The service, region and models
We match the model service, region and models to the level your data needs, checked against the provider’s current list, because the status changes and, on AWS, differs by model.
AI engineering in federal clouds
We build AI applications, from retrieval over your documents to agents, inside the federal cloud your system already runs in.
The model service, region and models are chosen for the level your data needs, and the system is tested and documented for the agency’s authorization.
Which model services reach your level
Each provider lists its own AI services against FedRAMP and the DoD impact levels. Choose the level your data needs to see what reaches it, and on what condition.
| Service | FedRAMP High | DoD IL4 | DoD IL5 | DoD IL6 |
|---|---|---|---|---|
| Azure OpenAI in Azure GovernmentMicrosoft | Yes | Yes | Yes, with conditions | Yes |
| Amazon Bedrock in AWS GovCloud (US)AWS | Yes | Yes, with conditions | Yes, with conditions | Yes |
| Generative AI on Gemini Enterprise Agent PlatformGoogle Cloud (formerly Vertex AI) | Yes, with conditions | Yes, with conditions | Yes, with conditions | No |
All 3 services reach DoD IL5.
- Azure OpenAI in Azure Government. IL5 with workload isolation, which needs extra configuration.
- Amazon Bedrock in AWS GovCloud (US). Set per model, as for IL4: models from OpenAI, Meta, Nvidia, xAI and Amazon, not Anthropic’s.
- Generative AI on Gemini Enterprise Agent Platform. With Assured Workloads.
The rules agencies buy AI under
OMB replaced its AI memos in April 2025. An agency buying an AI system now asks for things a vendor has to build in from the start.
- Jan 23, 2025
Executive Order 14179
Sets the policy to sustain and enhance America’s global AI dominance, and orders OMB to revise its two AI memos within 60 days.
- Apr 3, 2025
OMB M-25-21 and M-25-22
Minimum practices for high-impact AI, and how agencies buy AI: no training on agency data without consent, portability, and access for independent evaluation.
- Aug 25, 2025
FedRAMP prioritizes AI
GSA and FedRAMP prioritize 20x authorizations for conversational AI services. The work was completed in April 2026 and is closed to new entrants.
- Dec 11, 2025
OMB M-26-04
Agencies buying a large language model request, at a minimum, an acceptable use policy, model, system or data cards, end-user resources and a way for users to give feedback.
- Jun 17, 2026
GSA’s draft LLM clause
GSAR 552.239-7001, on safeguarding government data in LLM systems, is published as a draft for comment.
| What agencies ask | In practice | Source |
|---|---|---|
| No training on agency data | Contracts must permanently prohibit using non-public agency inputs and outputs to train publicly or commercially available AI, absent explicit agency consent. | OMB M-25-22 |
| Room to evaluate and monitor | Vendors must give agencies the access and time to evaluate the system independently, and contracts must let them monitor it regularly. | OMB M-25-22 |
| An authorization to operate | An AI system operated by or for an agency needs an ATO from an agency official before it is deployed. | OMB M-25-22 |
| High-impact practices | For high-impact AI: pre-deployment testing, an AI impact assessment, ongoing monitoring, trained operators, human oversight, remedies or appeals, and public feedback. | OMB M-25-21 |
| LLM documentation | An acceptable use policy, model, system or data cards, end-user resources and a way for users to give feedback. | OMB M-26-04 |
Sources: EO 14179 (opens in a new tab), M-25-21 (PDF, opens in a new tab), M-25-22 (PDF, opens in a new tab), FedRAMP AI prioritization (opens in a new tab), M-26-04 (PDF, opens in a new tab) and 91 FR 36559 (opens in a new tab).
The risks we design and test for
NIST’s Generative AI Profile names twelve risks that generative AI introduces or makes worse. OWASP, an industry group, ranks the ten most critical security risks for LLM applications.
NIST AI 600-1, Generative AI Profile
- CBRN Information or Capabilities
- Confabulation
- Dangerous, Violent, or Hateful Content
- Data Privacy
- Environmental Impacts
- Harmful Bias or Homogenization
- Human-AI Configuration
- Information Integrity
- Information Security
- Intellectual Property
- Obscene, Degrading, and/or Abusive Content
- Value Chain and Component Integration
OWASP Top 10 for LLM Applications 2025 (industry)
- LLM01 Prompt Injection
- LLM02 Sensitive Information Disclosure
- LLM03 Supply Chain
- LLM04 Data and Model Poisoning
- LLM05 Improper Output Handling
- LLM06 Excessive Agency
- LLM07 System Prompt Leakage
- LLM08 Vector and Embedding Weaknesses
- LLM09 Misinformation
- LLM10 Unbounded Consumption
Sources: NIST AI 600-1 (opens in a new tab) (July 2024), NIST AI 100-2 E2025 (opens in a new tab) for attack classes, and the OWASP GenAI Security Project (opens in a new tab), an industry list, not a government standard.
How we build it
Inside the boundary
We build in the cloud you already authorize: private endpoints, your own keys, identity on every call, and prompts and outputs logged to your SIEM, in Terraform.
Retrieval and agents with limits
Retrieval returns only what the person asking may see. Agents get the narrowest tools and permissions, and a person approves actions that change things.
Testing before deployment
We test for prompt injection, data poisoning and data extraction, the attack classes in NIST AI 100-2, and against the OWASP list, and keep the results agencies ask to see.
The documentation
We write the AI components into your SSP, and assemble what agencies request under M-26-04, the acceptable use policy, model and system cards and end-user resources, from the model developer’s documents and your own.
Monitoring
We set up content filtering and the abuse monitoring a provider leaves to you, as Azure Government does in part, and watch for drift and misuse.
The agency grants the ATO; we build and document the system for it. For the policies, risk register and ISO/IEC 42001, see AI governance.
AI services and FedRAMP, briefly
- Is ChatGPT FedRAMP certified?
- ChatGPT Enterprise and API Platform is FedRAMP Certified through 20x at Class C (Moderate), since January 9, 2026. Separately, Azure OpenAI in Azure Government is in Microsoft’s FedRAMP High audit scope.
- Which models can handle IL5 data?
- It depends on the service and, on AWS, on the model. As of October 2026, Bedrock in GovCloud lists IL4 and IL5 for models from OpenAI, Meta, Nvidia, xAI and Amazon, but not Anthropic’s; Azure OpenAI reaches IL5 with workload isolation; Google’s generative AI service reaches IL5 with Assured Workloads.
- Is Microsoft 365 Copilot available in GCC High?
- Yes. Microsoft says Copilot is available in its government clouds, GCC High among them, and operates within the government tenant, and it is in the service list of the Microsoft 365 GCC High FedRAMP listing. Features can arrive on a different timeline than in commercial tenants.
- Can FedRAMP still fast-track an AI service?
- Not through its AI prioritization. That ran from August 2025 to April 2026, certified ChatGPT Enterprise, Gemini for Government and Perplexity, and is no longer open to new entrants. FedRAMP has not named a successor.
Sources: the FedRAMP Marketplace (opens in a new tab) and Microsoft’s Copilot for government overview (opens in a new tab), read October 20, 2026.