Federal AI Procurement Submission and Review Process

The evolving federal AI procurement landscape

Federal AI procurement requirements are evolving rapidly, with the pace accelerating following the 2025 White House AI Action Plan and Executive Order 14179. Key developments that organizations procuring AI for federal use or supplying AI to federal customers must track:

Voluntary pre-deployment evaluation commitments: In 2023-2024, leading AI developers made voluntary commitments to the White House covering pre-deployment safety testing, red-teaming (deliberately attacking a system to find weaknesses), and transparency reporting. These commitments apply to the developers themselves and do not directly bind enterprise customers, but they establish norms and reference standards that federal procurement is beginning to write into formal rules.

Transition to mandatory requirements: Executive Order 14179 directed federal agencies to develop mandatory AI safety and testing requirements. The transition from voluntary commitments to mandatory standards varies by agency and use case. Organizations procuring AI for federal customers, or federal agencies procuring commercial AI, should track agency-specific rulemaking for the domains in which they operate.

NIST AI RMF as procurement standard: Several federal agencies have begun requiring alignment with the NIST AI RMF (the National Institute of Standards and Technology's AI Risk Management Framework) in procurement. The NIST AI 600-1 Generative AI Profile adds more specific requirements for generative AI. Vendors should be prepared to demonstrate alignment, not just awareness, of these frameworks.

National AI Initiative and sector-specific requirements: HHS (Health and Human Services), DOD (Defense) and the FTC (Federal Trade Commission) have issued AI guidance affecting procurement in healthcare, defense and consumer AI respectively. The national AI strategy and AI Action Plan create umbrella priorities that agency requirements are being aligned to.

Key elements of a federal AI procurement process

Requirement identification:

• Is this procurement covered by a federal contract or involves use of AI in a federal context?
• Which agency's requirements apply?
• Is the procurement subject to current mandatory requirements or voluntary standards? (These differ.)
• Has the relevant agency issued AI-specific acquisition guidance (e.g., clauses in the Federal Acquisition Regulation (FAR) or its defense supplement, DFARS)?

Vendor submission requirements:

• What documentation must the vendor provide? Common requirements include: AI system documentation (purpose, description of the data used to train it, what the system can do), safety evaluation results or red-team summaries, NIST AI RMF self-assessment, data privacy and security documentation.
• Are there format or completeness standards for submissions?
• How are submissions retained and who has access?

Ongoing monitoring:

• Which regulatory updates affect the procurement program?
• What is the process for re-evaluating existing vendor relationships when requirements change?

The voluntary-to-mandatory transition

Organizations should map current voluntary commitments from their AI vendors to the mandatory requirements emerging from federal rulemaking. Where a vendor's voluntary commitment covers a specific evaluation (e.g., red-teaming before deployment of the most advanced models), assess whether the mandatory requirement imposes additional specificity (e.g., a required third-party evaluator, a specific set of tests, a minimum disclosure format). The voluntary-to-mandatory gap is where compliance risk accumulates.