AI Governance Institute
← News
Corporate Policy2026-09-26

VA's October AI Contract Sets Governance as a Federal Procurement Criterion

What happened

The Veterans Affairs previews timeline for enterprise AI services competition describes a two-track AI acquisition strategy at the U.S. Department of Veterans Affairs. The larger track is a three-year Enterprise Artificial Intelligence Support Services contract targeting 540,000 users, with a final solicitation expected in October 2026. The contract scope spans the full AI development and deployment lifecycle, including security, accessibility, and post-deployment iteration. The VA explicitly names transparent AI governance as a procurement objective, making governance documentation a competitive requirement rather than a post-award expectation. A separate first-party acquisition for conversational assistance and agentic task execution tools is expected to be awarded first, creating a layered AI deployment involving both autonomous and human-assisted capabilities.

Why it matters

  • ·Governance is now a scored criterion, not a checkbox. Vendors competing for the October 2026 solicitation must document AI governance practices at the proposal stage, raising the bar for procurement-stage evidence across federal contracting.
  • ·The inclusion of agentic task execution in the first-party suite means VA deployments will involve AI that takes actions autonomously on behalf of users. Vendors and deployers must address human oversight and permission controls before award, not after.
  • ·This contract sets a replicable federal template. Other agencies watching the DOD's GenAI.mil hits 2 million weekly users trajectory are likely to adopt similar governance-as-criterion language in future solicitations. This will expand the compliance surface for AI vendors across the public sector.

Governance controls affected

PRC-001AI Vendor Due DiligencePRC-005AI Procurement Risk AssessmentPRC-011Federal AI Procurement Submission and Review ProcessAGT-016Agentic AI Deployment Readiness AssessmentAGT-005Human Approval Gate for Irreversible Agent Actions

What to do now

  • ☐If your organization is a potential VA vendor, audit your AI governance documentation now: confirm you can produce written policies covering transparency, human oversight, and lifecycle management before October 2026.
  • ☐Map your agentic AI capabilities against human-approval requirements: identify every workflow where AI takes autonomous action and confirm each has a documented approval gate or scope boundary.
  • ☐Review your procurement team's understanding of governance-as-criterion: brief them on what federal buyers now expect to see in technical proposals, including governance frameworks, audit trails, and incident response procedures.
  • ☐Assess whether your current AI governance program produces artifacts that can be shared with government auditors, such as model cards, risk assessments, and testing records, not just internal policies.
  • ☐Track the first-party acquisition award date as a signal: the governance terms embedded in that earlier award will likely set the floor for what the third-party solicitation requires.

What to watch next

Compliance teams should monitor the October 2026 solicitation release for VA governance documentation requirements. Those terms will signal federal procurement norms for AI vendors across agencies. The NIST AI Risk Management Framework Playbook and emerging U.S. General Services Administration AI Strategies and Compliance Plan are likely reference points for what evaluators will assess. Watch also for whether the first-party agentic tool award imposes human-oversight conditions that cascade to third-party integrators as contractual obligations.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Corporate Policy2026-09-15

AIUC-1 Sets First SOC 2-Style Certification Standard for Enterprise AI Agents

Startup Artificial Intelligence Underwriting Company (AIUC) has launched a third-party audit and certification standard called AIUC-1 for enterprise AI agents. The standard, modeled on SOC 2, runs agents through roughly 5,000 tests covering jailbreaks, hallucinations, and data leaks. AIUC raised $40 million in a Series A to scale the service, founded by an early Anthropic employee and the former COO of METR.

Corporate Policy2026-09-24

Google's AI Vulnerability Scanners Target Critical Infrastructure, Raising Authorization and Disclosure Gaps

Google has launched its Scan for Good initiative, using the Gemini 3.8 Flash Cyber model and Wiz's Red Agent to autonomously identify security vulnerabilities in critical infrastructure organizations, hospitals, municipalities, and nonprofits. The program requires explicit authorization or bug bounty program coverage before scanning begins, and mandates human review of all findings before disclosure decisions are made. CISA has publicly endorsed the initiative.

Corporate Policy2026-09-26

50,000 Agents in Two Weeks: GenAI.mil Exposes Scale vs. Governance Gap

The U.S. Department of Defense's GenAI.mil platform reached over 2 million weekly users as of September 2026, up from roughly 80,000 at launch in December 2025. The platform hosts vetted AI models from Google, OpenAI, and xAI for unclassified tasks. It saw more than 50,000 custom AI agents deployed within two weeks of releasing an agentic feature. The pace of agent creation raises direct questions about whether intake reviews, permission scoping, and oversight workflows can keep up with adoption at that speed.