Buy, Build, or Let the Vendor Decide: How Federal Agencies Are Approaching AI Acquisition
One of the more useful contributions of GAO’s April 2026 AI acquisitions report (GAO-26-107859) is its taxonomy of the different procurement approaches federal agencies are actually using—not as a policy prescription, but as an empirical account of what agencies have tried, what trade-offs they’ve encountered, and where each approach leaves agencies exposed.
Agency-Directed vs. Vendor-Driven
Some agencies began with a defined requirement and went out to acquire a solution. Others found vendors presenting AI capabilities to them that didn’t correspond to any existing requirement—and accepting those offerings anyway. GSA acquired a facility management software platform that included a chatbot feature the vendor added as a bonus, not in response to any stated requirement. VA awarded a task order for medical software that arrived with embedded AI capabilities.
The report is candid about both sides. Agency-directed procurement involves deliberate planning that produces contracts with AI-specific terms and conditions. The downside is time—the process is slow enough to risk missing the capability window. Vendor-driven adoption is faster and sometimes yields genuinely useful capabilities, but without proper contract language it creates exposure: no performance benchmarks, no model drift protections, no meaningful accountability mechanism.
FAR-Based Contracts vs. Other Transaction Agreements
DOD has statutory authority to use Other Transaction Agreements—contract instruments not governed by the FAR—to develop and prototype new technologies. In July 2025, DOD awarded OTAs with $200 million ceilings to four leading AI companies to accelerate adoption across the department. The Air Force also used a partnership intermediary agreement with the Wright Brothers Institute to support development of a ChatGPT-style chatbot.
The flexibility OTAs provide is real: they can accommodate commercial business practices, remove IP and cost-accounting barriers that deter non-traditional contractors, and move faster than FAR-based awards. But GAO has previously found that OTAs reduce accountability and transparency compared to standard contracts—a concern OMB’s M-25-22 amplifies by noting that high-impact AI use cases require more transparency, not less.
DHS, notably, lost its OTA authority as of October 1, 2024, when its statutory authorization lapsed. As of September 2025, it was still seeking legislative restoration.
Custom Acquisitions vs. Government-Wide Vehicles
The tension between bespoke contracts and existing vehicles runs through the entire report. GSA’s OneGov Strategy, launched in April 2025, represents the most ambitious bet on the vehicle approach: a government-wide procurement framework that entered agreements with OpenAI, Anthropic, and Google in August 2025, giving all federal agencies access to leading AI models through a single managed channel. DOD’s Tradewinds ecosystem takes a similar approach within the defense space.
The appeal is efficiency—GSA has already negotiated prices, agencies can move fast, and competition has been addressed at the vehicle level. The cost is configurability. FEMA found when it used an existing contract to meet a deadline that it couldn’t include the AI-specific terms it wanted, including post-award testing requirements.
AI as a Service vs. AI as a Product
Most of what agencies are actually buying, officials told GAO, is a service—ongoing access to vendor-provided AI capabilities and outputs—rather than a discrete software product. This distinction matters for contract structure. A product has defined specs and a delivery date; a service requires continuous performance monitoring, reliability standards, and mechanisms for handling model updates that change behavior.
Agency officials managing the most sophisticated AI systems in the sample went further: they argued that vendor service quality—the humans and processes behind the model—affects outcomes more than the underlying algorithm. This reframes what agencies are actually evaluating when they assess AI vendors, and it has direct implications for evaluation criteria, contract terms, and oversight frameworks.
GSA’s senior leadership offered perhaps the sharpest framing in the entire report, comparing the current AI vendor landscape to the early 2000s search engine proliferation—full of AltaVistas and Ask Jeeveses, with Google still ascending. The strategic implication: agencies should avoid deep commitment to platforms and vendors that may not survive market consolidation, and should structure contracts accordingly.