Procurement Is Becoming a Hidden Form of AI Regulation

Governments may debate AI legislation for years, but procurement officials are already determining which AI systems can enter public institutions.

A solicitation can require security testing, model documentation, data residency, accessibility, human oversight, incident reporting, intellectual property protections, and performance monitoring. These contractual requirements may shape the market faster than a new statute.

This makes procurement a hidden form of AI regulation.

OMB Memorandum M-25-22 directs federal agencies to acquire AI quickly, competitively, and responsibly. It addresses the AI acquisition lifecycle, including market research, data use, competition, testing, contractual protections, and vendor performance.

A 2026 GAO review recommended that agencies use cross-functional procurement teams, test AI systems, demand pricing transparency, define licensing terms, address data and model portability, and include protections against vendor lock-in.

These are reasonable objectives. The difficulty is proportionality.

A procurement package designed for a high-impact national security system should not automatically be imposed on a low-risk administrative tool. Excessive requirements can prevent small companies from competing even when they offer innovative and responsible products.

At the same time, weak contracts can expose agencies to long-term dependency. An organization may discover that it cannot retrieve its training data, reproduce an output, transfer a workflow, or continue operations without paying the original vendor.

Procurement officers are therefore becoming AI governance professionals, whether or not the title appears in their job descriptions.

They need technical, legal, cybersecurity, privacy, accessibility, and operational expertise. They must purchase not only a model, but also the rights, controls, evidence, and continuing support needed to govern it.