An Adaptive Procurement System, Not a One-Time Award
The central question in public-sector AI procurement is not whether an agency should adopt AI in the abstract. It is whether the agency can create enough public value, evidence, authority, and learning capacity to govern the capability after adoption. The answer supported by the evidence is clear in direction but bounded in certainty: contract award is necessary to establish a relationship, yet insufficient to manage a changing service, a changing workflow, or a changing public consequence. An agency should therefore judge an acquisition as an adaptive system whose control must survive the award and improve through use.
Award as a hinge between two lifecycles
The acquisition lifecycle and the AI lifecycle meet at the contract, but they do not end there. Before award, the agency defines a mission need, translates it into requirements, evaluates a market, and negotiates terms. During award, it selects a supplier and commits public resources. After award, it must authorize use, oversee performance, assess changes, and decide whether to continue. Alongside that process, the AI capability moves through design, development, deployment, and continuous monitoring. The model or service may change; the data and population may change; operators may adapt their behavior; and the surrounding organization may redesign its workflow.
The award is the hinge because it converts assumptions into leverage. A requirement becomes a performance claim. A testing plan becomes a source of evidence. A discussion about data becomes a right or restriction. A choice of contract route becomes a trade-off between speed, flexibility, specificity, transparency, and cost. A responsibility that is left implicit becomes a problem for the people operating the system later. The award does not predict the future, but it determines how much of the future the agency will be able to see and influence.
This is the chain that makes early omissions consequential. If the agency cannot define the mission outcome, it cannot define a meaningful test. If it cannot obtain independent validation data, it must rely more heavily on the vendor’s account of performance. If it does not secure rights over data, outputs, records, or portability, it may not be able to share results, compare suppliers, or leave the service. If it chooses a route that moves quickly but does not specify update notification or monitoring, a later model change can become an operational event without a contractual response. If the agency measures only technical output and not user behavior or public outcomes, it may mistake activity for value.
The converse is also important. A pre-award gap does not make later governance impossible in every case. An agency can renegotiate, add terms in follow-on actions, establish an independent test, or change the workflow. But each repair may cost more after the agency has become dependent on the vendor or has already exposed people to the system. DOD’s Maven experience, as reported by GAO, shows officials adding more specific requirements and performance metrics in later contracts after learning that early contracts did not give them enough accountability for deliverables. That is evidence of institutional correction, but also of leverage that would have been cheaper to secure earlier.
The broad federal finding is similarly two-sided. GAO found agencies experimenting with multiple acquisition approaches because AI capabilities and markets were changing rapidly. It also found recurring challenges involving subject-matter expertise, data and intellectual-property rights, requirements and contract terms, testing, traditional timeframes, and price. These are not six unrelated administrative categories. They are points in the same control chain. Expertise affects requirements and interpretation. Requirements affect tests and accountability. Rights affect sharing and exit. Time and route affect what terms can be negotiated. Cost affects whether the agency can sustain monitoring and whether continuing operation remains justified.
The cross-jurisdictional checklist analysis and the public-sector governance synthesis reinforce this chain from different kinds of evidence. The checklist study found that technical checklists require experts, that narrow compliance can miss the purpose of a safeguard, and that public transparency is needed because even expert audits are imperfect. The later synthesis treats frontier general-purpose AI as a governance problem under uncertainty and proposes adaptive rather than static controls. Neither source proves that one institutional design will work everywhere.