Leading with AI: governance for an AI-enabled GovCon company
Executive15 min
By the end you can
Set a policy for AI use on proposals and contracts.
Know where a person must stay accountable.
Governance is a leadership job
NIST's AI Risk Management Framework is a voluntary resource for organizations that design, develop, deploy or use AI systems, meant to help them manage the risks of AI and promote trustworthy use 1. One of those risks is well documented: language models can generate fluent text that is unfaithful to its source or unsupported by it, which researchers call hallucination 2.
AI tools are also information systems. FAR 52.204-21's basic safeguarding controls include limiting information system access to authorized users, processes acting on behalf of authorized users, or devices 3.
Practice, what a company AI policy should settle, signed by the chief executive and reviewed each year: which tools are approved, for which kinds of information; what AI may draft and what it may never decide; who must approve anything that leaves the company; how sources are checked; what is logged and kept; how an AI error is reported and fixed; how vendors are reviewed; and who owns the policy. An owner below the executive team will not have the authority to stop a bid.
Check 1
Where a person must stay accountable
In Bids2Bank, drafted sentences pass gates with fixed thresholds: retrieval needs a similarity of at least 0.70 4 and entailment a score of at least 0.80 5. A sentence flagged for review is held for a person 6, as is one that passed only on the word-overlap fallback because the model was unavailable 7.
A package is marked submitted only after a person types the approval phrase 8; only a signed-in person can ever approve 9; and the approval check never fails open: anything it cannot check is refused 10.
Exceptions are bounded and recorded. A Bids2Bank approval override is granted for a limited number of hours 11, at most 72 12, needs a written reason 13, and is sealed on the chain before it is stored 14.
Practice, a decision-rights table for the leadership team. AI may draft, summarize, search and check. A named person approves every submission, price, representation and certification. An executive approves every exception, with a written reason and an end date. No API key, agent or automated job ever signs for the company.
Check 2
Measure it, and keep the record
Bids2Bank's nightly optimizer reports on repeated trouble but never changes prompts, routing or agent memory 15, and each pursuit's audit evidence can be exported as one signed document 16.
Practice, what the board should see each quarter: how many AI-drafted sentences needed a person, and how many were changed; every override, who granted it and why; AI incidents and what changed after each; which tools were approved or withdrawn; and whether a sample of submitted proposals was traced back to its sources. Ask the same questions of any AI vendor you rely on.
Worked example. Company K adopts an AI drafting tool. For the first quarter its policy allows AI drafts only for technical and management volumes, requires the proposal manager to clear every flagged sentence, and reserves pricing, representations and certifications to named people. At the quarter review the board sees that one in eight drafted sentences needed a person and that two overrides were granted, both with written reasons, and it extends the tool to past-performance volumes.