AI Governance Institute
← News
Corporate Policy2026-09-26

VA's October AI Contract Sets Governance as a Federal Procurement Criterion

What happened

The Veterans Affairs previews timeline for enterprise AI services competition describes a two-track AI acquisition strategy at the U.S. Department of Veterans Affairs. The larger track is a three-year Enterprise Artificial Intelligence Support Services contract targeting 540,000 users, with a final solicitation expected in October 2026. The contract scope spans the full AI development and deployment lifecycle, including security, accessibility, and post-deployment iteration. The VA explicitly names transparent AI governance as a procurement objective, making governance documentation a competitive requirement rather than a post-award expectation. A separate first-party acquisition for conversational assistance and agentic task execution tools is expected to be awarded first, creating a layered AI deployment involving both autonomous and human-assisted capabilities.

Why it matters

  • ·Governance is now a scored criterion, not a checkbox. Vendors competing for the October 2026 solicitation must document AI governance practices at the proposal stage, raising the bar for procurement-stage evidence across federal contracting.
  • ·The inclusion of agentic task execution in the first-party suite means VA deployments will involve AI that takes actions autonomously on behalf of users. Vendors and deployers must address human oversight and permission controls before award, not after.
  • ·This contract sets a replicable federal template. Other agencies watching the DOD's GenAI.mil hits 2 million weekly users trajectory are likely to adopt similar governance-as-criterion language in future solicitations. This will expand the compliance surface for AI vendors across the public sector.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-005Human Approval Gate for Irreversible Agent ActionsAGT-016Agentic AI Deployment Readiness AssessmentCMP-004Non-Legislative AI Obligation TrackerPRC-001AI Vendor Due DiligencePRC-005AI Procurement Risk AssessmentPRC-011Federal AI Procurement Submission and Review Process

What to do now

  • ☐If your organization is a potential VA vendor, audit your AI governance documentation now: confirm you can produce written policies covering transparency, human oversight, and lifecycle management before October 2026.
  • ☐Map your agentic AI capabilities against human-approval requirements: identify every workflow where AI takes autonomous action and confirm each has a documented approval gate or scope boundary.
  • ☐Review your procurement team's understanding of governance-as-criterion: brief them on what federal buyers now expect to see in technical proposals, including governance frameworks, audit trails, and incident response procedures.
  • ☐Assess whether your current AI governance program produces artifacts that can be shared with government auditors, such as model cards, risk assessments, and testing records, not just internal policies.
  • ☐Track the first-party acquisition award date as a signal: the governance terms embedded in that earlier award will likely set the floor for what the third-party solicitation requires.

What to watch next

Compliance teams should monitor the October 2026 solicitation release for VA governance documentation requirements. Those terms will signal federal procurement norms for AI vendors across agencies. The NIST AI Risk Management Framework Playbook and in-force U.S. General Services Administration AI Strategies and Compliance Plan are likely reference points for what evaluators will assess. Watch also for whether the first-party agentic tool award imposes human-oversight conditions that cascade to third-party integrators as contractual obligations.

Related Coverage

Standards2026-11-04

First AI Company Earns FedRAMP 20x Class C, Resetting Federal Vendor Eligibility

Perplexity has become the first AI company to receive a full FedRAMP 20x Class C authorization under the 2026 Consolidated Rules. The certification covers Perplexity Enterprise and its application programming interface (API) Platform for use by the General Services Administration (GSA) and the Department of Agriculture (USDA). Security is now measured through outcome-based Key Security Indicators rather than narrative documentation, changing what vendors must demonstrate to qualify.

Research2026-10-31

Agentic AI, Shadow AI, and Supply Chain Risk Form One Enterprise Control Gap

A peer-reviewed survey in Applied Sciences argues that agentic AI security, unauthorized employee AI use, and AI supply chain risk should be governed as a single interconnected exposure. These should not be treated as three separate programs. The paper identifies asset inventories, vendor due diligence, agent identity controls, and incident response as the controls most likely to fail when these risks are managed in silos. Compliance teams that treat the three risk areas separately will have gaps that auditors and regulators are increasingly equipped to find.

Corporate Policy2026-10-28

Delaware's AI Company Structure Would Shield Humans From AI-Driven Liability

Delaware is advancing a proposal to create an Artificial Intelligence Company (AIC). This new corporate structure allows AI agents to fully manage business operations with no human required to make decisions. Human members who fund an AIC would be insulated from liability for AI-driven harms, except in cases of fraud or willful legal violations. US House Oversight Committee Chairman James Comer has raised objections, warning the structure could enable liability evasion and signaling possible federal legislation to limit state AI regulatory authority.