U.S. General Services Administration AI Strategies and Compliance Plan
Issued by
U.S. General Services Administration
- September 30, 2026 · Correction — Labeled as executive action: it governs the agency's own AI use. (Cody Maxwell)
- September 30, 2026 · Correction — Corrected the date: the plan was published in September 2025 and is in force, not a July 2026 draft (fact-check finding). (Cody Maxwell)
- October 1, 2026 · Correction — Rewrote the practical steps, newsletter hook, search description, and audience fields to match the entry's corrected content. (Cody Maxwell)
The GSA AI Strategies and Compliance Plan from the US General Services Administration (GSA) establishes governance for internal agency AI use. An AI Governance Board and oversight committee review and approve use requests. Requirements cover privacy controls, security reviews, use-case intake, and compliance evidence.
Applies To
Overview
Published in September 2025 in response to OMB memos M-25-21 and M-25-22, this plan sets GSA's internal approach to AI governance. The EDGE Board, co-chaired by the Chief Data Officer and Deputy Administrator, sets risk tolerance and approves high-impact use cases. A cross-functional oversight committee supports the Board by conducting technical, privacy, and security reviews of proposed AI use cases before deployment. The plan aligns with federal AI policy requirements, including Executive Order mandates and Office of Management and Budget (OMB) guidance on responsible AI use in government. Key provisions address access controls, use-case intake procedures (how proposed AI uses are submitted for approval), and the ongoing collection of compliance evidence to support accountability. Although the plan governs internal GSA operations, its structure and documentation standards have direct relevance to vendors, contractors, and enterprises that supply AI-enabled products or services to the GSA. Procurement implications are significant, as supplier conformity with GSA security and privacy expectations is embedded in the compliance framework.
Key Requirements
- •Establish and maintain an AI Governance Board with authority to approve or reject internal AI use cases
- •Operate a cross-functional oversight committee to conduct privacy and security reviews of AI requests before deployment
- •Implement a formal use-case intake process for all proposed AI applications within the agency
- •Apply documented privacy and security controls to all AI systems in use, consistent with federal standards
- •Collect and maintain compliance evidence to support auditability and accountability for each deployed AI system
- •Align AI adoption decisions with applicable federal AI policy, including OMB guidance and relevant Executive Orders
What Your Organization Must Do
- →Map your AI governance against GSA's two tiers: board approval and committee-level technical review.
- →Build a formal intake process that records every proposed AI use before deployment.
- →Keep evidence of privacy, security, and access control reviews for each deployed AI system.
- →Check solicitation and contract terms for GSA security and privacy expectations if you supply AI products.
- →Brief sales and bid teams that documentation gaps may affect eligibility for GSA contracts.
- →Track OMB memos M-25-21 and M-25-22 and GSA directive CIO 2185.1C for related changes.
Playbook Guidance
Step-by-step implementation guidance for compliance teams.
Frequently Asked Questions
- Does the GSA AI Strategies and Compliance Plan apply to private sector vendors supplying AI tools to the GSA?
- The plan governs internal GSA operations, but its privacy and security control requirements are embedded in procurement expectations. Vendors and contractors supplying AI-enabled products or services to the GSA should expect conformity with these standards to affect contract eligibility and solicitation requirements.
- What is the role of the GSA AI Governance Board under this plan?
- The EDGE Board, GSA's AI governance board, sets risk tolerance and approves high-impact use cases. The AI Oversight Committee reviews AI requests and assesses risk before deployment.
- When does the GSA AI Strategies and Compliance Plan take effect?
- The plan was published in September 2025 and is in force, not a draft. Its governance bodies already operate, and GSA directive CIO 2185.1C, issued in March 2026, puts them into practice.
- What compliance evidence do AI suppliers need to maintain to satisfy GSA audit expectations?
- The plan requires ongoing collection of compliance evidence for each deployed AI system to support auditability and accountability. Suppliers should maintain documentation covering security and privacy reviews, use-case intake submissions, and access control measures applied prior to deployment.
- How does the GSA-AICP align with existing federal AI policy requirements like OMB guidance and Executive Orders?
- The plan explicitly references alignment with OMB guidance on responsible AI use in government and applicable Executive Order mandates. It operationalizes those federal-level requirements through its tiered governance structure, use-case intake process, and documented control standards.
- What gaps should AI vendors assess in their own governance structures before pursuing GSA contracts?
- Vendors should benchmark their internal AI governance against the GSA's two-tier model, which separates board-level decision authority from committee-level technical review. Gaps in formal intake processes, security review documentation, or compliance evidence maintenance are likely to affect contract eligibility under this framework.