What the FedRAMP AI Initiative Actually Produced
In a letter to the FedRAMP Board on August 12, 2025, the federal CIO Council asked FedRAMP to prioritize AI-based cloud services that provide conversational AI engines for routine and repeated use by federal workers. GSA and FedRAMP announced the prioritization on August 25, 2025. According to FedRAMP's AI page, the initiative began in August 2025, was completed in April 2026, and is closed to new entrants. Its criteria included enterprise features such as single sign-on, SCIM provisioning and role-based access control, guaranteed data separation, demonstrated demand from at least five CFO Act agencies or a CIO Council recommendation, and availability through the GSA Multiple Award Schedule.
Three prioritized services hold FedRAMP certification. The levels differ, and the differences matter:
- ChatGPT Enterprise and API Platform (OpenAI): Marketplace package FR2533155773, FedRAMP 20x Pilot, Class C (Moderate), certified since January 9, 2026. OpenAI announced the Moderate certification on April 27, 2026. OpenAI's FedRAMP help documentation states that FedRAMP compliance requires all API requests to use the designated gov.api.openai.com endpoint, and that the FedRAMP versions do not initially include every feature of the commercial products.
- Gemini for Government (Google): Marketplace package FR2604952026, FedRAMP 20x Pilot, Class B (Low), certified since January 21, 2026. Google's configuration guidance says this Class B (Low) certification covers publicly releasable information with minimal sensitivity and directs agencies needing Moderate or High processing to separate deployment guidance. GSA offers Gemini for Government to federal agencies through a OneGov agreement announced August 21, 2025.
- Perplexity Enterprise and API Platform (Perplexity AI): Marketplace package FR2604643715, FedRAMP 20x Pilot, Class B (Low), certified since February 1, 2026. FedRAMP's AI page lists the same prioritized service as Perplexity Enterprise Pro for Government.
These were not the first government-authorized routes to large language models. Anthropic announced in 2025 that Claude models were approved for FedRAMP High and DoD IL4/5 workloads through Amazon Bedrock in the AWS GovCloud (US) regions, an approval that rests on the hosting platform's authorization; OpenAI's government page similarly describes an AWS GovCloud Bedrock path at FedRAMP High. What the 2026 initiative added was certification for the vendor-managed enterprise chat products themselves. The FedRAMP home page currently reports 549 FedRAMP certified services, 33 of them certified through 20x.
The practical consequence for a state buyer is that "FedRAMP certified AI" covers a range from Low to High depending on which product and which hosting path is under discussion. A Class B (Low) certification does not support the same data as a Class C (Moderate) one, and neither supports data the agency has categorized as High.
What a Provider's Certification Does Not Do
FedRAMP has started using different words for the two halves of the decision. Under its 2026 rules, the program now calls a service it has approved "FedRAMP certified" rather than "FedRAMP authorized," because, as GSA's FedRAMP security director Nicole Thompson explained in Federal News Network's May 2026 coverage, agency users had mistakenly equated program authorization with agency authorization. Thompson described certification as decoupled from agency authorization, which she said "is always, and has always been, required to use a FedRAMP-authorized product at an agency."
That statement concerns federal agencies. A state agency is not a FedRAMP stakeholder at all: FedRAMP does not issue, require or recognize state authorizations. The FedRAMP package is therefore evidence the state can rely on under its own security policy, and the state's own approval process (whatever the state calls its ATO, risk acceptance or security review) remains the operative decision. That cuts both ways. It means a state can often move faster than a federal agency, because no federal rule dictates the form of its approval. It also means nothing in FedRAMP will stop a state program from skipping the work.
Spartan X recommends that a state agency treat the following as the minimum decision record before an AI service reaches production. These are recommendations modeled on federal practice, not requirements FedRAMP imposes on states.
Match the data to the certification level. Categorize the information the use case will actually process, then compare it to the certification class and legacy impact level on the Marketplace record. A Low-certified service is a poor fit for case files containing personal information; a Moderate-certified service does not cover information the agency has categorized as High. If the agency is unsure how the data categorizes, that uncertainty is the first finding, not a detail to resolve after contract award.
Decide the approval path in writing. Record whether the agency will rely on a state enterprise approval, a GovRAMP status, the FedRAMP package directly, or some combination. Marketplace records direct agencies to contact the vendor for package access, so confirm before award that the vendor will share its certification package with a state customer and on what terms.
Complete the shared-responsibility review. Every certification defines what the provider controls and what the customer controls. Access management, data classification, user training, audit log review and incident response on the customer side remain the agency's job. An agency that signs without a shared-responsibility matrix has accepted risks it has not assessed.
Validate the certified configuration. The certification covers a specific configured offering. For OpenAI's service, the help documentation makes the government endpoint a condition of FedRAMP compliance, and the FedRAMP feature set is narrower than the commercial one. A team that builds against the commercial endpoint, or enables a feature that is not in the FedRAMP version, is no longer using the certified configuration, whatever the vendor's name on the Marketplace.
Secure ongoing visibility. Certification is maintained through continuous monitoring, but a state agency should not assume it will see that reporting. GovRAMP has long noted that FedRAMP documentation is visible to the federal agencies working with a provider rather than to states, which is a large part of why GovRAMP exists. Decide how the state will receive monitoring results, by contract clause, by GovRAMP status or by both.
Many state procurement offices still buy AI services the way they buy SaaS subscriptions. The FedRAMP model treats them as systems to be authorized. Both paths end in a purchase order; only one leaves the agency with a defensible record when an auditor or an incident asks what was approved.
GovRAMP Leverage: How It Works, and Where It Doesn't
GovRAMP is the nonprofit program formerly called StateRAMP; it announced the rebrand on February 14, 2025, while keeping StateRAMP as its legal entity. It provides a NIST-based verification framework for state, local, tribal and education buyers. GovRAMP's participating government organizations list spans dozens of states, but participation is not the same as a mandate; GovRAMP itself describes formal adoption, requiring GovRAMP status for certain cloud services, as a further step that a growing number of states have taken. Vendors outside AI are moving through the same process; Rapid7 announced on June 23, 2026 that its InsightGovCloud Platform had achieved GovRAMP Authorization.
The leverage mechanism is GovRAMP's Fast Track program: a provider submits existing federal security materials, such as security assessment reports, readiness assessment reports and continuous monitoring documentation, and the GovRAMP office reviews them for alignment with GovRAMP requirements instead of requiring a full new assessment. The result is a GovRAMP status with monthly continuous monitoring that participating governments can request to view. That is the piece a FedRAMP certification alone does not give a state.
Three questions decide whether that leverage works for a specific AI procurement.
Does the state's policy accept the FedRAMP evidence, and which kind? The rules are state-specific and they are worded carefully. Nevada requires that new contracts containing a cloud component, as of July 1, 2026, include GovRAMP-aligned risk assessment requirements, with at least GovRAMP Core status and an on-ramp period for vendors to reach the required status; it directs products holding or seeking a FedRAMP Rev. 5 status to GovRAMP Fast Track. North Carolina established in April 2026 that it would transition to GovRAMP authorization requirements over the following 12 months; it says FedRAMP Rev. 5 authorizations may satisfy its standard at award, but it may require a FedRAMP-authorized vendor to pursue GovRAMP Fast Track to meet the state's continuous monitoring requirement. Minnesota requires GovRAMP Authorized status at the moderate level for cloud contracts involving high-risk data, with an April 1, 2027 deadline, and directs products holding or seeking a FedRAMP Rev. 5 status to enroll in Fast Track. Note what those texts name: Rev. 5. The AI services above were certified through the 20x pilot. Whether a given state treats a 20x certification the same way is a question to put to the state's security office in writing, not an assumption to build into a procurement schedule.
Is the specific AI product actually enrolled? A FedRAMP certification does not place a product in GovRAMP. Before award, check the product on GovRAMP's program participants list and confirm the exact offering name and status. If it is not there, the contract needs a defined path and deadline, as Nevada's and Minnesota's policies build in.
Will the boundary still match after go-live? GovRAMP status, like FedRAMP certification, attaches to a defined product. The integrations a state adds after signature, such as identity providers, document repositories and case management systems, are not inside the vendor's verified boundary by default. Each addition needs either confirmation that it is in scope or a documented agency risk decision.
Where the Vendor's Boundary Ends: The 2026 Consolidated Rules
FedRAMP launched its Consolidated Rules for 2026 on June 24, 2026. The important-dates page lists optional early adoption from July 4, 2026, and mandatory adoption for all stakeholders on January 1, 2027, subject to specific applicability and effective dates within certain areas, and the rules have continued to be revised through the fall according to the changelog.
One ruleset is directly relevant to AI deployments, though it binds providers rather than agencies. The Minimum Assessment Scope rules require a provider to identify every information resource likely to handle federal customer data, or likely to affect its confidentiality, integrity or availability; that set of resources is the cloud service offering. Providers must document information flows and security categories for those resources and address third-party information resources the offering uses. In other words, the rules define the vendor's boundary precisely, and anything the vendor has not placed inside it is not FedRAMP certified.
For an agentic AI deployment, where the system retrieves from data stores, calls tools or routes requests to other services, that precision exposes the agency's half of the problem. Consider a hypothetical: a state labor department deploys a certified AI assistant to help caseworkers search benefits policy documents. The vendor's package covers the AI service and whatever the vendor has declared in scope. The department's own policy document repository, the identity integration caseworkers use to sign in, the connector that links the assistant to the repository, and the system that retains query logs are the department's resources. FedRAMP does not certify them, and no FedRAMP deadline will force the department to document them. Its own security program has to.
The practical recommendation is to do the boundary mapping now, during the pilot, while there are few integrations to inventory: list every tool the assistant can call, every data store it can retrieve from, what agency data enters prompts, where outputs and logs are stored, and which of those are inside the vendor's certified scope. That inventory gets harder, not easier, as a pilot expands.
A Procurement Checklist Before the Contract
- Confirm the Marketplace record. Check the package ID, status, certification type and class on the FedRAMP Marketplace. Legacy "FedRAMP Ready" or "In Process" status is not a certification.
- Match the class to the data. Compare the certification class and impact level against the agency's categorization of the data in this use case. If the data is High, a Low or Moderate service does not cover it; look at High-authorized hosting paths instead.
- Read the state policy. Identify effective dates, data thresholds, and whether the policy accepts FedRAMP evidence directly, requires GovRAMP status, or names only Rev. 5. Get the security office's answer on 20x certifications in writing.
- Check GovRAMP enrollment. Confirm the exact product's status on the GovRAMP list, or write a status path and deadline into the contract.
- Get the package and the boundary. Confirm the vendor will provide its certification package to a state customer. Compare the declared offering against the features, endpoints and integrations the agency plans to use.
- Draft the shared-responsibility matrix before approval. Assign an owner to every customer-side control and build the work into the program plan.
- Inventory the agency side of any agentic design. Document every tool, retrieval store and external service the deployment touches, and record which are outside the vendor's boundary and how the agency will secure them.
The credible alternative to this sequence is to buy narrowly: start with a non-sensitive, chat-only use case on a certified service, keep agency data out of the prompts, and defer integrations until the approval path is settled. That makes sense when the state's policy on 20x evidence is unresolved or the data categorization is uncertain. What does not make sense is buying broadly and documenting later. The 2026 certifications removed a real barrier to state AI procurement; what remains is agency-side work, and most of it produces records the agency would need anyway.
Sources and further reading
- FedRAMP AI: initiative dates, prioritization criteria and the list of prioritized services
- GSA, August 25, 2025: prioritization announcement and the CIO Council's August 12, 2025 letter
- FedRAMP Marketplace records: ChatGPT Enterprise and API Platform, Gemini for Government, Perplexity Enterprise and API Platform
- OpenAI help center: ChatGPT Enterprise and API Platform for FedRAMP: endpoint requirement and feature scope
- Federal News Network, May 2026: Nicole Thompson on certification versus agency authorization
- FedRAMP Consolidated Rules for 2026, important dates and Minimum Assessment Scope
- GovRAMP Fast Track and state program pages for Nevada and Minnesota; NCDIT GovRAMP guidance, June 29, 2026
The decisions that matter most here are made in program design, before a contract fixes the product, the boundary and the approval path: which certification class fits the data, how the state's own policy treats FedRAMP evidence, and who owns the integrations an AI assistant will depend on. Spartan X's AI strategic advisory work with state leadership focuses on exactly that stage, helping agencies settle the authorization path and responsibility model as design inputs so a deployment does not inherit compliance debt from an early purchase.
