Cheap to license, slow to permit: federal AI’s bottleneck moved to the CISO’s desk

The week

For a few weeks in August 2025, some of the most talked-about software in the world became, for federal agencies, almost free.

It began on August 5, when the General Services Administration, the agency that acts as the federal government’s central buyer and landlord, added OpenAI, Google and Anthropic models to its Multiple Award Schedule. The Schedule is essentially a pre-approved catalog: once a product is on it, agencies can buy it without running a full procurement from scratch.

The next day, August 6, GSA announced under its OneGov strategy that OpenAI would offer ChatGPT Enterprise to federal executive branch agencies for $1 per agency for the next year. ChatGPT Enterprise is the business version of the popular AI assistant, a tool that can draft documents, summarize long reports and answer questions in everyday language. The dollar was a real price, designed to remove cost as an argument.

Similar offers followed within weeks. On August 12, Anthropic offered its Claude assistant to all three branches of government, executive, legislative and judicial, for $1. On August 21, Google announced Gemini for Government at 47 cents per agency.

The deals came out of OneGov, a strategy GSA had launched in the spring of 2025 to negotiate government-wide terms directly with large software providers, rather than letting each agency strike its own deal. The logic is the same as a large company negotiating one enterprise license instead of letting every department buy separately: more bargaining power, simpler terms, less duplicated effort.

GSA presented the AI agreements as a way to speed adoption under the administration’s AI Action Plan, released in late July. The message to agencies was clear: the price is no longer your obstacle. What the announcements did not say is that price was only one of several gates every agency tool must pass. The others belonged to offices that had no say in the deal and received no extra resources because of it.

Federal software purchases usually stall on money. A budget line has to exist, an acquisition strategy has to be approved, and a contract vehicle (an existing contract or catalog the agency can buy through) has to be found. The August 2025 agreements removed all three obstacles at once for a year. They did not remove the other gate every agency tool must pass: permission to use it on real work.

That permission has three parts, and each sits with a different office. The first is a security authorization from the chief information security officer, or CISO, the executive responsible for protecting the agency’s systems and data. The second is a ruling on what data may go into the tool, which involves privacy, legal and records staff. The third is accountability: someone has to own the records the tool generates and the oversight duties federal AI policy imposes. Price affects none of them. With the license nearly free, these became the binding constraints on how fast agencies could put AI to work.

This pattern is not unique to government. Any organization that has been offered a free trial of a powerful tool knows the feeling: the vendor is ready on Monday, and security, legal and compliance are ready some months later. The August deals made that gap unusually visible.

What a dollar actually bought

The tools agencies were actually being offered, ChatGPT Enterprise, Claude and Gemini for Government, are generative AI assistants built on large language models. A large language model is software trained on enormous amounts of text so that it can predict, word by word, a plausible response to a question or instruction. In practice that means it can draft a memo, summarize a 200-page report, rewrite a letter in plainer English, or answer questions about documents you give it. It does not “know” things the way a person does, and it can state something false with complete confidence, which is why human review matters.

The enterprise and government versions differ from the free consumer versions in ways that matter to a CISO and a general counsel. They typically come with administrator controls, single sign-on through the organization’s own accounts, logging of activity, and contract terms about how the provider may use the data people type in. Those differences are the reason agencies can consider them at all.

Two features change the risk picture sharply. The first is what goes into the prompt, the text a user types or pastes in. The second is connectors: links that let the assistant read documents from the agency’s own file stores, email or case systems. A disconnected assistant knows only what a user hands it. A connected one can reach whatever the user can reach, and often more than the user realizes.

The security authorization

Agencies may not run a system without an authorization to operate, or ATO: a formal, signed decision by an agency official that a system’s security risks are acceptable. For cloud services, that normally rests on a FedRAMP authorization at the right impact level, which the agency then reviews and accepts. FedRAMP is the government-wide program that assesses cloud services against a standard set of security controls, so that each agency does not have to start from zero.

FedRAMP sorts systems into impact levels, chiefly Low, Moderate and High, according to how much harm would follow if the data they hold were exposed or altered. The higher the level, the more controls a provider must demonstrate.

When the dollar offers arrived, the security packages lagged behind the price. In mid-August, FedRAMP published criteria for prioritizing authorization of conversational AI services through its faster 20x process, and in the following weeks it added services including ChatGPT Enterprise and Gemini for Government to the list. At the time, 20x authorizations were available only at the Low impact level, with a Moderate pilot still being planned.

That sequence put CISOs in a familiar bind. Low is suited to information whose loss would have limited effect. Much agency work involves personal data or controlled unclassified information that normally calls for Moderate controls. A CISO could refuse use until authorization caught up, issue a limited authorization restricted to public and low-sensitivity information, or accept the risk more broadly. Each choice has a cost. Refusal invites unsanctioned use on personal devices, so-called shadow AI, where staff simply use the consumer version on their phones. A narrow authorization limits value. Broad acceptance puts the CISO’s signature on controls nobody has fully assessed.

The workable path for most agencies was the middle one, written precisely. A good authorization names permitted data types, required account settings, logging and retention configuration, and the conditions that would expand or revoke it. It also names a date for re-review once a higher authorization arrives.

Government-wide pricing also invited government-wide security work. When dozens of agencies assess the same tool separately, each CISO repeats the same review with the same gaps. Agencies that shared assessment documentation through FedRAMP or with peer agencies, and accepted each other’s findings where impact levels matched, spent their own effort on what was specific to them: their data and their configuration.

The data ruling

An authorization says the system is secure enough. It does not say which information staff may put into it. That question involves several regimes at once. The Privacy Act governs records about individuals retrieved by personal identifier, such as a name or Social Security number. The E-Government Act requires a privacy impact assessment, a structured written analysis of what personal data a system collects and how it is protected, for new systems that collect personal data. Controlled unclassified information (sensitive but not classified material, such as certain law enforcement or infrastructure details), federal tax information and law enforcement data each carry their own handling rules.

Staff need a ruling they can apply without a lawyer at their side. The most useful format is short: a list of data types that are permitted, permitted only in specific configurations, and prohibited. Technical controls should back it up. Data loss prevention rules, software that scans outgoing text for patterns like Social Security numbers, can flag sensitive identifiers in prompts. Connectors to document stores should be enabled only after permission settings are checked, because an assistant connected to a shared drive will surface every file that was ever overshared.

That last point deserves a moment. In most large organizations, file permissions have drifted for years: a folder shared “with everyone” for a quick project, a spreadsheet of personnel data left open to a whole division. Nobody noticed because nobody went looking. An AI assistant goes looking on every request. Ask it “what do we know about the reorganization?” and it may happily summarize a draft no one was supposed to see.

Connecting the tool to agency data is where most value lies, and where the data ruling bites hardest. An agency that keeps the tool disconnected avoids the hard questions and gets a sophisticated drafting aid. One that connects it to case files gets more value and must answer every privacy question first.

Contract terms belong in the same ruling. Counsel should confirm what the agreement says about provider use of agency inputs, where data is processed, and how long it is retained after an account closes. Those terms decide whether a permitted data type stays permitted.

The accountability owner

OMB’s April 2025 AI memo, M-25-21, requires agencies to keep inventories of AI use cases, identify high-impact uses and apply minimum risk management practices to them, under a chief AI officer. OMB, the Office of Management and Budget, sets policy that executive branch agencies must follow. A “use case” is simply a specific way the tool is being used, for instance drafting public correspondence, or summarizing benefit applications.

A tool available to every employee generates use cases faster than any inventory process designed for a handful of pilots. Someone has to decide which uses are high-impact and check that the required practices are in place. Drafting an internal meeting summary is very different from summarizing a veteran’s claim file that will inform a benefits decision, yet both may happen in the same tool on the same afternoon.

Records are the less visible duty. Prompts and outputs used in official business can be federal records. They may be subject to retention schedules (the rules for how long each kind of record must be kept), Freedom of Information Act requests and litigation holds, the legal instruction to preserve material relevant to a lawsuit. The agency needs to know how the tool stores conversations, whether administrators can export and preserve them, and how long they persist. Records officers rarely sit in AI pilot meetings, and that absence shows up later as an unanswerable records request.

The dollar license brought these offices no new budget. Their review time was the main cost of adoption, and the queue for their attention set the pace. Agencies that staffed those reviews, or standardized them into templates other agencies could reuse, moved faster than agencies that relied on goodwill.

Two agencies, one price

Suppose two agencies both accept the same $1 offer in August.

The first announces the deal internally the same week. The CISO, under pressure, waits for a higher authorization and tells staff not to use the tool yet. Records and privacy staff are not consulted. Within a month, the help desk notices staff pasting work text into consumer AI apps on personal phones. The tool the agency paid a dollar for sits idle, while the risk it was meant to manage happens anyway, out of view.

The second agency takes a different route. Before announcing anything, its CISO writes a two-page limited authorization: public and low-sensitivity information only, single sign-on required, logging switched on, conversations retained to match the records schedule, re-review when a Moderate authorization arrives. The privacy officer publishes a one-page list: press releases and public reports permitted; internal drafts permitted with no personal data; applicant files prohibited for now. The records officer confirms that conversations can be exported for a FOIA request. The chief AI officer’s staff add a short form for anyone who wants to use the tool for something new.

The second agency spends a few weeks of staff time up front, and it shows. It gets real, visible use on low-risk work, a clear path to expand, and answers ready when an inspector general or a reporter asks how the tool is governed. Both agencies paid the same for the license; the difference in outcome came from that up-front staff time.

Money, risk and public trust

It is easy to read the dollar deals as a story about procurement. For an agency head, deputy secretary or general counsel, the more useful lens is what the reviews protect, and what each kind of failure would cost.

Money. A license that costs a dollar is not a free program. The real spending is staff time: the CISO’s team reviewing controls, privacy staff writing assessments, records officers configuring retention, trainers explaining the rules, and help desks fielding questions. The deal paid for none of it. An agency that does not plan for it either stalls or cuts corners. And because the attractive price was for a year, every habit the agency builds is also a future cost decision.

Security and privacy risk. The worst outcomes here are not exotic. They are an employee pasting a list of names and benefit details into a tool that was only approved for public information, or an assistant summarizing a sensitive personnel file because a folder was shared too widely years ago. Either can become a reportable privacy incident, with notification duties, congressional interest and press coverage.

Legal exposure. If AI conversations are federal records and the agency cannot find or preserve them, that is a records management failure that can surface in litigation, where a court expects relevant material to be kept, or in a FOIA dispute, where a requester expects a complete search.

Public trust. Government use of AI draws attention. An agency that can explain plainly what its staff use AI for, what data is off limits and who is accountable is in a strong position when an oversight body or reporter asks. An agency that cannot is in a weak one, even if nothing has gone wrong yet.

Seen this way, the security, privacy and records reviews are the part of the deal that protects the agency’s mission and its reputation, rather than bureaucratic friction slowing down a good one.

Narrow approvals, early reviewers

The agencies that got value from the deals had a few habits in common. They wrote a narrow authorization that said exactly what was allowed and when it would be reconsidered. They gave staff a one-page data ruling in simple language, backed by technical controls rather than trust alone. They cleaned up file permissions before any connector was switched on. They brought records, privacy and the chief AI officer’s staff into the first meeting, not the last, and they shared security assessments with peer agencies instead of repeating them.

The failures ran the other way. Some agencies treated a low price as a decision already made and left the reviewers to catch up. Some imposed an outright ban that drove staff to consumer tools no one could see. Some assumed the contract protected agency data without counsel reading the terms. And many forgot that the free year would end, and that habits formed at $1 would be priced differently later.

Permissions, records and reviewer time to settle before the free year ends

• Which AI tools are our staff allowed to use today, for what kinds of information, at what impact level, and where is that written down?
• Are staff using consumer AI tools on personal devices because the approved one is unavailable or too restricted?
• Before we connect an assistant to our shared drives, who has checked what is overshared there, and what does the contract say about the provider using our inputs?
• If we received a FOIA request or litigation hold tomorrow covering AI conversations, could we produce them?
• How much reviewer time has this rollout consumed, is it funded, and what happens to cost and access when the first-year terms end?

With hindsight

GSA kept extending the model. On August 14, 2025, it launched USAi, a shared platform where agencies could evaluate and try different AI models before committing to one. On September 2 it announced a OneGov agreement with Microsoft that included Microsoft 365 Copilot at no cost for a year for eligible customers. Adoption grew quickly, although published usage figures came mostly from GSA and the vendors.

When the main evidence of success comes from the buyer that negotiated the deal and the sellers who offered it, agency leaders should rely on their own internal measures: how many staff use the tool, for what, and with what governance in place.

In September 2026, as the first-year terms ran out, GSA announced a 27-month OneGov agreement with OpenAI, expected to take effect on October 1, built on discounted, consumption-based pricing. Consumption-based pricing means paying for how much the tool is actually used, rather than a flat fee. That brings renewal economics into view, because a tool that cost a dollar becomes a line item that grows with every query.

What the first year showed is that price was never the constraint for long. The agencies that moved fastest had written narrow, explicit authorizations, given staff a simple data ruling, and put a records officer and a chief AI officer’s staff in the room from the start.

The broader point travels well beyond government. A vendor can drop the price of a tool to almost nothing overnight. It cannot drop the cost of deciding how to use it safely. That cost lives in the time of security, privacy, legal and records professionals, and organizations that plan and fund that time get the value; those that do not get either an idle license or unseen, ungoverned use.