One-time money, recurring bills: the Rescue Plan’s technology hangover

The week

On March 11, 2021, President Biden signed the American Rescue Plan Act, a $1.9 trillion relief package. Most of the headlines went to the parts households felt directly: direct payments, extended unemployment benefits and health coverage subsidies. But tucked inside was something that would shape government technology budgets for years.

The bill had moved quickly. It passed through budget reconciliation, a procedure that lets certain spending bills pass the Senate by simple majority. The Senate approved its version on March 6, the House gave final approval on March 10, and the President signed it the next day. It passed without Republican votes in either chamber.

The law created the Coronavirus State and Local Fiscal Recovery Funds, $350 billion for states, territories, tribes, counties and cities. Roughly $195 billion went to states and the District of Columbia, roughly $130 billion to local governments, $20 billion to tribal governments and $4.5 billion to territories. Counties and larger cities received money directly from Treasury. Smaller towns, which Treasury called non-entitlement units, received theirs through their state.

It also funded the Emergency Connectivity Fund for schools and libraries, meant to help students and patrons get online. A separate Capital Projects Fund was aimed largely at broadband, the high-speed internet connections many communities still lacked.

Other technology money was scattered through the act. It gave the federal Technology Modernization Fund $1 billion, added funding for CISA, and set aside money for the Labor Department to modernize unemployment insurance systems and fight fraud. A separate education title sent about $122 billion to school districts through the Elementary and Secondary School Emergency Relief fund, which many districts also used for devices and software.

The design was a deliberate break from 2020. The CARES Act’s Coronavirus Relief Fund, passed a year earlier, had been narrower. It could cover only new costs caused by the pandemic, and it could not replace lost revenue. Many governments found it hard to spend well within its rules and deadlines. The new funds were built to be broader and to last longer.

Treasury began sending the first payments in May 2021. Recipients had to file regular project and expenditure reports, and states and larger local governments also had to publish annual recovery plans describing how they were using the money. Those reports recorded categories and amounts spent, which matters later in this story.

The detailed rules came later. The Treasury Department, which administered the recovery funds, issued an interim final rule in May 2021 and its final rule in January 2022. An interim final rule is a set of regulations that takes effect right away while the agency gathers comments, and the final rule is the settled version.

The eligible uses were broad. They included responding to the public health emergency and its economic effects, premium pay for essential workers, water, sewer and broadband infrastructure, and replacing lost public-sector revenue. That last category was the sleeper. Revenue replacement meant a government could use the money to cover income it had lost during the pandemic, which could in turn pay for general government services, including technology.

There were limits. States could not use the money to offset tax cuts, a provision that several states challenged in court. No recipient could deposit it into pension funds. The money came in two payments, roughly a year apart, which gave recipients time to plan and also stretched the period over which decisions were made.

And there was the clock. Funds had to be obligated, meaning formally committed through a contract or similar binding agreement, by the end of 2024, and spent by the end of 2026.

For a county, this was a rare moment. It had a large pot of money, more flexible than almost any grant, with few strings on what to buy. It could pay for things put off for years. The catch was easy to miss in the excitement. The money would stop, and someone would have to decide what happened to everything it had started paying for.

For state and local technology leaders, the recovery funds were the largest flexible funding event in a generation. The useful test of them is not what got bought, such as new systems, laptops and security tools. It is the fit between how the money arrived and how modern technology is paid for.

The mismatch has three parts, and each created its own exposure. The first is the funding shape: large, flexible and temporary. The second is the cost shape of what agencies bought, increasingly recurring. The third is the contract terms that connected the two, often negotiated under deadline pressure. No knowledge of cloud services is needed to see the problem. It is the same as using a one-time bonus to sign a lease.

The mismatch did not fall evenly. A large state had a budget office, a central IT agency and a procurement team that negotiated enterprise contracts every year. A small town might have a clerk, a part-time treasurer and an IT vendor on call. Counties and cities sat between, often with capable staff stretched across many funding streams at once. The same three parts applied to all of them, but the smaller the government, the more each part depended on one or two people.

The sections below take the funding shape first, then a short explanation of how technology buying changed, then the cost shape and the contract terms. They close with who bears the consequences, how one county could handle the same purchase two ways, and the questions that tell a government where it stands.

The funding shape: generous, flexible and temporary

The recovery funds had two properties that rarely appear together in public finance. They were large relative to many local budgets. They were also flexible, especially after Treasury’s final rule let recipients claim a standard revenue-loss allowance of up to $10 million. A government could simply elect to treat up to $10 million as replacement for lost revenue, without proving the loss in detail. That money could pay for general government services with lighter reporting. And the funds were explicitly temporary, with fixed deadlines to obligate and spend.

Temporary money suits things that end: a broadband build, a backlog clearance, a data migration, the replacement of a failing benefits system. Each has a start, a finish and something lasting at the end. Temporary money suits poorly anything that carries an annual bill.

Finance officers knew this. The difficulty was that the most urgent technology needs of 2021 rarely fit the one-off pattern. The revenue-loss route also made it easy to fund ongoing services without a separate debate about who would pay for them later. When money is flexible, it can flow to anything, including commitments that outlive it.

Timing made the problem worse. Many agencies spent their first year on planning and public engagement, then faced a compressed window to obligate funds by the end of 2024. Money that must be committed by a date tends to flow toward whatever can be contracted quickly. In technology, that usually means a subscription from a vendor already on a cooperative contract. That is an agreement one government or purchasing group has already competed that others are allowed to buy from without running their own full tender.

How revenue replacement worked

The revenue-loss category deserves a closer look, because it shaped how much technology spending escaped scrutiny. Under the interim rule, a government calculated its loss with a formula that compared actual general revenue with a pre-pandemic trend. The difference, if any, could be spent on government services.

The final rule added the standard allowance as an alternative. For a recipient whose whole allocation was under $10 million, electing the allowance meant the entire award could be treated as revenue replacement. That described most small towns and many counties. For them, the recovery funds were in effect general-purpose money with a federal reporting wrapper.

Money spent this way carried lighter compliance and reporting requirements than money spent under the other eligible categories. That was a sensible design for small governments with little grant administration capacity. It also meant that a cloud subscription bought under revenue replacement might be reported only as spending on “government services.” Treasury’s reporting would show the category, not the run-rate it created.

How the shape varied by government

For states, the recovery funds were large in absolute terms but smaller relative to total budgets, and states had their own revenues rebounding by 2021. Their exposure was concentrated in specific agencies that received large one-time allocations for system replacements.

For counties and large cities, the funds were often a meaningful share of a year’s discretionary spending. Their governing boards faced competing claims from housing, public health, public safety and infrastructure. Technology competed for the same money as everything else, which pushed IT leaders toward proposals that looked inexpensive in year one.

For small towns receiving money through their state, the challenge was administrative. Many had never managed a federal award directly. They relied on state guidance, associations of municipalities and outside consultants. Their technology purchases were smaller, but a single new subscription could still be a noticeable addition to a small operating budget.

Tribal governments had their own allocation and their own constraints, including in many cases limited existing broadband and IT infrastructure. For them, the line between one-time capital and recurring service was often the line between building a network and paying to run it.

The objection: flexibility was the right design

A fair critic would say the flexibility was the point. The CARES Act money had been hard to use because it was narrow. Treasury’s final rule loosened the interim rule because recipients, especially small ones, asked for simpler compliance. Governments knew their own needs better than a federal formula did.

That is correct, and the argument here does not dispute it. Flexibility let governments fix things that had broken in 2020. The problem is narrower: flexibility removed the moment when someone would normally ask who pays next year. A conventional grant application forces that question. Flexible money allows it to be skipped. Governments that kept the question in their own approval process got the benefit of the flexibility without the hangover.

From fire trucks to subscriptions

The funding shape and the cost shape collided because of how technology buying changed over the previous decade.

Not long ago, a government bought software much as it bought a fire truck. It paid a large sum upfront for a license, installed the software on servers it owned, and then paid a smaller annual maintenance fee. The big purchase could be treated as a capital investment, an asset with a useful life of several years.

Today, most software is sold as a service. Software as a service, often shortened to SaaS, means the vendor runs the software on its own computers and the customer pays a recurring fee, usually per user per year, to use it over the internet. It is the difference between buying a car and leasing one. You get the use of the thing and someone else maintains it. But the payments never stop as long as you want to keep using it.

Cloud hosting works the same way at a lower level. Instead of buying servers, an agency rents computing power and storage from a provider and pays for what it uses each month, like an electricity bill.

The same shift has happened to security. Tools that protect computers, check who is logging in and watch for attacks are now mostly subscriptions, and many come bundled with a team of people at the vendor who do the watching. There is nothing wrong with any of this. Often it is better: the vendor handles updates, the service scales up and down, and small agencies get capabilities they could never build. But it changes the budgeting question entirely. The cost of a service is the price every year, forever, plus whatever it would cost to leave, rather than its price in year one.

Why public budgets struggle with the shift

Many state and local budgets separate a capital budget from an operating budget. Capital budgets fund long-lived assets, often with borrowed money, and are approved project by project. Operating budgets fund the recurring cost of running government and must usually balance each year.

The old software model fitted the capital budget. A new financial system could be bonded, depreciated and planned around a ten-year life. The subscription model belongs in the operating budget. Every new service competes each year with salaries, utilities and every other recurring cost.

Recovery funds could be spent on either. That made them an easy bridge across the gap between the two budgets. A project that would never have won an operating-budget increase could be started with federal money. The question of how to carry it was simply postponed.

The cost shape: subscriptions, not assets

By 2021, much of what agencies needed was sold as a service. Cloud hosting, software-as-a-service case management, endpoint protection, identity platforms, collaboration suites and managed detection all carry recurring fees. Case management is the software caseworkers use to track applications and clients. Endpoint protection is security software on each laptop and desktop. Identity platforms manage who can log in to what. Collaboration suites are the email, chat and document tools staff use daily. Managed detection is a service in which an outside team watches your systems for attacks around the clock.

A county that used recovery funds to move permitting, benefits intake or court scheduling to a cloud service was starting a payment stream, not buying an asset.

That was often the right call. The pandemic had shown how fragile paper and on-premises processes were. But a one-time grant was also creating a future operating cost that few budgets showed. Where agencies phased those costs into general fund budgets over several years, the investment held. Where they did not, the system’s survival depended on a budget conversation scheduled for after the federal money ran out.

Cybersecurity shows the mismatch most sharply. Many governments used recovery funds, directly or through revenue replacement, for security. One common purchase was multi-factor authentication, which requires a second proof of identity, such as a code on a phone, in addition to a password. Others were endpoint detection, immutable backups (copies of data that cannot be altered or deleted for a set period, so ransomware cannot destroy them), and around-the-clock monitoring. These were sensible purchases after a year of ransomware attacks on cities, counties and school districts. Ransomware is malicious software that scrambles an organization’s files and demands payment to unlock them.

Almost all of these protections have value only while they keep running. A monitoring service that lapses after three years leaves an agency where it started, with staff who have come to rely on protection that is gone.

The same applies to the people side: a security analyst hired on grant-funded salary lines, or a managed service sized for a three-year term, needs a successor budget as much as any license does. Cyber insurers, meanwhile, began asking about exactly these controls at renewal, so a lapse could also raise premiums or narrow coverage. The cost of letting a service lapse may therefore show up in two places at once: in the risk itself and in the insurance bill.

Prepaid multi-year subscriptions added a subtler effect. Paying three years upfront from recovery funds made a service look cheap in its first years and hid its run-rate from the operating budget. The run-rate is simply what something costs per year to keep going. The true annual cost surfaced only at renewal, when price increases and the end of federal money arrived together.

Working out the real run-rate

The run-rate of a service is rarely the number on the first invoice. A finance office building the figure needs several components:

• The subscription itself. Units, such as users, devices or cases, times the unit price at renewal, not the introductory price.
• Growth in units. A system rolled out to one department often spreads to others, and the license count follows.
• The escalator. Any annual price increase the contract allows, and what the vendor’s list price is likely to do at renewal.
• Connected services. Hosting, storage, integration platforms and add-on modules billed separately.
• Support and administration. Vendor support tiers and the staff time needed to run the service.
• People. Any position created to operate the system, with benefits.

Staff positions need the same treatment. Many governments created limited-term positions for recovery-funded projects, and some of those positions ended up running services that outlived the projects. The run-rate of a security operations function includes the analysts, and an analyst who leaves when the grant line ends takes with them the knowledge of how the tools were configured.

A useful discipline is to split every recovery-funded project into its one-time and recurring parts at approval. Implementation, data migration, training and hardware are one-time. Licenses, hosting, monitoring and staff are recurring. Only the first group truly fits temporary money.

The accounting caught up, the budget did not

Governmental accounting changed in the same period. GASB Statement No. 96, which took effect for fiscal years beginning after June 15, 2022, requires governments to report many multi-year subscription arrangements in their financial statements. A qualifying subscription appears as a liability and as a right-to-use asset, rather than as a series of payments.

That made long subscription commitments more visible to auditors and to readers of annual financial reports. It did not put the run-rate into the budget. Financial statements look backward and report obligations. Budgets look forward and decide what to fund. A county could be fully compliant with the new accounting standard and still have no line in next year’s budget for a service its auditors had recorded.

The new standard did give finance officers a useful byproduct. To comply, they had to inventory subscription arrangements, their terms and their payment schedules. That inventory is most of the spreadsheet this article recommends. Governments that connected the accounting work to the budget forecast got two benefits from one exercise.

The objection: subscriptions are cheaper overall

A reasonable objection is that the run-rate framing makes subscriptions look worse than they are. Owning software was never free. It required servers that needed replacing, staff to patch them, upgrades every few years and disaster recovery. Many of those costs were hidden in other budget lines. A subscription bundles them into a visible fee.

That is often true, and it is a good argument for subscriptions. It does not answer the funding question. A cheaper recurring cost is still recurring. The argument here is about which money pays for it, not whether the service is good value. A service that is cheaper over ten years still fails if nobody budgets for year four.

The contract terms: speed against durability

Recovery funds came with federal grant rules and reporting obligations, and with pressure to move quickly. Agencies used cooperative purchasing vehicles, emergency procurement where justified, and existing vendor relationships to obligate funds on time. These routes were legitimate, but they favored speed over the slower work of defining what happens after the first term.

Which purchasing rules applied

For most eligible uses, recovery funds were subject to the federal Uniform Guidance, the rules in 2 CFR Part 200 that govern how recipients of federal awards buy goods and services. Those rules require competition, documentation and certain contract clauses, scaled by the size of the purchase. They allow noncompetitive purchases in limited cases, including a genuine public emergency. State and local procurement law applied as well.

Money used under revenue replacement carried lighter federal requirements, and the recipient’s own procurement rules then did most of the work. Which rules applied to a given purchase depended on the category, the recipient and the date. Organizations should check with counsel and Treasury’s guidance for their own case.

The practical effect was that many technology purchases ran through cooperative contracts. These include multi-state vehicles managed by state purchasing officials, national purchasing cooperatives, and the federal government’s schedules that state and local governments may use for information technology. A government buying through one of them inherits a master agreement negotiated by someone else. It can usually add its own terms through a participating addendum or order, but only if it asks.

The clauses that matter later

The terms that matter most for a recurring service are the ones that apply later:

• Renewal price caps, which limit how much the vendor can raise the price when the first term ends.
• Data export in a usable format at no extra charge, so the agency can take its records with it if it leaves.
• Transition assistance if the agency changes provider, meaning the old vendor must help move to the new one.
• Clear ownership of configurations and integrations, the settings and connections to other systems that often represent months of work.
• The right to reduce license counts without penalty, so the agency is not paying for seats it no longer needs.

Three further provisions are specific to public buyers. The first is a non-appropriation clause, common in state and local contracts, which lets a government end a multi-year agreement if its legislature or board does not fund the next year. It protects the buyer when money runs out. A fully prepaid term gives it little to do. The second is an auto-renewal notice window: many subscriptions renew automatically unless the customer gives notice weeks or months ahead. Missing the window can lock in another year at a higher price. The third is records retention. Public bodies must keep many records for set periods under state law, and a contract should say how the vendor will preserve and return them.

Contracts signed in a hurry often left these thin. Nothing went wrong in 2022. The exposure arrives at renewal, when switching costs are highest and the agency’s bargaining power is weakest. By then, staff have been trained, workflows have been rebuilt around the system and years of records live inside it. The vendor knows that leaving would be painful, and prices accordingly.

The objection: there was no time

Procurement officers under deadline pressure might reasonably say that negotiating renewal and exit terms would have delayed contracts past the obligation date. Vendors on cooperative contracts often resist changes to standard terms.

The delay is smaller than it seems. The clauses above are standard in well-run public contracts, and many cooperative agreements already allow them. A government that wrote them into a template once could attach them to every order. The agencies that got good terms were rarely the ones with the most time. They were the ones that had decided in advance which terms they would not give up, and asked for them every time.

Who feels it when the renewal arrives

The technology is the cause, but the consequences land on the people who run budgets, answer to councils and serve the public.

For a finance director, the risk is a hole in the operating budget that appears all at once. Several services started in the same window will tend to renew in the same window, so the bill does not arrive gradually.

For a county administrator or mayor, the risk is a choice between unpleasant options. They can cut something else to keep the service running, renegotiate from a weak position, or switch providers and absorb the cost and disruption of another migration.

For residents, the risk is that a service they have come to rely on, such as applying for a permit online or scheduling a court date without standing in line, gets worse or disappears.

For a security leader, the risk is an unnoticed slide back to where the agency was before, often without anyone outside IT noticing until something goes wrong.

And for auditors and oversight bodies, the question is whether one-time federal money produced lasting public value or only a few good years.

Credit analysts watch the same pattern. Rating agencies have long treated the use of one-time revenue for recurring costs as a sign of structural imbalance in a government’s budget. A run of technology renewals with no funding source is a small example of exactly that. It is unlikely to move a rating on its own, but it adds to the picture a rating analyst forms of budget discipline.

There is also a staff dimension that is easy to overlook. Employees trained on a new system, who rebuilt their daily routines around it, experience a lapse or a forced migration as one more disruption in a period that has already had many. Caseworkers, clerks and dispatchers who have adapted twice are understandably wary of being asked to adapt a third time. Morale and retention are real costs, even if they never appear on an invoice.

Finally, there is the matter of trust between departments. When IT starts a service and finance discovers its cost only at renewal, the next request from IT will be met with more suspicion, however good it is. Getting the run-rate onto the table early is prudent budgeting, and it also protects the working relationship that every future technology investment depends on.

Where it lands hardest

The effect concentrates in a few kinds of service. Security monitoring and endpoint protection are hard to cut without visible risk. Benefits and case management systems are hard to leave because they hold years of client records. Collaboration suites are hard to shrink because every employee uses them. Broadband infrastructure, by contrast, is mostly a one-time build, though someone still has to operate and maintain the network.

School districts faced a parallel version through their own relief funds. Districts that started device programs and instructional software subscriptions with temporary money met the same question as their federal funds wound down. The mechanics were identical, even though the funding stream was different.

The same county, two ways

Suppose a county receives its recovery funds and decides to spend part of them on a cloud-based benefits intake system and a managed security monitoring service. Both are good choices.

In the version that goes well, the county’s approval form for every recovery-funded technology project has three extra lines. The first records the annual cost after the grant ends and names the budget line that will carry it. The second says what the county keeps if it stops paying: for the intake system, its data in a standard format; for monitoring, very little, which is noted honestly. The third confirms that the contract caps renewal increases, includes free data export and requires transition help. The budget office receives a copy and begins phasing the run-rate into the general fund over three years. When renewal arrives, the cost is already in the base budget and the county negotiates calmly.

In the version that goes badly, both services are prepaid for three years from recovery funds. They do not appear in the operating budget forecast at all, because on paper they were already paid for. The contract renews automatically at a higher price. The security analyst hired on a grant-funded line has no successor funding. When renewal arrives, the county discovers a new annual cost in the same season that the federal money ends.

The county in the second version still has choices, but each costs more than it would have earlier. It can ask the vendor for a shorter bridge term while it competes the service, accepting a higher unit price. It can move monitoring to a state-run program if one exists. It can cut licenses to the staff who use the intake system daily. Whichever it chooses, it should export its data before any termination notice, while it still has bargaining power and access.

A sound approval process would have asked three questions of every recovery-funded technology project, one for each part. What does this cost per year once the grant is gone, and which budget line will carry it? If we stop paying, what do we keep? Do the terms after the first period protect us as well as the terms in the first period? Agencies that wrote the answers into the project record, and gave the budget office a copy, turned one-time money into durable capability. Those that did not bought a few good years.

The difference between the two versions is not the quality of the technology chosen. The systems are identical. The difference is three lines on a form and one email to the budget office. The version that goes badly usually comes from a handful of habits:

• Treating a prepaid subscription as a finished purchase. It is a commitment with a future bill attached.
• Counting the license and forgetting the people. Staff hired to run a service need ongoing funding too.
• Negotiating only the first term. The terms that protect you most are the ones that apply at renewal and exit.
• Letting deadlines choose the vendor. Speed was necessary, but a fast contract should still include an exit plan.
• Assuming someone else will raise the issue. IT often assumes finance knows; finance often assumes IT planned for it.

A spreadsheet, not a reassurance

Whether you lead a government, sit on a council or oversee any organization that funded technology with temporary money, five questions will tell you quickly where you stand:

1. Which technology services did we start or expand using one-time money, and what does each cost per year to keep running?
2. For each of those services, which budget line will carry the cost once the one-time money is gone? Is it already in the forecast?
3. Do our contracts cap price increases at renewal, guarantee free data export and require help if we move to another provider?
4. Did we hire any staff on temporary funding to run these systems, and what is the plan for their salaries?
5. Are any prepaid multi-year subscriptions missing from the operating budget forecast because they look already paid for?

The best answers will be a spreadsheet, not a reassurance: every service, its annual cost, its renewal date and the budget line that carries it.

The columns that make it useful

A spreadsheet that drives decisions needs a few more columns than a list of vendors. For each service, record the funding source that started it, the contract end date, the auto-renewal notice date, the current annual cost and the expected renewal cost. Add the business owner, the number of users, whether a non-appropriation clause exists, and whether the data can be exported without a fee.

Then add a decision column with four options. Keep and fund means the service moves into the base budget. Renegotiate means the service stays but the terms or scope change. Consolidate means another platform the government already pays for can absorb it. Retire means the service ends, with its data exported and its users told in advance.

Who should own it

The spreadsheet belongs to the budget office, with IT as the main contributor. That reverses the usual flow, in which IT tracks licenses and finance sees invoices. The budget office is the only function that sees every funding source and every future year. IT knows which services are essential and which are replaceable. Neither can finish the list alone.

For governments with renewals still ahead in 2026, the order of work matters. First, build the list and mark every auto-renewal notice date, because a missed window removes options. Second, for each service marked retire or renegotiate, confirm how data can be exported and test the export before sending any notice. Third, bring the keep-and-fund items into the budget hearings as named lines, with their run-rates, rather than as a single technology increase. Fourth, tell the affected staff and residents what is changing and when.

Audit adds a reason to keep the record tidy. Recovery funds are federal awards, so recipients above the federal spending threshold are subject to the Single Audit, and the program has been a major one in many governments’ audits. Auditors test whether costs were allowable, whether procurement followed the applicable rules and whether reports were accurate. A clean file showing how each technology purchase was competed, approved and reported is cheaper to assemble now than during fieldwork.

Governing boards can help by asking for the list as part of the budget cycle, every year, including years when no federal money is involved. The same discipline will apply to the next temporary funding stream, whatever it is.

With hindsight

The recovery funds’ final spending deadline at the end of 2026 is now close, and these questions have become practical and, in many places, urgent.

The rules kept moving after 2021. Treasury’s final rule in January 2022 took effect that April and added the $10 million standard allowance. In late 2022, Congress expanded the eligible uses again, adding categories such as disaster relief and certain transportation projects. In November 2023, Treasury issued another interim final rule on what counted as an obligation, as recipients worked toward the December 2024 deadline. Reports covering obligations through that deadline were due in April 2025.

Many agencies used the money well. They funded broadband builds that will serve communities for decades, water system upgrades, and replacements for benefits and unemployment systems that had buckled in 2020. That year, sudden demand overwhelmed old software and residents waited weeks for help. Those are exactly the kinds of projects temporary money suits: they have an end, and they leave something lasting behind.

The strain appears where recurring technology costs were started with one-time money and never moved into base budgets. Renewals of multi-year subscriptions signed in 2021 and 2022 are arriving as the federal funds end. That can leave an agency choosing between finding operating money, renegotiating, or migrating again. Every one of those options costs something, and the last one means repeating the disruption the original project was meant to end.

Other temporary federal programs showed the same pattern earlier. The Affordable Connectivity Program, created by the 2021 infrastructure law to help households pay for internet service, ran out of money and ended in June 2024. Households that had come to rely on a monthly discount lost it. School districts met their own version as their pandemic relief funds wound down, with device and software programs that needed a new source of money. Each case was the same mismatch at a different scale.

The security programs started in this period face a related test. The State and Local Cybersecurity Grant Program, also created by the 2021 infrastructure law, required a cost share from states that rose each year. That design built in the transition the recovery funds lacked, because it asked recipients to carry a growing share of the cost while federal money was still flowing.

The broader principle held up: in public finance, the shape of the money should match the shape of the cost. One-time money for one-time things; recurring money for recurring things. When the two are mixed, the mismatch does not disappear. It waits for the renewal date.

The accounting side improved, as GASB’s subscription standard pushed governments to inventory their multi-year technology arrangements. Where finance offices connected that inventory to the budget forecast, the renewal wave of 2025 and 2026 came as no surprise.

Agencies that budgeted the run-rate early are in a calm position. Their services continue, their budgets absorbed the cost gradually, and their negotiations at renewal are ordinary business.

How many agencies are in that calm position is hard to say. We cannot tally how many did, because recovery-fund reporting tracks spending categories, not whether the resulting services were moved into base budgets. That gap in the data is itself a reminder that the questions that matter most for long-term value are often not the ones a reporting form asks. Someone inside the organization has to ask them.

One thing did not hold up as well as the worriers expected. Flexible money did not, by itself, produce waste; much of it went to projects with clear and lasting results. The risk was narrower than a general fear of misuse. It sat in the specific overlap between temporary funds and recurring technology costs, and it can still be managed in the months that remain.