Request for proposals: service provider to collaborate with ncc on opt-out registry system

Date issued: 8 September 2026. Non-compulsory briefing session: 18 September 2026 at 11h00 via Microsoft Teams (Meeting ID: 376 084 384 847 872, Passcode: ct26bj3k, Join link: https://teams.microsoft.com/meet/376084384847872?p=tNB4yf50KUivfxEmiT). Closing date and time for questions: 25 September 2026 at 16h00. Closing date and time for submissions: 9 October 2026 at 14h00. Bid validity period: 90 calendar days after closing date. Project implementation plan must assume a start date of 30 October 2026. Contract duration: 10 years for successful service provider(s).

Non-compulsory briefing session: 18 September 2026 at 11h00 via Microsoft Teams. Join link: https://teams.microsoft.com/meet/376084384847872?p=tNB4yf50KUivfxEmiT. Meeting ID: 376 084 384 847 872. Passcode: ct26bj3k. Attendance is not mandatory but recommended for clarity on the RFP.

Technical enquiries: Mr J Mulaudzi — email [email protected], phone 012 065 1947. SCM enquiries: Ms M Moropene — email [email protected], phone 012 065 1995. All enquiries must be reduced to writing and sent to the relevant email address. All communication between service providers and the NCC must be in writing. Any discrepancy, ambiguity, error or inconsistency in the RFP must be promptly notified to the NCC in writing.

Submission method: Physical delivery to the NCC tender box at National Consumer Commission, SABS Campus, Building C, 1 Dr. Lategan Road, Groenkloof, Pretoria. Proposals must be clearly marked "For attention: The Manager: Supply Chain Management" with the reference number NCC/RFP/01/2026/2027. Three copies required: one original, two duplicates, plus an electronically accessible version packaged similarly to the physical copies. All copies must be correctly marked and sealed separately. Closing date and time: 9 October 2026 at 14h00. Late submissions will not be considered. Returnable documents: SBD 1 (Invitation to Bid) — complete, sign and submit the provided pro forma; SBD 4 (Declaration of Interest) — complete and sign the supplied pro forma; Proof of registration on the Central Supplier Database (CSD); Signed letter confirming zero financial impact on the NCC and consumers (service provider runs at own operational cost) — non-submission leads to disqualification; Signed letter confirming data sovereignty, data privacy and POPIA compliance with hosting of ICT infrastructure and data centres within South Africa — non-submission leads to disqualification. The NCC may conduct a site visit to verify data sovereignty compliance.

Submission requirements: Proposals must be clearly marked 'For attention: The Manager: Supply Chain Management' with the proposal reference number, delivered at reception in NCC's tender box at National Consumer Commission, SABS Campus, Building C, 1 Dr. Lategan Road, Groenkloof, Pretoria. Three (3) copies required: one (1) original and two (2) duplicates, plus electronically accessible proposal packaged similar to physical copies. Submit on or before closing date 09 October 2026 at 14h00. Each submission must be marked correctly and sealed separately for ease of reference during evaluation.

Three-phase evaluation. Phase 1: Administrative and Mandatory Compliance — submit SBD 1, SBD 4, CSD registration, zero financial impact letter, data sovereignty/POPIA letter. Non-submission of the two signed letters results in disqualification. Phase 2: Technical Evaluation (desktop) — minimum 70 out of 100 points required to proceed. Criteria and weights: 1) AI Chatbot development and implementation proposal (10 pts) — must include multilingual conversational chatbot, NLU for SA languages, contextual awareness, no-code/low-code tools for NCC staff; all elements required for full score, otherwise 0. 2) Revenue generation models and revenue-sharing framework (20 pts) — both elements required for full score, otherwise 0. 3) Multi-channel accessibility for consumer and Direct Marketer registration (20 pts) — mobile app, WhatsApp channel/chatbot, SMS/MMS/USSD registration, SMS short code for opt-out; all four = 20 pts, three = 15 pts, two = 10 pts, one = 5 pts, none = 0. 4) Value-add feature not covered elsewhere (10 pts) — proposal provided = 10 pts, none = 0. 5) Multi-channel evidence collection of opt-out violations with AI metadata capability (10 pts) — detailed proposal = 10 pts, none = 0. 6) Project Management (30 pts) — detailed project plan with milestones, deliverables, dependencies; proven agile/hybrid methodology with governance and communication structures; risk management, quality assurance and testing plans; readiness for pilot rollout, change management, post-deployment support; understanding of OORS operating environment and interdependencies; all elements required for full score, otherwise 0. Phase 3: Presentation and/or Demonstration — scored on a 1–5 scale (1 Poor, 2 Below Expectations, 3 Meets Expectations, 4 Exceeds Expectations, 5 Outstanding). Minimum 3 out of 5 required. Assessment based on alignment of presentation/demonstration with submitted proposal. The NCC may accredit more than one service provider based on functionality and ranking. Bid validity period: 90 calendar days after closing date.

Scope: Provide high-level Solution Architecture to augment, supplement and complement the existing NCC Opt-Out Registry System (OORS). Required solution components: 1) Multi-channel accessibility for consumer and Direct Marketer registration — mobile app (profile registration, view/update information), WhatsApp channel/chatbot, SMS/MMS/USSD registration, SMS short code for opting out. 2) AI Chatbot Design and Implementation — multilingual conversational chatbot handling generic and transactional queries, Natural Language Understanding (NLU) for user intent, informal speech and multiple South African languages, contextual awareness for conversational continuity, no-code/low-code tools for NCC staff to update content independently. 3) Multi-channel evidence collection of consumer opt-out violations with AI capability to collect AI metadata. 4) Real-time consumer and Direct Marketer verification during registration. 5) Any other value-adding solution. Existing OORS technology stack: MS SQL database, MVC architecture with N-tier structure (Web, Web API, database), C# programming language, Visual Studio IDE, .NET Core framework, JavaScript/HTML/CSS/Bootstrap UI, Azure DevOps source control, cloud-hosted on Azure. eService functionality (complaints handling) is live; Opt-Out Registry functionality expected live in 2026. High traffic volumes anticipated for opt-out activities and direct marketer list cleansing.

Project implementation plan must assume start date of 30 October 2026. Service provider must provide methodology on delivery, project governance, timelines, risk management, quality assurance, and approach to testing, rollout and support. Required elements: detailed project plan with milestones, deliverables and dependencies; proven agile or hybrid project management approach with clear governance and communication structures; clearly defined risk management strategy, quality assurance and testing plans; demonstrated readiness for pilot rollout, change management and post-deployment support; demonstrated understanding of OORS operating environment and interdependencies with existing systems. All elements required for full score (30 pts) in technical evaluation; missing any element scores 0.

Quality assurance and testing plans must be clearly defined as part of the project management proposal (evaluated under Phase 2, criterion 6). Service provider must demonstrate readiness for pilot rollout, change management and post-deployment support. Development process for existing OORS adhered to industry best practices with rigorous testing methodologies, security measures and compliance with relevant standards. Proposed solutions must ensure reliability, security and seamless functionality.

Zero financial impact on the NCC and consumers — service providers must run independently with their own operational costs at no cost to the NCC. A signed letter confirming this must be submitted (non-submission leads to disqualification). Service providers must propose detailed revenue generation or monetisation models and a revenue-sharing framework with the NCC (evaluated for 20 points in technical evaluation). No pricing schedule, bonds, guarantees or payment terms specified — this is a collaboration/accreditation model rather than a traditional procurement with contract value.

Mandatory compliance documents: Registration on the Central Supplier Database (CSD) — if not registered, must register at https://secure.csd.gov.za/. SBD 1 (Invitation to Bid) — complete, sign and submit. SBD 4 (Declaration of Interest) — complete and sign. Signed letter confirming zero financial impact on the NCC and consumers (service provider operates at own cost) — non-submission leads to disqualification. Signed letter confirming data sovereignty, data privacy and protection within South African jurisdiction — hosting of ICT infrastructure and data centres must be in South Africa, compliance with POPIA — non-submission leads to disqualification; NCC may conduct a site visit for confirmation. Service providers must be cognisant of applicable legislation and standards, including the Consumer Protection Act (CPA) and POPIA. No specific B-BBEE level, CIDB grading, or professional body registration mentioned. No local content percentages specified.

SBD 4 (Declaration of Interest) must be completed and submitted as part of Phase 1 administrative compliance. No specific B-BBEE level requirement or preferential procurement points (80/20 or 90/10) mentioned in the evaluation criteria. Evaluation is based on functionality (technical score) and presentation/demonstration, not on B-BBEE points.

Contract duration: Successful service provider(s) accredited for 10 years. Indemnity: Service provider indemnifies and holds NCC harmless from all costs and damages (including investigations, procedural impairment, repetition of RFP process, enforcement of IP or confidentiality obligations) arising from breach of RFP conditions. Limitation of liability: Participation is at the service provider's cost and risk; NCC not liable for any costs incurred or damage suffered. Confidentiality: No disclosure of RFP or tender information except as required by law, court or regulatory authority. No distribution, reproduction, storage or transmission of RFP content except for proposal preparation. RFP documents remain NCC property and must be returned on request with all copies. Written NCC approval required before releasing any information about the potential work or RFP process; failure may result in disqualification and civil action. Misrepresentation: Proposal terms incorporated by reference; NCC relies on proposal as material representation. Misrepresentations may give rise to termination and claims. In case of conflict between proposal and Service Level Agreement, the SLA prevails.

Mandatory requirements: 1) Zero financial impact on NCC and consumers — signed confirmation letter required (disqualification if omitted). 2) Data sovereignty, privacy and protection within South African jurisdiction — ICT infrastructure and data centres hosted in SA, POPIA compliance — signed confirmation letter required (disqualification if omitted); NCC may conduct site visit. 3) CSD registration. 4) SBD 1 and SBD 4 completed and signed. 5) Proposed solution must include: multi-channel registration (mobile app, WhatsApp, SMS/MMS/USSD, SMS short code), AI chatbot (multilingual, NLU, contextual awareness, no-code/low-code tools), multi-channel evidence collection with AI metadata, real-time verification, and any value-add features. 6) Project plan assuming 30 October 2026 start with agile/hybrid methodology, governance, risk management, QA, testing, pilot rollout, change management, post-deployment support, and OORS environment understanding.