Most contractors adopted AI tools the way most organizations did: individually, informally and ahead of any policy. For low-stakes work that is understandable and often harmless. Federal pursuits are not low-stakes work. They involve customer information with handling requirements, claims that become contractual commitments, and submissions evaluated on their accuracy.
The alternative to informal use is not prohibition. It is a posture: the company’s agreed position on which tools may be used, with which information, for which tasks, and with whose review. A good posture is specific enough that anyone on the team can answer those questions without having to ask.
Four boundaries around a workflow
A posture is easiest to write, and to follow, when it is attached to a defined task rather than to a tool. Around each task sit four boundaries.
The data boundary deserves the most care. Customer and contract requirements can restrict where information may be processed, and controlled material needs an approved environment and handling process. General access to a tool is not authorization to put that material into it. The NIST AI Risk Management Framework offers a useful shared vocabulary for these decisions, in particular its insistence on mapping the context in which a system is used before trying to measure it.
Check where errors become commitments
Review works best at the points where an error would otherwise become a promise. A pursuit has four of them.
Most failures begin at the second. Generated text is fluent by construction, and fluency hides gaps. The discipline that matters is the line between a suggestion and a confirmed fact: every substantive claim should travel with its source, and an unknown should be marked as unknown rather than filled with something plausible.
Corrections are evidence too. Recording an error, its cause and the change it prompted turns a single mistake into an improvement in the workflow. It also makes it possible to see when quality changes because a tool, an input or a responsibility changed.
Test one workflow before scaling it
The fastest way to adopt a tool well is to adopt it narrowly first. Choose a task that repeats often enough to compare, such as requirement review or preparation of a supported response, and set the information boundaries and the evaluation standard before the trial begins.
A tool should earn a larger role through results on the company’s own work, with the required controls in place. That standard is stricter than enthusiasm and looser than prohibition, which is why it tends to produce adoption that lasts.
From framework to first decision
A framework is only useful if it changes what a team does next week. The simplest way to start is a one-page brief that names the constraint that matters most and the evidence that would settle it.
Sources
National Institute of Standards and Technology, AI Risk Management Framework (AI RMF 1.0), January 2023.
