HHS Sole-Source Anthropic Award Puts AI Vendor Lock-In Under Federal Scrutiny

What happened

Why it matters

• ·Organizations relying on a single AI vendor without a documented exit or portability plan are structurally exposed. This HHS case shows that dependency can become a legal and reputational liability, not just an operational one.
• ·Federal procurement rules require competitive bidding except in defined circumstances. Using operational dependency as a sole-source justification is now a named risk that auditors, inspectors general, and oversight bodies will look for in public-sector and regulated-industry AI contracts.
• ·The HHS case is a signal for private-sector compliance teams. If switching vendors has become impractical, concentration risk controls, contractual portability clauses, and documented alternatives are audit-ready requirements, not optional best practices.

Governance controls affected

What to do now

• ☐Identify every AI vendor relationship where the organization could not feasibly switch providers within 90 days, and document whether that dependency has been disclosed to procurement, legal, or risk leadership.
• ☐Review existing AI vendor contracts for data portability clauses: confirm you can export your data, configurations, and model fine-tuning work if the relationship ends.
• ☐Ask your legal and procurement teams whether any current or planned AI sole-source or direct-award decisions can withstand audit scrutiny if the justification rests primarily on existing deployment rather than a recognized legal exception.
• ☐Require that future AI vendor assessments include a concentration risk rating and a written alternative-vendor or exit scenario, and track this in your vendor risk register.
• ☐If your organization is in the public sector or a regulated industry, confirm that your AI procurement decisions are consistent with competitive-bidding obligations and that any exceptions are formally documented before contracts are signed.

What to watch next

Inspectors general and congressional oversight committees have shown growing appetite for scrutinizing federal AI contracts. This HHS notice is likely to draw follow-up inquiries into how the sole-source justification holds up under review. Compliance teams in federally regulated industries should watch for guidance from the General Services Administration and the Office of Management and Budget on AI vendor dependency documentation requirements. Existing frameworks like OMB Memorandum M-26-04: Increasing Public Trust in AI Through Unbiased AI Principles touch procurement principles but do not yet mandate exit-strategy documentation. Private-sector teams should also monitor whether financial regulators begin treating single-vendor AI dependency as a concentration risk requiring disclosure. Signals from bodies like the European Systemic Risk Board suggest this may be coming.