Cheap to license, slow to permit: federal AI’s bottleneck moved to the CISO’s desk
GSA’s August 2025 agreements made leading AI tools nearly free for agencies. The price did not grant the three permissions that decide real use: a security authorization, a ruling on what data may go in, and an owner for the records and oversight duties.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On August 5, 2025, the General Services Administration added OpenAI, Google and Anthropic models to its Multiple Award Schedule. On August 6, under its OneGov strategy, GSA announced that OpenAI would offer ChatGPT Enterprise to federal executive branch agencies for $1 per agency for the next year. Similar offers followed within weeks. On August 12, Anthropic offered Claude to all three branches of government for $1, and on August 21 Google announced Gemini for Government at 47 cents per agency. GSA had launched OneGov in the spring of 2025 to negotiate government-wide terms directly with large software providers. It presented the AI agreements as a way to speed adoption under the administration’s AI Action Plan, released in late July.
Federal software purchases usually stall on money. A budget line has to exist, an acquisition strategy has to be approved, and a contract vehicle has to be found. The August 2025 agreements removed all three obstacles at once for a year. They did not remove the other gate every agency tool must pass: permission to use it on real work.
That permission has three parts, and each sits with a different office. The first is a security authorization from the chief information security officer. The second is a ruling on what data may go into the tool, which involves privacy, legal and records staff. The third is accountability: someone has to own the records the tool generates and the oversight duties federal AI policy imposes. Price affects none of them. With the license nearly free, these became the binding constraints on how fast agencies could put AI to work.
The security authorization
Agencies may not run a system without an authorization to operate. For cloud services, that normally rests on a FedRAMP authorization at the right impact level, which the agency then reviews and accepts. When the dollar offers arrived, the security packages lagged behind the price. In late August, FedRAMP said it would prioritize authorization of several conversational AI services, including ChatGPT Enterprise and Gemini for Government, through its faster 20x process, initially at the Low impact level.
That sequence put CISOs in a familiar bind. Low is suited to information whose loss would have limited effect. Much agency work involves personal data or controlled unclassified information that normally calls for Moderate controls. A CISO could refuse use until authorization caught up, issue a limited authorization restricted to public and low-sensitivity information, or accept the risk more broadly. Each choice has a cost. Refusal invites unsanctioned use on personal devices. A narrow authorization limits value. Broad acceptance puts the CISO’s signature on controls nobody has fully assessed.
The workable path for most agencies was the middle one, written precisely. A good authorization names permitted data types, required account settings, logging and retention configuration, and the conditions that would expand or revoke it. It also names a date for re-review once a higher authorization arrives.
Government-wide pricing also invited government-wide security work. When dozens of agencies assess the same tool separately, each CISO repeats the same review with the same gaps. Agencies that shared assessment documentation through FedRAMP or with peer agencies, and accepted each other’s findings where impact levels matched, spent their own effort on what was specific to them: their data and their configuration.
The data ruling
An authorization says the system is secure enough. It does not say which information staff may put into it. That question involves several regimes at once. The Privacy Act governs records about individuals retrieved by personal identifier. The E-Government Act requires a privacy impact assessment for new systems that collect personal data. Controlled unclassified information, federal tax information and law enforcement data each carry their own handling rules.
Staff need a ruling they can apply without a lawyer at their side. The most useful format is short: a list of data types that are permitted, permitted only in specific configurations, and prohibited. Technical controls should back it up. Data loss prevention rules can flag sensitive identifiers in prompts. Connectors to document stores should be enabled only after permission settings are checked, because an assistant connected to a shared drive will surface every file that was ever overshared.
Connecting the tool to agency data is where most value lies, and where the data ruling bites hardest. An agency that keeps the tool disconnected avoids the hard questions and gets a sophisticated drafting aid. One that connects it to case files gets more value and must answer every privacy question first.
Contract terms belong in the same ruling. Counsel should confirm what the agreement says about provider use of agency inputs, where data is processed, and how long it is retained after an account closes. Those terms decide whether a permitted data type stays permitted.
The accountability owner
OMB’s April 2025 AI memo, M-25-21, requires agencies to keep inventories of AI use cases, identify high-impact uses and apply minimum risk management practices to them, under a chief AI officer. A tool available to every employee generates use cases faster than any inventory process designed for a handful of pilots. Someone has to decide which uses are high-impact and check that the required practices are in place.
Records are the quieter duty. Prompts and outputs used in official business can be federal records. They may be subject to retention schedules, Freedom of Information Act requests and litigation holds. The agency needs to know how the tool stores conversations, whether administrators can export and preserve them, and how long they persist. Records officers rarely sit in AI pilot meetings, and that absence shows up later as an unanswerable records request.
None of these offices received new budget with the dollar license. Their review time was the main cost of adoption, and the queue for their attention set the pace. Agencies that staffed those reviews, or standardized them into templates other agencies could reuse, moved faster than agencies that relied on goodwill.
With hindsight
GSA kept extending the model. On August 14, 2025, it launched USAi, a shared platform for agencies to evaluate models. On September 2 it announced a OneGov agreement with Microsoft that included Microsoft 365 Copilot at no cost for a year for eligible customers. Adoption grew quickly, although published usage figures came mostly from GSA and the vendors.
In September 2026, GSA announced that OpenAI’s $1 arrangement would give way on October 1 to a 27-month agreement built on discounted, usage-based pricing, which brings renewal economics into view. We return to that question later in this series. What the first year showed is that price was never the constraint for long. The agencies that moved fastest had written narrow, explicit authorizations, given staff a simple data ruling, and put a records officer and a chief AI officer’s staff in the room from the start.