AI Governance Institute
← News
Corporate Policy2026-10-21

HHS Sole-Source Anthropic Award Puts AI Vendor Lock-In Under Federal Scrutiny

Source

HHS to make sole-source award to Anthropic ahead of broader AI competition

U.S. Department of Health and Human Services

What happened

HHS published a notice of intent to award Anthropic a sole-source contract for continued Claude AI services. The agency is simultaneously preparing for a broader competitive procurement, according to reporting by FedScoop. The agency cited its existing enterprise deployment as the justification for bypassing competitive bidding. A government procurement law expert quoted in the report called that justification legally weak. The expert argued it reads as an acknowledgment of vendor dependency, not a valid basis for sole-source award. The case follows a broader pattern of federal AI procurement drawing scrutiny. The VA's October AI contract similarly elevated governance as a procurement criterion. Meanwhile, AI-generated proposals flooding federal RFPs have put procurement integrity under additional pressure. HHS intends to run a competitive process after the sole-source period ends, but the interim award has already drawn public criticism.

Why it matters

  • ·Organizations relying on a single AI vendor without a documented exit or portability plan are structurally exposed. This HHS case shows that dependency can become a legal and reputational liability, not just an operational one.
  • ·Federal procurement rules require competitive bidding except in defined circumstances. Using operational dependency as a sole-source justification is now a named risk that auditors, inspectors general, and oversight bodies will look for in public-sector and regulated-industry AI contracts.
  • ·The HHS case is a signal for private-sector compliance teams. If switching vendors has become impractical, concentration risk controls, contractual portability clauses, and documented alternatives are audit-ready requirements, not optional best practices.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

PRC-001AI Vendor Due DiligencePRC-002AI Contractual RequirementsPRC-005AI Procurement Risk AssessmentPRC-009AI Vendor Concentration Risk AssessmentPRC-007Vendor Governance Change Monitoring

What to do now

  • ☐Identify every AI vendor relationship where the organization could not feasibly switch providers within 90 days, and document whether that dependency has been disclosed to procurement, legal, or risk leadership.
  • ☐Review existing AI vendor contracts for data portability clauses: confirm you can export your data, configurations, and model fine-tuning work if the relationship ends.
  • ☐Ask your legal and procurement teams whether any current or planned AI sole-source or direct-award decisions can withstand audit scrutiny if the justification rests primarily on existing deployment rather than a recognized legal exception.
  • ☐Require that future AI vendor assessments include a concentration risk rating and a written alternative-vendor or exit scenario, and track this in your vendor risk register.
  • ☐If your organization is in the public sector or a regulated industry, confirm that your AI procurement decisions are consistent with competitive-bidding obligations and that any exceptions are formally documented before contracts are signed.

What to watch next

Inspectors general and congressional oversight committees have shown growing appetite for scrutinizing federal AI contracts. This HHS notice is likely to draw follow-up inquiries into how the sole-source justification holds up under review. Compliance teams in federally regulated industries should watch for guidance from the General Services Administration and the Office of Management and Budget on AI vendor dependency documentation requirements. Existing frameworks like OMB Memorandum M-26-04: Increasing Public Trust in AI Through Unbiased AI Principles touch procurement principles but do not yet mandate exit-strategy documentation. Private-sector teams should also monitor whether financial regulators begin treating single-vendor AI dependency as a concentration risk requiring disclosure. Signals from bodies like the European Systemic Risk Board suggest this may be coming.

Related Coverage

Corporate Policy2026-11-09

OpenAI's Transparency Blueprint Puts AI Infrastructure Risk on the Compliance Agenda

After the 2026 midterm elections, ballot measures restricted data center construction across the US. OpenAI responded by publishing a compute campus policy blueprint. It commits to ending non-disclosure agreements with local officials and disclosing environmental impacts. Compliance teams need to add vendor infrastructure exposure to procurement and vendor risk programs.

Enforcement2026-11-07

SpaceXAI Faces $6M in Fines for Unpermitted Mississippi Data Center Construction

Mississippi state regulators issued notices of violation to SpaceXAI subsidiary MZX Tech LLC in July 2026. The violations concern construction on roughly 30 acres of its Southaven data center campus without required stormwater permits. Potential fines reach $6.1 million at $25,000 per day. A federal court separately ruled that state regulators had improperly allowed 69 natural gas turbines to operate without air permits, a finding central to an ongoing NAACP lawsuit.

Standards2026-11-04

First AI Company Earns FedRAMP 20x Class C, Resetting Federal Vendor Eligibility

Perplexity has become the first AI company to receive a full FedRAMP 20x Class C authorization under the 2026 Consolidated Rules. The certification covers Perplexity Enterprise and its application programming interface (API) Platform for use by the General Services Administration (GSA) and the Department of Agriculture (USDA). Security is now measured through outcome-based Key Security Indicators rather than narrative documentation, changing what vendors must demonstrate to qualify.