There will be no announcement. One day a prime sends a supplier questionnaire with a new section, or a solicitation asks how you govern the AI in your solution, and the honest answer inside your company is that nobody has written it down.
How it reaches you
Federal agencies inventory their AI use cases and manage them against the NIST AI Risk Management Framework. When a contractor builds or operates the system, the evidence behind that inventory has to come from the contractor. It arrives the way every other obligation arrives in this business: through solicitation language and flow-downs from the prime.
Why a policy PDF is not an answer
The first instinct is to write an AI policy. A policy says what you intend. The question being asked is what you do and whether you can show it. A values statement about fairness is not evidence of bias testing. A sentence about human oversight is not a record of who reviews model output, how often, and what happens when they disagree with it.
What they will ask for
- An inventory: every model, API, agent, and embedded AI feature you use or deliver, each with an owner and a lifecycle stage.
- A risk picture you can explain: how autonomous the system is, what data it touches, what happens when it is wrong, who is watching, and what you depend on from suppliers.
- Whether a given model may touch Controlled Unclassified Information, and where it runs.
- Evidence, not assertions, mapped to the framework the customer uses. For federal work that is usually NIST AI RMF. A prime with commercial or European business may ask about ISO/IEC 42001 or the EU AI Act as well.
- A trail showing who decided what, and when.
The part most contractors miss
The frameworks overlap heavily. NIST AI RMF, ISO/IEC 42001, ISO/IEC 23894, and the EU AI Act ask many of the same questions in different words. A company that answers each one separately does the work four times. A company that answers a single set of plain-English controls, and maps each answer to every clause it satisfies, does it once. That is how we built Stratify: 62 controls mapped to 179 clauses across the four frameworks.
Why now
Almost nobody can produce this evidence on request yet. That makes it a discriminator today. It is also far cheaper to build before an award than after one, when the customer sets the deadline.
Start with the inventory. You cannot govern what you have not listed, and most companies are surprised by how many AI features are already inside tools they bought for another reason.
This article supports compliance planning. It is not legal advice.