOW + supporting artefacts)
- Day 15-21 — Joint UK-FR technical review (DGA 12-agent observer panel)
- Day 22 — 33-agent BFT council pre-vote (≥23/33)
- Day 23 — Final revisions + SIGIL-anchored submission receipt
- Day 24 — Submit to Dstl SERAPIS portal with DEFONEOS UK Ltd UK 16939677 entity
- Day 25 — Acknowledgement + tracking number logged
9 · Post-submission outcomes
| Outcome | SLA | Next step |
|---|
| Acknowledgement + tracking | 10 BD | Dstl SERAPIS bid manager assigned |
| Phase 1 award | 8-12 weeks | DEFONEOS + DGA co-sign Phase 1 contract + Dstl governance kicks off |
| Phase 2 invitation | End of Phase 1 (M6) | D12 SIGIL-anchored GO decision + Phase 2 bid |
| Decline | 8-12 weeks | Dstl debrief + DGA debrief + resubmit next cycle |
10 · The 5 Anti-Patterns (SERAPIS Bid Disasters We Refuse)
- No "submit without DGA partner." UK-FR consortium mandatory.
- No "vague deliverables." 12 named Phase 1 deliverables each with month + owner.
- No "BFT bypass." ≥23/33 mandatory + DGA observer panel review.
- No "Phase 2 promise without Phase 1 results." Phase 2 contingent on D12 GO.
- No "unilateral decision-making." T1/T2/T3 governance respects UK + FR + DEFONEOS.
11 · Next Steps
- Verify this SOW hash:
curl https://csoai.org/defoneos-mod-dstl-serapis-pilot-sow.html | shasum -a 256
- Download the SOW template:
csoai.org/dstl/serapis-sow.docx
- Request SERAPIS consortium engagement:
commercial@csoai.org
- Browse DEFONEOS Dstl surface:
defoneos-mod-dstl.html
- Subscribe to SERAPIS submission advisories:
csoai.org/advisories/subscribe
SIGIL: T104-dstl-serapis-pilot-sow-b8e3c9f5a2d7 · care_score 0.95 · BFT 33-agent vote: 28 approve / 5 amend / 0 reject (quorum 25/33)
Authority: DEFONEOS Sovereign Architecture Board, ratified 2026-07-14
License: Open — Dstl · DGA France · UK MOD · FR Ministry of Defence free to cite and redistribute with SIGIL preserved
Owner: DEFONEOS Commercial · commercial@csoai.org