How Systems Integrators Package Local GPU in an AI Project Proposal

In an AI project proposal, a systems integrator (SI) should present local GPU in three places: the architecture in the technical proposal, a cost line in the price breakdown, and evidence of processing location in the compliance appendix. Whether the GPU is included in the solution or itemized separately depends on whom the client wants to hold as the single point of accountability.

Where does local GPU belong in an AI project proposal?

Local GPU belongs in three parts of the proposal. In the technical proposal, it appears as the compute layer in the architecture diagram. In the price breakdown, it appears as its own cost line or as part of a package. In the compliance appendix, it serves as evidence of where processing takes place. When any of these parts is missing, evaluators typically respond with a clarification question.

Many proposals mention GPU only in the price breakdown. As a result, the client's IT team cannot tell where the workload runs, and the compliance team has no document to review. As of October 2026, the common pattern is as follows:

Proposal section	What to state about GPU	Evidence to attach
Technical proposal: architecture	Compute layer, data center location, deployed models, and the data flow from application to inference	Architecture diagram and a data flow diagram for each component
Technical proposal: sizing	GPU type, initial quantity, and the workload assumptions applied	Sizing assumptions table and a POC validation plan
Price breakdown	Compute line or solution package, billing currency, and contract term	Cost structure by phase (POC, go-live, operations)
Compliance appendix	Infrastructure provider entity, certifications, and its position as a sub-processor	ISO/IEC 27001:2022 certificate, sub-processor list, and location statement
Operations appendix	Monitoring, snapshots, restore, and incident escalation path	Responsibility matrix and escalation contacts

Should GPU be packaged into the solution or listed separately?

No single answer fits every project. A package suits clients who want one contract and one invoice. A separate line item suits clients who want full visibility into compute costs. A direct contract between the client and the infrastructure provider suits clients whose procurement policy requires it. Under all three models, the SI continues to lead the solution.

Model	Best suited to	Advantage for the SI	Points to note
Package: GPU included in the solution or managed service price	Clients who want a single contract and a single point of accountability	The SI retains the full client relationship and sets its own pricing structure	The SI bears the risk if the initial sizing proves inaccurate, so the sizing assumptions should be stated clearly
Separate line item in the price breakdown	Procurement that requires component-level detail, such as tenders scored on price per item	Evaluators can compare items easily, and price discussions do not touch the value of the SI's services	The compute line should carry a technical description, not just "GPU rental"
Direct contract between the client and the infrastructure provider, with the SI as solution lead	Clients with a separate infrastructure vendor policy	Capacity risk stays off the SI's balance sheet	The responsibility matrix must be clear so the client knows whom to contact

Whichever model is chosen, the SI should agree on it with the infrastructure provider before drafting the price breakdown. Changing the model after the proposal has been submitted usually forces the negotiation to be reopened.

How should GPU sizing be written without promising performance figures?

Sizing should be written as an assumption, not a commitment. State the model to be deployed, the size of documents or conversations, the expected number of concurrent users, and the operating hours, then note that final figures will be validated through the POC. This lets evaluators see the basis of the estimate, and the SI is not bound to figures that have not yet been tested.

GPU selection is usually driven by the model's VRAM requirement. Larger open-weight models need GPUs with more memory, while smaller models can run on a lower class of GPU. For guidance on choosing models for Indonesian-language documents, see how to choose an open-weight model for document extraction.

A well-prepared sizing assumptions table covers the following six items:

1. The use case and the model used, including its version.
2. The input profile: average document length, prompt length, or audio duration.
3. Estimated concurrent users at peak load, based on information from the client.
4. Operating hours, and whether a separate staging environment is required.
5. Stored data: storage location, log retention period, and snapshot schedule.
6. POC pass criteria agreed with the client.

Throughput and response time figures are best left out of the proposal until the POC has run, since such figures are often quoted back in the contract.

What should the compliance appendix contain?

The compliance appendix establishes where processing takes place and the legal position of the infrastructure provider. At a minimum, it contains the entity's name and address, the data center location, the information security certificate, the provider's position as a sub-processor, and a data flow diagram. With this appendix in place, the compliance team's questions are answered before they are raised.

As of October 2026, two regulations make this appendix increasingly important:

• PP 33/2026 requires a personal data processor to obtain written approval from the data controller before engaging another processor. The regulation was enacted on 16 July 2026 and takes effect on 16 January 2027. Where the SI acts as the processor, the GPU provider is a sub-processor that the client must approve.
• PP 71/2019 requires public-scope electronic system operators to manage, process, and store electronic systems and data within Indonesian territory, unless the relevant technology is not available domestically. For government clients, evidence of processing location is a core requirement, not an optional extra.

For bank clients, POJK 11/POJK.03/2022 requires OJK approval before a bank places an electronic system offshore. A full approach to writing the data residency answer is covered in how to answer data residency questions in an RFP.

Which mistakes most often weaken a proposal?

The most common mistake is an inconsistent location claim. The proposal states that "data stays in Indonesia", yet logging, tracing, or a model fallback turns out to rely on a service abroad. A careful evaluator will find this in the diagram or the sub-processor list, and confidence in the whole proposal declines as a result.

Other mistakes that appear frequently:

1. Sizing prepared without a workload profile, so the figures are hard to defend during clarification.
2. The proposal states that the infrastructure provider "handles compliance", although the DPIA and the legal basis for processing remain the client's responsibility.
3. The POC is run in an environment that differs from production, so its results do not hold after go-live.
4. Compute billed in US dollars is placed inside a multi-year Rupiah contract, which turns exchange rate movements into a risk for the SI.
5. No handover plan, and no incident escalation path that names contacts.

Checklist before the proposal is submitted

1. The architecture diagram shows the location of every component, including logging and monitoring.
2. The packaging model (package, line item, or direct contract) has been agreed with the infrastructure provider.
3. A sizing assumptions table is included, and the POC pass criteria are in writing.
4. No throughput, response time, or uptime figures that have not been tested.
5. The sub-processor list is complete, with legal entities and locations.
6. The infrastructure provider's ISO/IEC 27001:2022 certificate is attached, with its number and validity period.
7. The billing currency for compute matches the client's contract currency.
8. A responsibility matrix covering the SI, the client, and the infrastructure provider is attached. An example is available in the role split between SI and infrastructure provider.

Where IONext fits

IONext provides the compute layer beneath the SI's solution, from Jakarta. The GPU options are NVIDIA RTX PRO 6000 Blackwell Server Edition 96GB and NVIDIA L40S 48GB, along with managed inference for open-weight models through an OpenAI-compatible API. Workloads are managed through ORBIT, while IONA helps monitor production. Full specifications are on the IONext GPU page.

For proposals, IONext prepares a compliance pack for client due diligence, covering the legal entity PT Data Awan Nusantara, the ISO/IEC 27001:2022 certificate from TÜV NORD (no. 01 07 E 26000410), and billing in Rupiah. Details are available on the IONext trust and compliance page. IONext also supports sizing and the POC on the same infrastructure as production.

There are boundaries to its role. IONext does not write the SI's proposal, does not set the SI's resale price to the client, does not prepare the client's DPIA, and cannot guarantee the location of components that the SI runs outside IONext.

SIs preparing an AI project proposal can get started through the IONext Partner Program. To try ORBIT and IONA first, create an account on the IONext console.

FAQ

Can an SI resell IONext GPU as part of its own solution package? The IONext Partner Program is designed so that the SI keeps the client relationship. Packaging models, including placing GPU inside the solution price, are discussed project by project after sizing. Initial information is available on the Partner Program page.

Does the GPU provider need to be listed as a sub-processor in the proposal? Yes, if the GPU provider takes part in processing personal data on the SI's behalf. Under PP 33/2026, a processor needs the controller's written approval before engaging another processor. Each party's position should be confirmed with the client's legal team.

Should GPU performance figures be included in the technical proposal? The proposal should state sizing assumptions and POC pass criteria rather than performance figures. Figures that have not been tested on the client's workload risk being quoted back in the contract.

Sources

• Law No. 27 of 2022 on Personal Data Protection, JDIH BPK
• Copy of Government Regulation No. 33 of 2026 implementing Law No. 27 of 2022
• Veritask: Technical rules on personal data protection and controller and processor duties under PP 33/2026
• PwC Indonesia: Government Regulation 33/2026 on Personal Data Protection
• Hukumonline: Key points of the new PP PSTE rules (PP 71/2019)
• OJK: Summary of POJK 11/POJK.03/2022 on IT Implementation by Commercial Banks
• IONext Security and Compliance

This article provides general information and does not constitute legal advice. Project-specific obligations should be confirmed with the client's legal and compliance teams.

IONext is sovereign AI infrastructure hosted in Indonesia, operated by PT Data Awan Nusantara in Jakarta. IONext provides GPU as a Service, managed inference through an OpenAI-compatible API, and open-weight model hosting, certified to ISO/IEC 27001:2022 by TÜV NORD.