Author: Jessica Tillipman

My family hates AI. Well, more specifically, my family hates my use of AI.

And don’t get me started on road trips with my family. This past summer we took a road trip from Virginia to Maine, just after GSA released its revised AI clause. My kids had to listen to me discussing “Government usage context” with Claude and ChatGPT for nearly two weeks in the car. You may be thinking: “poor kids,” but can your elementary school kids explain, with great fluency, the difference between telemetry and “data dust?”

As a working parent, I’ve become more productive than at any other point in my career, thanks to AI. I am no longer tethered to a desk to write papers, and AI enables me to bring a paper concept to the tool, then spend hours discussing it as I decide whether it is worth turning into a paper. When something moves from “potential working paper” to “actual working paper,” those hours turn into weeks.

Sometimes an idea hits me out of the blue. For example, this morning I woke up at 5 am thinking about Other Transaction Authority and transparency concerns (as one does). So, I immediately turned to Claude and made sure I captured it. Maybe that becomes a follow-on piece, maybe not. But now that idea is preserved in my AI project. Other times, I read an interesting article, or someone says something on social media that I want to discuss in greater detail, pull background research on, and just think through. So I start discussing it with ChatGPT to help me decide whether it’s worth exploring.  

Having a brilliant research assistant and sounding board I can fit in my pocket and consult whenever I want has dramatically reduced the friction of thinking through these issues. More importantly, it has helped a government procurement and anti-corruption expert analyze the legal implications of a new technology.

How I Use AI In My Work

I was inspired to write this piece because I frequently receive requests from students and early-career researchers for advice about my research, methodologies, and how I communicate complex ideas in a way that everyone can understand. They also often ask how I use AI in my work, so I figured it was time I captured it in writing.

To be clear, this isn’t a best-practices guide, and I am certainly not suggesting everyone should write this way. Also, although what follows is presented linearly for the sake of organization, my writing process is anything but. I frequently toggle back and forth between different phases as I develop a piece, which ultimately makes the final product stronger and uniquely mine.

Project Development

One of the most valuable aspects of AI in legal scholarship is that it reduces friction in the project development phase of the writing process. It lets me develop a piece from anywhere, at any time, and receive feedback immediately. But, and this is probably the most important thing I will say in this entire piece: I bring my paper concepts to AI; I don’t rely on AI to tell me what to write about.

Project development is the intellectual heart of all my articles. It’s probably the stage of my writing that irritates my family most. When I am developing a paper idea, you will find me talking to a chatbot constantly as I work through where I want to take things. Many of my pieces involve translating technical concepts for a broader audience or weighing in on policy or debate. But my favorite pieces stem from my anger—something has been mischaracterized, someone has overreached, or someone has created a policy that is objectively terrible. As I always tell my students: “write about what pisses you off.” It. Never. Fails.

AI can be an incredible sounding board as you work through how to translate anger or passion into a piece, especially when you are working on an interdisciplinary piece or something outside your comfort zone. I could not have developed the same level of technical understanding of AI as quickly without using AI for research and feedback. I am not a technologist or an engineer. It took me six months of fighting with ChatGPT (seriously, fighting) to develop my framework for analyzing the risks of organizational conflicts of interest (OCI) embedded in the AI stack. ChatGPT kept defaulting to a traditional OCI analysis and couldn’t see how technology transforms it. And I could never have developed the same understanding of the “informational advantages” that stem from AI data exhaust as quickly without a tool that helped me appreciate the technical differences among types of AI “data,” so I could assess their impact on AI procurement. AI has meaningfully reduced barriers to this type of research. But I want to disabuse you of the notion that “AI assistance” or “reduced friction” means “outsourced thinking” or that using AI is “easy” or “fast.” What happens after I develop and begin drafting the piece has become even more labor-intensive than my pre-AI scholarship.

Assemble & Write the Piece Yourself

I distill weeks of research and extensive back-and-forth into a working outline in the tool, then I assemble and write the piece myself. This is critical. When AI, particularly Claude, tries to write polished prose, it often sounds like a bad imitation of Carrie Bradshaw, with each sentence trying to out-pun or out-sass the last. The end result is that all the good ideas you spent weeks developing wind up fighting for their lives, buried under a mountain of weird tics, snappy transitions, and overconfident phrasing. 

But more importantly, letting AI take the wheel can strip the piece of everything that makes it uniquely yours. I may use an AI tool at different stages of the writing process, but the work still sounds unmistakably like the other articles I’ve written over the past two decades.

Write So Everyone Can Understand It

After I graduated from law school, I clerked for Judge Lawrence Margolis at the U.S. Court of Federal Claims. He taught me to write so everyone, including non-lawyers and non-procurement experts, could understand it. That lesson stuck with me, and I adhere to that principle in all my work.

Long before I started using AI tools, I adopted a writing style that enables someone completely unfamiliar with an issue to understand my work. I learn complex concepts best through analogies, and so that is how I write.

It’s why my AI tech stack wedding cake came so easily. When I would read other publications’ descriptions of the stack, it reminded me of an abstract painting. But explaining it like food? That I could do. The same with the Chef. Once you understand how the model works through the analogy, other, far more complex ideas start to make sense. AI has also become instrumental to this process as I try to explain complex procurement, anti-corruption, or technology concepts to audiences with little to no familiarity with the subject matter and seek feedback on whether a particular passage is sufficiently accessible to novices. This is a critical step, particularly if your work is interdisciplinary. 

Stress-Test, Then Stress-Test Again

If using AI during the project development phase of writing reduces friction, this phase multiplies it. My recent Lawfare article on GSA’s revised AI clause took me, conservatively, over 100 hours to research, develop, write, revise, stress-test, discuss with humans, revise again, present to humans, revise again, discuss with more humans, revise again, reduce to keep the word count within spitting distance of Lawfare’s word budget, submit for review and digest feedback from three editors, revise again, digest feedback from two more editors, and revise again before submitting the final draft.

Stress-testing is my least favorite stage of my project development. Whenever I write something, I am laser-focused on accuracy, making sure I haven’t overstated anything, that all my claims are supported, and that technical explanations or analogies are airtight. I often joke, “I can’t believe I used to just let my pre-AI articles fly after finishing them!” This stage in my writing involves both AI and human review.

First, I stress-test the piece with AI by repeatedly subjecting it to adversarial attacks. The stress-test is substantive (“Did I explain this correctly?”), stylistic (“Is it clear?” “Does it flow logically?” “Does it have typos or grammatical errors?”), and accessible (“Would someone unfamiliar with this topic understand this?”). The degree to which I review a piece for errors has probably become unhealthy. I know this because at some point both Claude and ChatGPT tell me to STOP (thankfully, Claude has at least stopped telling me to go to sleep).

I often hear people say they use AI “just” for copyediting. That’s fine, but to me, one of the most valuable benefits of using AI in the writing process is that it doesn’t just focus on my grammar. I have never fully understood why, if someone has access to a machine that will say, “you didn’t describe that correctly,” “this new case undermines that argument,” or “this paragraph is inconsistent with what you said in a different article last year,” I wouldn’t use it. If I just wanted something to correct my grammar, I would use Grammarly. But I love having a tool that can flag substantive errors, prose that could be misinterpreted, and potentially inconsistent ideas. Sometimes I agree with the suggestions, but most of the time, I don’t. If an AI-suggested edit is correct and strengthens the piece, I accept it, because my goal is always to write the strongest, most accurate piece possible.

One consequence of accepting this feedback is that your piece will likely carry fingerprints of AI involvement in the research and writing process—particularly sentences that have been stress-tested into oblivion. I am resisting the urge to turn this section into an ancillary rant about AI-detector shaming, but I have a strong aversion to the narrative that has evolved around this issue, which often collapses dramatically different writing processes under an “AI-GENERATED” label. Asking AI to draft an article from a prompt is not the same as using AI to complete tasks traditionally performed by research assistants and editors (e.g., iterative research, substantiation, editing). An AI detector scanning a final draft cannot reconstruct which of these processes has occurred, yet both can trigger a high “AI-Generated” score. 

Once I finish stress-testing it with machines, I then bring the piece to humans (many humans). They often inspire me to take my work in a different direction or consider ways to improve it. Obtaining human feedback is essential. I received feedback about Buying Blind, my first major AI article, from 14 different people before I even submitted it to the Public Contract Law Journal. My shorter pieces have fewer reviewers, but I never submit a piece to a publisher without another person reading it first.  

“Good Writing is 90% Good Editing.”

If stress-testing introduces friction, editing introduces agony. Editing is painful and often requires me to cut prose I have worked so hard on. I agonize over the simplest sentences. I am laughing as I type this, remembering an exchange I had over text with a good friend while I was in the final stages of editing my Lawfare piece, Military AI Policy by Contract: The Limits of Procurement as Governance. After asking for his opinion about whether I should describe something as “procedural protections,” “legal protections,” or “certain protections,” I apologized for my editing insanity. He replied by reminding me that “Good writing is 90% good editing.”

Like the other phases of my writing, the editing process isn’t linear. Because my articles usually develop over weeks or months, I often introduce new material during editing, swap out paragraphs after receiving feedback, and cut sections as my thinking evolves or new information changes how I want to address something. AI is incredibly helpful during this phase because it provides feedback on my potential edits. The point is that the project is never static until I am 100% satisfied with the piece and I submit the final draft.

Verify Your Work, Then Verify it Again

Yes, we all know that AI hallucinates. Yes, we know we need to check our work. But automation bias is real, so you must take time to actually verify things. Sometimes hallucinations are hilariously bad, but sometimes they’re insidious. One time, I asked ChatGPT to help me format some footnotes for one of my publications. The citation it returned changed the title of a GAO report from “Improper Payments and Fraud: How They Are Related but Different” to “Improper Payments and Fraud: How They Are Related but Not the Same.” Thankfully, I caught the error while triple-checking my citations.

Follow the Rules

If you are a student, you must (I repeat, you must) comply with your institution’s AI policy. If it is unclear, seek clarification. You may disagree with it, but that’s your rulebook while you are enrolled there. Don’t destroy your career before it has even started.

As for publications, if they have an AI policy, you must follow it. The last thing you want is for your work to be retracted or for an AI disclaimer to appear at the top of your piece. The challenge is that disclosure rules are evolving in real time, in an environment where the terminology used to describe how people use these tools is wildly inconsistent. Terms such as “AI-edited,” “AI research,” “AI-generated,” and “AI-assisted” are interpreted differently, yet consequential policies increasingly use them without an agreed-upon baseline.

As terminology and disclosure policies evolve, one theme appears to be emerging more consistently: the human author remains responsible for the work, regardless of the tools used to create it. Kevin Frazier and Alan Rozenshtein call this “absolute authorial accountability” in their excellent article, Large Language Scholarship. One benefit of that approach is that it remains an evergreen benchmark even as technology, expectations, and standards continue to evolve.   

Have you “Outsourced” Your Thinking?

AI can remove labor and friction, but I never want it to replace my thinking. Automation bias, cognitive offloading, deskilling, and other concerns are significant, so I think it is important to proactively mitigate these risks. That said, I am uncomfortable developing categorical recommendations about “appropriate” AI use when the research in this space is still evolving. So I am not going to tell you what to do or how you should do it. Instead, I can share some practices I have adopted to ensure AI doesn’t replace my own intellectual labor.

First, I maintain a diverse research base. I find AI invaluable for research, but I also rely on news articles, government reports, scholarly research, books, and other reputable sources. 

Second, I talk to humans about my ideas. They provide feedback, offer new perspectives, and often cause me to rethink much of what I have been mulling over as I develop my work. If you are a student or junior scholar, reach out to your professors, practitioners, or experts in the field. I never let students leave a meeting with me about their draft papers without at least 3 names of people they should contact to help them as they develop their work.

Third, and this is critical, I can explain and defend my work without AI assistance. I also test my ideas as I develop them. All my speaking engagements double as a lab for my working papers. I tested my ideas about GSA’s revised AI clause with at least half a dozen audiences before finalizing it. Each group provided valuable feedback that helped me improve the piece. The beauty of a presentation is that you usually receive at least one question you never anticipate, and you must understand your work well enough to respond to it without turning back to AI to supply the answer.

This practice also appears in emerging scholarship. Bednar et al.’s fascinating new article, Artificial Intelligence and Human Legal Reasoning, tested whether using generative AI early in a project reduced comprehension and impaired legal reasoning later, when AI was no longer available. The results were surprising, and I encourage you to read the article. In their discussion of best practices, the authors offer a similar heuristic to reduce the risk of cognitive offloading, explaining that if work could not be defended “in a demanding conversation with a skeptical colleague or judge without further preparation . . . [then] . . . the task has likely been delegated rather than assisted, and the professional and developmental costs of that delegation may outweigh its efficiency gains.”

The Downside of Frictionless AI

When I first started writing this piece, my 7-year-old asked what it was about. When I told her, she said, “I am going to draw a picture of you using AI.” And this is what she produced. Me, in a hoodie and the plaid Christmas pajama pants my mother-in-law bought for me last Christmas, arguing with Claude.

On the one hand, it perfectly demonstrates the lesson I teach in all my AI trainings: an output is just the starting point. Always verify and always push back.

But on the other hand, it highlights something more concerning. Something that I and many others have noticed over the past year. There is a downside to this “frictionless” tool. Yes, it helps us do things we never could before, and yes, it can make many daily tasks easier or more efficient. But for many of us, it has started to play an outsized role in our lives, absorbing much of our downtime. When my 7-year-old can draw a picture like this and knows the tool by name, perhaps it’s time to consider the other potential repercussions of this “frictionless” tool—a topic I will explore in a future blog post.

When I teach AI procurement to government or industry audiences, I always include two slides at the beginning of every presentation. First, I teach the AI tech stack as a wedding cake. That helps people visualize the AI supply chain as tiers, from the foundational infrastructure supporting it (the cake stand) to the governance that surrounds it (the frosting). The cake answers the first question every acquisition professional must ask: what exactly am I buying? They need to understand that they are effectively buying a stack, not just an app.

But the cake can’t answer the second question: how does the model at the center of that stack actually work? And what does that mean for your intellectual property, your business processes, your compliance obligations, and your procurement risk?

Answering those questions requires a basic level of AI literacy, so to help explain it, I turn to another food-related analogy: the chef. The chef is the model, and her career illustrates how a model is developed, adapted, and used.

One caveat before we start. Like the wedding cake, this is not a technical taxonomy, and it will not cover every configuration. Real-world AI deployments are more complex than a single chef, and the vocabulary is much larger than the five terms discussed below. But these are the basics, and they are essential for everyone negotiating AI contracts.

Culinary school: training

Before the chef ever cooks for you, she goes to culinary school. She learns knife skills, sauces, techniques, and food safety: a general capability across an enormous range of cooking. That’s training, the process that builds a foundation model’s broad ability, using massive amounts of data, generally before you show up. You usually had no say in her education, and yet you inherit it, good habits and bad, because it shaped everything she does.

The apprenticeship: fine-tuning

After school, the chef apprentices at a French restaurant. She’s now specializing—learning a particular cuisine through hands-on work. When she’s finished, she’s not just a chef anymore. She’s a French chef. That’s fine-tuning: taking a generally capable model and adapting it to a specific purpose. Keep in mind that the apprenticeship is training, too. It’s specialized training layered on top of what she learned at culinary school. Now you might be thinking, “Of course, an apprenticeship is training!” If so, great, because remembering this fact is really important during your contract negotiations (more on this below).

One more thing about this stage, because everything that follows depends on it: what she learns in the apprenticeship isn’t a binder she can return at the end. It’s essentially muscle memory. For all practical purposes, she can no more hand it back than you can forget how to ride a bicycle.

The recipe book: RAG

Now she’s cooking at your restaurant, and tonight’s menu includes a dish she hasn’t made since culinary school. She could try to remember it, reaching all the way back to her lessons, reconstructing the recipe from a years-old impression. Sometimes she will get it right. Sometimes she will confidently produce something that looks sort of like the dish but isn’t quite right. That confident invention is a hallucination, and it’s especially likely when a model generates an answer from distant training rather than from a source in front of it.

So, to reduce that risk, you hand her a recipe book to reference during service. That’s RAG, retrieval-augmented generation. The model doesn’t have to remember—it looks things up in materials placed in front of it, often materials you supplied. And if you’re wondering why a trained specialist needs your book at all, that’s the point. You are not relying only on her memory. You bring the information, and she brings the skills to work with it. This is why RAG exists: as a hedge against the model’s memory. The recipe book helps, but it isn’t a guarantee, so the system can still pull the wrong recipe, and the chef can still misread the right one.

Standing instructions: configuration

Before service, the chef gets the restaurant’s standing instructions: the house style, the permitted substitutions, the safety checks she must run. That’s configuration: the system prompts, settings, and standing policies that tell the model how to behave for you specifically. Similar to the recipe book, the instructions are something you handed her. They don’t change who she is. If you take the instruction sheet off the wall, she reverts to the way she used to cook.

Dinner service: inference

Next, the orders are placed, each with its own details (say, the allergy at table six), and she cooks[1] the order. Every plate served to diners is inference, the model applying everything above (her schooling, her apprenticeship, the recipe book, the instructions) to produce an output in response to a specific request. This is the only part of the chef’s entire career that you, the AI user, actually see. Everything else happened backstage, and yet it’s your name over the door.

Once you understand her career, read a common assurance in AI contracting, “we don’t train on your data,” and notice how little it says.

The AI contract’s promise

Here’s why the chef is critical to your contracts. Once you understand her career, read a common assurance in AI contracting, “we don’t train on your data,” and notice how little it says.

Start with the word “train.” Remember that the apprenticeship is training, too, so the promise should extend to fine-tuning as well as to the culinary school. But unless your contract defines the term, its scope is open to interpretation, and in day-to-day performance, the vendor’s reading is applied first, by the party with the least incentive to read it broadly. That’s why careful drafters spell it out: “train, fine-tune, or otherwise improve.” The promise also says nothing about the recipe book: where your supplied materials are stored, who can access them, and whether they are returned to you at the end of the contract. And it says nothing about the records kept while she cooks in your kitchen: the orders, your feedback, what’s sent back, what your kitchen struggles with. The chef doesn’t learn merely by serving dinner, but the vendor who staffed your kitchen can learn a great deal from those records, without ever training anything on them.

The same goes for the other comforting promise, “we’ll delete your data when the contract ends.” If your data was used for fine-tuning and the vendor keeps the tuned model, deleting the files only removes them; it doesn’t remove what the model learned from them. You can take back the recipes. You cannot reliably make the chef forget what she learned.

To be clear, this is not a story about vendors tricking anyone. It’s about a literacy imbalance. The vendor understands the chef’s entire career, and most buyers only ever see dinner service, yet given how much depends on understanding what you are agreeing to, both parties should come to the table with a roughly equivalent understanding. Without that basic literacy, you don’t know what you’re buying, what the risks are, or what your protections cover, and that’s true whether you’re a government agency or a company.

The harder problem: what she learned

The different parts of the chef behave differently, which is exactly why the vocabulary matters. The materials you supplied, the recipe book and the instructions, can often be segregated, inspected, and returned if the system is built that way and your contract requires it. The things she learned, the schooling and the apprenticeship, are embedded in the chef herself: hard to inspect, and difficult (though not impossible) to unwind. And once that learning happens, “give it back” is essentially off the menu.

You can take back the recipes. You cannot reliably make the chef forget what she learned.

That raises a set of questions that get complicated fast. Who has rights to the customization—the version of the chef built for you—and does the vendor keep the underlying chef it arrived with? What is the vendor allowed to do with that custom chef, and with what she learned, after your contract ends? Can it send her across the street to cook your signature dishes for your competitor? Restricting use and claiming ownership are different legal tools, and they raise different problems. These are not hypothetical questions: GSA’s revised draft AI clause is wrestling with all of them right now (I analyzed the earlier draft in Lawfare). I will address those issues in a forthcoming piece. The point is simpler: you cannot even ask these questions unless you know which part of the chef your contract is pointed at. And if you can’t ask them, you don’t know whether the protection you negotiated is real.

Learn the cake. Learn the chef

The wedding cake and the chef do different jobs, and you need both. The cake helps you understand what you’re buying. The chef helps you understand how it works. That’s why I begin every AI procurement training with the same advice: learn the cake and learn the chef. If you don’t, you have no idea what you’re negotiating or what you’ve already agreed to in your contracts.

---

[1] Yes, I know that technically a “chef” doesn’t cook the dinner, but just go with it (please).  

I spent the weekend thinking about the latest government directive regarding Anthropic, and I kept returning to a theme from my recent scholarship.

For the past year and a half, I’ve researched and written about the federal government’s approach to AI governance. Much of my concern centers on a false binary: the claim that governance and innovation are opposing forces. That oversight is a drag, that safeguards are “blockers,” and that the only way to win the AI race against China is to treat regulation and bureaucratic process as the enemy of AI dominance. It is the underpinning of this administration’s AI policy. Don’t take my word for it. Read some of the statements made repeatedly across this administration:

• “The United States continues to lead the world in Artificial Intelligence (AI) because of the enormous talent and innovation of our AI industry, and because we refuse to stifle this innovation with overly burdensome regulation.”
• “It is the policy of the United States to sustain and enhance the United States’ global AI dominance through a minimally burdensome national policy framework for AI.”
• “To maintain global leadership in AI, America’s private sector must be unencumbered by bureaucratic red tape.”

I have argued that this is the wrong approach to AI governance. In Buying Blind: Corruption Risk and the Erosion of Oversight in Federal AI Procurement, I argued that governance and innovation are not opposing forces but mutually reinforcing conditions for responsible AI acquisition and deployment. Governance sustains innovation by ensuring fair, transparent markets and by building the institutional trust that adoption depends on. In Governance as a “Blocker”: How the Pentagon’s New AI Strategy Trades Oversight for Speed, I walked through decades of procurement history to show what happens when we treat oversight as the enemy of progress. I pointed to other mature industries that run critical infrastructure, such as aviation, pharmaceuticals, and financial auditing, that long ago reached the opposite conclusion: in high-risk systems, oversight is the condition that enables innovation without destroying trust.

What I never considered, in any of my work, was that the speed-first administration—the one that treats oversight as the thing standing between America and global AI dominance—would be the one to pull the trigger. According to New York Times reporting, Anthropic received 90 minutes’ notice before the government moved to restrict foreign-national access to its Fable 5 and Mythos 5 models on national security grounds. According to Anthropic, the restriction applies to any foreign national, including its own employees. It was broad enough that the company had to disable both models for all customers to comply. This came on the heels of a supply-chain-risk designation against the same company, announced via tweet, which was later backfilled with a justification and preliminarily blocked by a federal judge, who found serious procedural problems and that Anthropic was likely to succeed on its claim that the government retaliated against it for protected speech.

There may well be a legitimate national security concern this time, but the way this was done makes it impossible to know and casts even a justified action in the worst possible light. The problem is not that the government exercised discretion; national security demands such latitude. Administration officials reportedly claim the company failed to honor a cybersecurity executive order, but a dispute like that is precisely what a fair process is meant to resolve, not a 90-minute ultimatum. What is striking is the absence of any meaningful process.

In Governance as a “Blocker,” I discussed my colleague Professor Joshua Schwartz’s description of procurement regulation as a pendulum that swings between the costs of overregulation and underregulation. When rigid rules create inefficiency, policymakers push for discretion; when discretion enables abuse, the system swings back toward constraint. Neither extreme is stable, and across administrations, the government rarely gets the calibration right. But I had been thinking about that pendulum as a swing between too many rules and too few. What happened this week is something else entirely: not too few rules, but no real process. Absolute discretion is not the deregulated end of the pendulum. It is the unstable end—the point where the absence of any constraint produces exactly the abuse that has always swung the pendulum back toward a period of aggressive regulation and oversight.

We’ve seen this movie before, and we know how it ends. Operation Ill Wind exposed systemic corruption in defense procurement and led to the passage of the Procurement Integrity Act. The pricing, waste, and defense management scandals of the 1980s led to the creation of the Packard Commission. Of course, the actors differ—then it was contractors exploiting lax oversight, now it is the government wielding unchecked discretion. But the lesson holds: extremes never last and ultimately lead to overcorrection. And it is why the deepest irony of this ordeal is that the people who believe they are protecting innovation from governance are governing in ways that have always produced more of the regulation they fear.

Start with a single firm. Stable, predictable governance is what makes frontier investment rational; arbitrary exclusion makes it a gamble. Nothing chills this incentive faster than knowing your market access can vanish overnight, on a contested basis, and with no meaningful opportunity to respond before it does.

The administration says it wants to lead the AI race, refuses to stifle innovation, and insists America’s AI leadership relies on a thriving private sector. Then it moves against a leading developer on national security grounds, leaving the company with no choice but to pull its best models for everyone to ensure compliance. That is a strange way to treat the private sector on which American AI leadership depends.

The damage does not stop at one firm. An administration that governs this way will not avoid the heavy regulation it fears. It is manufacturing the conditions for catastrophe or abuse that, in every cycle I’ve documented, triggers exactly that response. The speed-first camp thinks it is at the pendulum’s deregulated end, but it is standing at the end that swings back hardest.

In Blacklisting by Tweet is Not a Thing, I asked what kind of business partner the government wants to be. But the concerns raised by this incident are far more significant for the future of frontier AI development. The administration states that America’s leadership in AI depends on unleashing the full potential of its private-sector innovators. Yet within hours, from a midday call to an afternoon directive, it left a leading developer with little choice but to take its best models offline for everyone. Every other frontier developer is watching closely. You cannot unleash an industry on those terms.

I am rooting for the use of AI in government. Every day, I read about a new and exciting government use case. I write about procurement governance and risk because I want federal AI deployment to succeed—so it brings me no joy to write this piece.

When OMB M-25-21 and M-25-22 were released in April 2025, the governance expectations for agency AI use looked reasonable—Chief Artificial Intelligence Officers (CAIOs), inventories, risk management, Authorizations to Operate (ATOs), generative AI policies, impact assessments, etc. Yet by mid-2025, the administration’s deregulatory posture on AI policy appeared to extend to the federal government’s procurement and deployment of AI. Across multiple policies, programs, and public statements, the administration signaled that agencies were expected to accelerate AI adoption, even as governance structures and technical capacity struggled to keep pace.

In my article, Buying Blind: Corruption Risk and the Erosion of Oversight in Federal AI Procurement, I warned about exactly this dynamic:

The deregulatory trajectory has narrowed pathways for implementing [government AI procurement] safeguards. Commercial acquisition preferences direct agencies toward procurement methods least compatible with governance protections, while simultaneous workforce cuts leave fewer acquisition professionals with less AI-specific expertise to implement whatever safeguards remain available.

M-25-22 articulates principles for responsible AI procurement while the post-AI Action Plan environment removes the regulatory authority and workforce capacity necessary to implement them. Without binding regulations or agency-wide policies, M-25-22’s safeguards exist as aspirations rather than obligations.

And in my article, Governance as a“Blocker”: How the Pentagon’s New AI Strategy Trades Oversight for Speed, I addressed the broader leadership and adoption dynamic:

[T]one at the top matters. When leadership frames safeguards as barriers, the organization comes to see compliance as an obstacle rather than a risk-management tool. Adoption metrics measure whether AI capabilities are being used and at what pace, not whether the governance infrastructure underlying those deployments is sound. The practical effect is to shift risk downstream, where it can surface as security incidents, performance failures, bid protests, or mission impact.

We now have new evidence of what governance failure looks like in practice. On May 12, the United States Department of Agriculture’s Inspector General (IG) released a report, Cybersecurity of Artificial Intelligence Technology at USDA, determining that USDA has not fully implemented cybersecurity and governance controls within AI systems in compliance with federal standards, leaving the agency at risk of data breaches or reputational harm.

Specifically, the IG found:

• No security authorization for 89% of AI use cases. OIG found that 73 of 82 operational AI use cases lacked a required system ATO prior to operation and were not recorded in CSAM. An ATO is effectively a security sign-off: someone in charge must review a computer system for risks and approve it before it can run on a federal network. The Federal Information Security Modernization Act (FISMA) and USDA’s own departmental regulations require it for any federal IT system.
• No generative AI policy, despite widespread GenAI use. USDA missed the December 29, 2025 OMB M-25-21 deadlines to update agency IT policies and to develop a generative AI (GenAI) policy. The Office of the Chief Information Officer (OCIO) told OIG it has not updated or developed any AI policies or procedures.
• No documented impact reviews for high-impact AI. OIG sampled eight AI use cases against the high-impact criteria: civil rights, access to government resources, public safety, and critical infrastructure. USDA’s own AI inventory separately marks facial-recognition surveillance and AI tools for cover crop mapping, planting date detection, and acreage and crop type validation as high-impact. OIG found OCIO had not performed or documented the required impact reviews.
• No reliable AI inventory. USDA’s AI inventory relies entirely on an annual self-report data call. OIG examined 82 operational use cases and concluded that the inventory cannot be verified as complete or accurate.

Beyond these findings, OIG flagged a deeper problem: shadow AI. Shadow AI is the unsanctioned use of AI tools by employees without the formal approval or oversight of the information technology (IT) department. With an inventory built on annual self-reporting and no policy governing GenAI use, USDA cannot know what AI tools its workforce is running on departmental data. The OIG concluded that the methodology itself produces this risk.

Although shadow AI is a significant concern, it is equally alarming that even sanctioned AI can create major risks when agency-level governance is missing—no generative AI policy, no ATOs, no impact assessments, no reliable inventory.

The USDA report does not establish that these use cases came through GSA’s AI offerings through its OneGov program. That distinction is important. The report documents an agency-level governance failure, not a OneGov procurement failure. But OneGov is still relevant because it shows the adoption environment in which those failures now operate: AI tools are being made available across government quickly and cheaply, through centralized contracting channels, while responsibility for inventories, ATOs, impact assessments, and internal use policies remains with the ordering or deploying agency.

OneGov has reached 3.4 million federal users with AI tools at near-zero cost: OpenAI’s ChatGPT Enterprise and Anthropic’s Claude Enterprise at $1 per agency for one year, Google’s Gemini at $0.47 per agency through 2026, xAI’s Grok at $0.42 per agency for eighteen months, and Perplexity at $0.25 per agency for eighteen months. As I wrote in Buying Blind, “below-market pricing drives widespread adoption across the federal government, locking in dependencies before agencies understand costs, develop expertise, establish governance, or build exit strategies.”

GSA may be thinking about AI governance, but we cannot say the same for USDA. Centralized purchasing does not solve the problem of decentralized governance. Whether USDA employees are using centrally procured tools, agency-procured tools, embedded AI features, or unsanctioned AI accessed off the books, USDA still needs the controls OIG found missing.

That’s the most critical point: the procurement channel may vary, but the governance obligation does not.

None of this has produced the kind of high-profile government AI debacle that captures public attention—at least, not that we know of. But the conditions described in this report are exactly the kind that produce one.

The structural separation between centralized procurement and decentralized governance is the downstream consequence that Buying Blind warned about. USDA, by itself, is what happens when AI adoption outpaces governance and capacity.

The conditions producing these failures are present across the federal government. Whether other agencies have built governance to match those conditions is a question we will answer only through additional IG evaluations. USDA may be an outlier, or it may be one of the clearest looks so far at agency-wide AI governance. With AI adoption continuing to outrun governance and capacity, USDA is what we can see. The more troubling concern is what we can’t.  

Yesterday, National Economic Council Director Kevin Hassett said the administration is studying an executive order that would require AI models to be vetted “just like an FDA drug” before public release.

People are underestimating the influence public procurement already has on the frontier AI debate.

To help understand why, a brief history lesson is instructive. Section 508 of the Rehabilitation Act requires federal agencies to ensure their information and communication technology is accessible to people with disabilities.

Section 508 did not directly regulate the commercial ICT market—it operated through federal procurement. Vendors seeking federal business typically had to provide accessibility documentation, usually through Accessibility Conformance Reports that explain the extent to which their products conform to federal accessibility standards. These reports became credentials beyond federal procurement: states added similar requirements, enterprise customers requested the same documentation, and vendors found it cheaper to design accessibility into products than to maintain separate federal and commercial lines. In short, federal acquisition policy shaped the commercial baseline beyond its original reach.

It’s early days, but that same dynamic is emerging for frontier AI.

On May 1, the Pentagon announced agreements with SpaceX, OpenAI, Google, NVIDIA, Reflection, Microsoft, AWS, and Oracle to deploy advanced AI on classified IL6 and IL7 networks. On May 5, the Center for AI Standards and Innovation (CAISI) announced agreements with Google DeepMind, Microsoft, and xAI covering pre-deployment evaluation, classified-environment testing, and information sharing. Both announcements follow a March 18 partnership announcement between GSA and NIST to “Boost AI Evaluation Science in Federal Procurement.” Under this partnership, CAISI will provide tools and guidance to help GSA evaluate advanced AI models, select and interpret benchmarks, conduct testing in federal workflows, and develop evaluation guidelines and checklists for other agencies to use.

These announcements are not formally coordinated, but read together, they show the federal government’s growing leverage over companies central to the frontier AI stack. The CAISI agreements are formally voluntary, but leverage operates regardless of whether participation is mandated. The government does not need a freestanding statutory mandate or an executive order. It can achieve much the same effect through procurement by making cooperation on testing, evaluation, classified-environment assessment, documentation, and deployment constraints part of how frontier developers maintain federal market access. For companies seeking sensitive federal AI work, especially classified defense work, this is becoming the new price of admission.

While stakeholders debate whether the latest developments amount to a licensing regime in disguise, the government is quietly building much the same effect through procurement—and calling it voluntary.

Students of federal procurement history are well aware of this familiar pattern. The government does not always need to win the underlying legal question to shape behavior. It needs the leverage to be credible enough that regulated parties act on it.

If CAISI follows the Section 508 path, federal buyers will eventually treat CAISI evaluation, testing artifacts, model documentation, and lawful-use terms as conditions of adoption. Those conditions will travel through prime contractors, cloud marketplaces, subcontractors, regulated enterprise buyers, and product design. Vendors will find it cheaper to build one product line than two, and federal evaluation will become the commercial default. Of course, not every federal requirement will spill over. Vendors may maintain separate model versions for specific usage constraints, but evaluation artifacts, documentation practices, and testing infrastructure are more likely to be standardized across product lines.

At this stage, though, the infrastructure is still nascent. Unlike Section 508, CAISI currently lacks the statutory backing, FAR integration, and enforcement ecosystem that made Section 508 transformative. Still, the trajectory is what matters. The licensing-authority debate asks whether the executive branch can stop the release of commercial AI models. The procurement question asks what the government can require of any model used in federal work. The government does not need to win the first debate. Procurement is already reshaping the market.

 “I don’t know if it’s murder, but it looks like an attempt to cripple Anthropic. And specifically, my concern is whether Anthropic is being punished for criticizing the government’s contracting position in the press.”

Those words, spoken by Judge Rita Lin at the March 24 hearing on Anthropic’s motion for a preliminary injunction against the Department of Defense and sixteen other federal agencies, address the question that government contractors and Silicon Valley have been asking for the past month.

I have described contractor blacklisting as the “corporate death penalty,” a “corporate death sentence,” and the “corporate grim reaper,” but corporate “murder” is a first.

In late February, the President directed every federal agency to stop using Anthropic’s AI technology. The Secretary of Defense also designated Anthropic a supply chain risk to national security under 10 U.S.C. § 3252 after the company refused to remove usage restrictions from its contracts with the Department. Anthropic filed suit in the Northern District of California alleging that the government’s actions were unlawful. It is separately challenging a covered procurement action under 41 U.S.C. § 4713, which is subject to exclusive review in the D.C. Circuit. I have discussed the underlying policy dispute, including the “all lawful use” directive and the structural gaps in AI procurement governance, in a prior Lawfare piece. Alan Rozenshtein’s Lawfare piece addresses the remedy question from a national security law perspective.

On March 26, Judge Lin granted Anthropic’s motion for a preliminary injunction, enjoining the president’s social media directive, the secretary’s social media directive, and the Section 3252 supply chain designation. The order is stayed for seven days. The final paragraph of the preliminary injunction order captures in three sentences what this piece explains at length:

This Order restores the status quo. It does not bar any Defendant from taking any lawful action that would have been available to it on February 27, 2026, prior to the issuances of the Presidential Directive and the Hegseth Directive and entry of the Supply Chain Designation. For example, this Order does not require the Department of War to use Anthropic’s products or services and does not prevent the Department of War from transitioning to other artificial intelligence providers, so long as those actions are consistent with applicable regulations, statutes, and constitutional provisions.

Everyone expects the government to appeal, so that is probably next. But the question I keep hearing is, what do the federal contracting rules require when the government decides it no longer wants to work with a contractor?

The procurement system provides detailed, well-established answers to that question, developed by policymakers over decades. Section 3252 required the Secretary to determine, in writing, that less intrusive measures were not reasonably available, and to tell Congress which alternatives were considered and why they were rejected. This piece describes some of those measures.

The Tools the Government Had But Didn’t Use

First, the government is not required to contract with Anthropic. Under Perkins v. Lukens Steel, the government enjoys broad discretion to determine with whom it will do business and on what terms. No one disputes that the Executive Branch can decide it no longer wants a particular vendor’s products or services, but it must do so consistent with the law. Beyond this, the federal contracting system offers a range of tools for ending a contractor relationship, and they escalate in severity. With respect to Anthropic, the government skipped to the most extreme one.

The options available to the government for severing ties with Anthropic depend on the type of contract involved. Based on the public record, Anthropic had FAR-based contracts, including a GSA “OneGov” agreement; deployments through third-party contractors, including Palantir’s Maven Smart System; and a prototype Other Transaction (OT) with the Chief Digital and Artificial Intelligence Office. The tools available to end each relationship differ accordingly.

We do not know the full picture, but the government had multiple defined processes available to end its relationship with Anthropic and begin removing it from federal systems.

Termination

Under Anthropic’s FAR-based agreements, the simplest way for the government to sever its relationship with the company is through a “termination for convenience“ (T4C). If the contract includes a termination for convenience clause, as most FAR-based contracts do, the contracting officer may terminate when doing so is in the government’s interest. The standard is broad, but not limitless, as a termination cannot be an act of bad faith or an abuse of discretion. The contractor is entitled to certain costs when the government exercises its T4C rights, so the parties negotiate a settlement; if they disagree, the disputes process outlined in FAR Part 33 is followed.

If the concept of “broad government termination rights” sounds vaguely familiar, it is because you may recall that in early 2025, the government, through DOGE, exercised its T4C authority on a sweeping and unprecedented basis, terminating thousands of contracts for convenience across the federal government. The tool is neither obscure nor untested, and the government has shown absolutely no hesitation in deploying it.

There is little doubt that the government could have demonstrated that terminating its agreements with Anthropic was in the government’s interest. The administration has articulated a policy rationale—it wants AI models free from vendor usage restrictions—and Anthropic declined to comply. Whether or not you agree with the policy, the threshold is not hard to meet. They’ve certainly done it for less.

With respect to Anthropic’s OT agreement with CDAO, the picture is less certain, as the public record does not disclose the specific terms. Unlike FAR-based contracts, OTs are flexible instruments, so the FAR-based termination process does not automatically apply. But OTs often include FAR-like termination provisions, so the government may well have had a contractual off-ramp for the direct relationship. Beyond the government’s options, Anthropic itself offered to facilitate a transition to another provider.

Termination addresses the government’s immediate concern: current operational reliance on a vendor it no longer trusts. The government had contractual tools to address that concern without invoking a supply chain exclusion determination. It did not use them.

Suspension and Debarment

Termination for convenience is common enough that the FAR has an entire disputes process built around it. What happened last year was jarring, but a T4C in this instance wouldn’t have surprised anyone. The next option on the less-intrusive-measures menu is a significant jump, more like moving from a speeding ticket to a life sentence. But even a life sentence has more process than what the government did here.

Discretionary suspension and debarment are the federal procurement system’s mechanisms for excluding “nonresponsible” contractors from doing business with the government. Regulated by FAR 9.4, both tools are triggered by evidence of serious misconduct or grossly incompetent performance, but they serve different functions. Suspension is immediate and temporary, designed to protect the government while an investigation or legal proceeding is underway. Debarment is longer-term, typically following a criminal conviction, a civil judgment, or a finding that the contractor’s conduct is serious enough to affect its present responsibility. This is the FAR’s nuclear option. And given its potential consequences (both direct and collateral) it’s no wonder we call it the corporate death penalty.

Before I continue, I want to stop and address something directly. I am not suggesting that the government should have pursued debarment. On these facts, I do not believe it would survive judicial scrutiny. At issue is a contractual dispute in which a vendor declined to accept the terms the government wanted. That is not the kind of triggering misconduct the system was designed to address. But if we are evaluating less intrusive measures, which Section 3252 requires the Secretary to consider, then understanding what even this most extreme tool requires is essential. Because it shows just how far the government departed from any recognized process.

Specifically, the debarment process itself recognizes how consequential it can be for a contractor. FAR 9.402(b) establishes the core principle: debarment and suspension may be imposed “only in the public interest for the Government’s protection and not for purposes of punishment.”

FAR 9.4 implements that principle through a framework that requires notice and an opportunity to respond, though the timing differs depending on the tool used. These determinations are made by a Suspension and Debarment Official (SDO), whose ultimate question is one of present responsibility: can this contractor be trusted to continue doing business with the federal government? In answering this question, the SDO will generally assess present responsibility in light of remedial measures, mitigating factors, and aggravating factors. Suspension and debarment generally preclude new prime contract awards and restrict certain future subcontracts, but they do not, by themselves, require the termination of existing agreements. FAR 9.405-1 expressly permits agencies to continue existing contracts and subcontracts unless the agency head directs otherwise.

The Subcontractor Problem and Section 3252

Anthropic’s technology reportedly runs through Palantir’s Maven Smart Systems in classified defense workflows. The government’s direct contractual relationship appears to be with Palantir, not Anthropic. That makes it harder to use ordinary tools for severing the relationship. Directing a prime to remove a deeply integrated supplier mid-performance is indirect and creates commercial and technical risk for the prime. Reuters has reported that removing Claude would require Palantir to replace the model and rebuild parts of its software. As discussed above, debarment would constrain certain future subcontracting, but it would not by itself compel a prime to unwind an existing relationship.

Section 3252 offers something different. Congress established the original authority in the FY 2011 NDAA to address supply-chain risks in sensitive defense information technology procurements, and the statute defines “supply chain risk” as the “risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert” a covered system. Applying it to a domestic AI company in a dispute over contract terms pushes the statute well beyond its ordinary adversary-focused framing. Yet the structural difficulty of reaching a deeply embedded supplier through ordinary channels may help explain why the government reached for it.

Among the covered procurement actions the statute authorizes is the decision to withhold consent for a subcontract with a particular source or to direct a contractor to exclude a particular source from consideration for a subcontract (as implemented by DFARS 239.73). That subcontract-specific authority is best read as prospective. It addresses future subcontracting decisions, not the unwinding of an already-performing subcontract. The government, therefore, could have used a narrower, forward-looking measure while existing arrangements transitioned off on a defined timeline.

Instead, according to the public record in the Anthropic litigation, it chose a much broader covered procurement action, and the record does not show that narrower alternatives were meaningfully considered. Indeed, Judge Lin noted that the congressional notices required by § 3252(b)(3)(B) did not contain the required discussion of less intrusive measures, and the government conceded that omission at oral argument.

An Unusual Course of Action . . . Even for Government Procurement

There is no public record of Section 3252 being used to designate a domestic company as a supply chain risk. No president has ever directed government-wide exclusion of a named contractor by social media post. The government designated Anthropic a supply chain risk to national security and then gave itself six months to keep using Anthropic’s products on classified systems.

According to Anthropic’s complaint and supporting declarations, the government at one point threatened to both invoke the Defense Production Act to compel Anthropic to provide its services and designate it a supply chain risk, thereby excluding it—contradictory remedies directed at the same company in the same dispute. And as I type this sentence, according to Anthropic’s court filings, the contractor the government branded a national security threat continues to maintain its Top Secret facility security clearance, issued by the same government that currently declares it a threat to the United States government.

On February 27, the President posted on social media directing every federal agency to “IMMEDIATELY CEASE all use of Anthropic’s technology.” The post characterized Anthropic as a “RADICAL LEFT, WOKE COMPANY” and threatened “major civil and criminal consequences,” without citing a single source of authority for this extraordinary action. Court filings show that Anthropic had contracts or usage with at least 16 federal agencies. Treasury Secretary Bessent posted on X that the department was “terminating all use of Anthropic products.” The Federal Housing Finance Agency and the General Services Administration (GSA) followed. One after another, all on social media, none citing any statutory authority.

Later that day, Secretary Hegseth posted on social media, directing the Department to “designate Anthropic a Supply-Chain Risk to National Security.” No statute was cited. The Secretary described Anthropic’s stance as “fundamentally incompatible with American principles,” criticized its “defective altruism” and “Silicon Valley ideology,” and declared: “This decision is final.” He also directed that “no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic.”

On March 3, the joint recommendation and risk analysis materialized, along with the statutory bases, which had appeared in neither of the social media posts. The Secretary signed the Secretarial Determination the same day the recommendations were submitted. The government’s opposition brief characterizes the Secretary’s February 27 social media post as “the beginning” of the decision-making process and argues it was not final agency action.

So, let’s take them at their word. The Secretary publicly announced the outcome, directed subordinates to produce the justification, and the justification confirmed the predetermined conclusion four days later. The record went from initiation to final determination without the contractor ever having an opportunity to respond before the decision was made.

None of the Established Processes Were Used

The government did not terminate Anthropic’s contracts for convenience; it directed every federal agency to stop using Anthropic’s products via social media. It did not initiate suspension or debarment proceedings before an SDO; the decision was made by a political appointee who had already announced the result on social media before any internal process had commenced. At the March 24 hearing, the government’s theory narrowed to speculation that Anthropic might install a “kill switch” or manipulate its software during operations. Anthropic’s counsel denied that the company has any such capability once Claude is deployed, and the government’s lawyer could not confirm otherwise.

The Secretary’s post also directed that “no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic,” a directive for which the government later conceded there was no statutory basis. At the March 24 hearing, the government’s lawyer further conceded that the statement had “absolutely no legal effect at all.” Judge Lin then pressed the government on what, if anything, prevents the Department from changing its position on how the sentence would operate.

The Exclusion Without a Name

Courts have long recognized that a government agency’s conduct can effectively result in a government-wide exclusion without formal debarment proceedings ever being initiated. In Old Dominion Dairy Products, Inc. v. Secretary of Defense, the D.C. Circuit emphasized the severe economic and reputational consequences of effectively excluding a contractor from further government work, including the loss of contracts that would otherwise have been awarded and the effective destruction of the business.

De facto debarment is notoriously difficult to prove. As Dominique Casimir and Alexandra Barbee-Garrett explain in their piece, The Government’s Just Not That Into You—Is it De Facto Contractor Debarment?, the contractor typically faces “an uphill battle,” where their proposals “simply lose out quietly to those of its competitors, again and again, making it difficult to discern that a de facto debarment is occurring.” Courts generally require either an agency statement that it will not award future contracts or agency conduct demonstrating the same.

That’s what makes this case so remarkable. De facto debarment cases usually require painstaking reconstruction of a pattern of informal agency conduct, such as repeated nonresponsibility findings, back-channel communications between acquisition professionals, or unexplained refusals to award. This one came with a press release. And the President later stated: “I fired [them] like dogs.”

The kinds of economic and reputational harm Old Dominion described were already underway before any statutory process had begun.

What Kind of Business Partner Does the Government Want to Be?

If the government can brand a contractor a national security threat for refusing to accept contract terms, every federal contract negotiation becomes existential. At the March 24 hearing, Judge Lin pressed the government on precisely this point, asking whether an IT vendor can be designated a supply chain risk because it “is stubborn and insists on certain terms and it asks annoying questions.” She called that “a pretty low bar.”

The deterrent effect extends beyond Anthropic. It reaches every contractor that might push back on terms it considers unworkable, unsafe, or commercially unreasonable. The procurement system depends on good-faith negotiation between the government and its contractors. Contractors must be able to say no without the government branding them a national security threat—not for protection, but as punishment for driving a hard bargain.

I have been writing, teaching, and advising on suspension and debarment for nearly two decades. I know what it looks like when the government excludes a contractor. I know what it looks like when the government abuses the process. And I know what it looks like when the government skips the process entirely.

The corporate death penalty has rules. What happened here followed none of them.