---
id: "workshop:how-governments-are-buying-ai-now-opportunities-risks-and-leverage"
type: "InnovateUS workshop"
title: "How Governments Are Buying AI Now: Opportunities, Risks, and Leverage"
url: "https://innovate-us.org/how-governments-are-buying-ai-now-opportunities-risks-and-leverage"
date: "2026-03-04"
duration: "60 minutes"
series: "Democratic and Public AI: Practical Strategies for Buying, Building, and Governing AI"
instructors: ["Kaye Sklar","Nishant Shah"]
moderators: ["Beth Simone Noveck"]
recording: "https://www.youtube.com/watch?v=qyR2AWHwqHs"
transcript: "automatic, from the recording"
source: "InnovateUS (innovate-us.org)"
licence: "CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/), as stated on innovate-us.org"
---

# How Governments Are Buying AI Now: Opportunities, Risks, and Leverage

InnovateUS workshop · 4 March 2026 · 60 minutes

Governments are adopting AI through enterprise licenses, pilots, embedded features in existing platforms, and heavily subsidized “government offers.” This opening session maps how AI is actually entering public institutions today—and what that means for control, risk, and long-term flexibility. Participants will examine patterns such as deep discounting, centralized purchasing, closed ecosystems, and “shadow AI,” and explore how these dynamics can either lock governments into proprietary platforms or create leverage to demand something better. The session sets the stage for the series by framing procurement and architecture choices as the key battleground for public AI.

## Learning goals

- Understand the main ways AI is currently acquired and used in government (enterprise deals, off-the-shelf tools, pilots, embedded features, “shadow AI”).

- Recognize the risks of vendor lock-in, loss-leader pricing, and non-portable agents, memory, and workflows.

- Identify where governments have real leverage (procurement, standards, governance) to shape AI markets rather than simply absorb them.

- Articulate why today’s purchasing decisions will shape government AI infrastructure for the next decade.

## Speakers

- **Kaye Sklar**, Senior Program Manager for Content and Insights, Open Contracting Partnership
- **Nishant Shah**, Former Senior AI Advisor, State of Maryland

## Moderators

- **Beth Simone Noveck**, Founder of InnovateUS and Director, Burnes Center for Change and the GovLab

Part of the series [Democratic and Public AI: Practical Strategies for Buying, Building, and Governing AI](https://innovate-us.org/workshop-series/public-ai-buying-and-building-for-civic-use).

Recording: https://www.youtube.com/watch?v=qyR2AWHwqHs

## Transcript

Automatic transcript of the recording: names and terms can be misheard, and the times can be a few seconds off. Each time links to that moment of the video. The transcript alone: https://innovate-us.org/how-governments-are-buying-ai-now-opportunities-risks-and-leverage.txt (plain text) and https://innovate-us.org/how-governments-are-buying-ai-now-opportunities-risks-and-leverage.json (every segment with its start and end second).

**Nishant Shah**

[0:00](https://youtu.be/qyR2AWHwqHs?t=0) They said this is the first in our series on public AI that we are running today. Governments around the world, and again, please finish the poll and we'll send that out in just a moment, governments around the world are rapidly adopting AI. They are under instruction sometimes from a governor or their mayor or their politician, tomorrow we want you to create access to AI for our workforce. At the same time, there is this broader public conversation about public AI or sovereign AI or discussions about governments actually building AI instead of buying AI. So we're really here during this series, I think, to try to bridge that gap between these aspirational conversations around more public, more democratic, accountable, transparent forms of AI on the one hand, and the urgency and pressure that we're under to give access to tools and to adopt existing commercial models.

[1:00](https://youtu.be/qyR2AWHwqHs?t=60) So we're not here to talk in theory, we're really here to kind of bridge that gap between what public institutions are doing now and can do realistically, and what they might do in the future to help us get closer to our public interest aspirations and our greater goals for accountability, transparency, et cetera. So we have two phenomenal speakers here today to help us bridge that gap. Ishan Shah was until recently the senior advisor for responsible AI for the state of Maryland. He led the state's work under Governor Wes Moore to cohere and execute an AI strategy centered on responsible, ethical, and productive use. I'll put his full bio in the chat, but his most important qualification is that he is the owner of a fierce mini doodle named Judo. So Nishant, I think before the session ends, we definitely need a sighting or at the very least a picture of this mini Bernadoodle.

[2:01](https://youtu.be/qyR2AWHwqHs?t=121) Kay, and if you have a dog, Kay, you are welcome to share its picture, is senior manager for content and insights at the Open Contracting Partnership. In that work, she helps the Open Contracting Partnership achieve global scale through practical guidance on program design and supports cross-sector collaboration. She is also one of the co-authors of a fantastic new resource on buying AI that they have put out. Again, we'll put links to both her bio and also to that buying AI guide. And she's joined here by one of her colleagues, Katrine Froucher, who's also in the room. So again, as we're going along, oh, yes, awesome. Thank you. You could, you don't need to show your picture anymore. You can just have your, I think that for the future, we're going to have workshops where only pets participate. I think we're going to do a, maybe for St. Francis Day, we will do a pets only workshop in the future.

[3:02](https://youtu.be/qyR2AWHwqHs?t=182) So they're here to help us navigate this world, this bridge between commercial reality and public interest aspirations. And I just want to thank them for being here. Again, please ask an answer and discuss in the chat, questions for them put in the Q&A. But let me get us started with a very practical, what will seem like a really basic question to both of you, which is how is AI really being acquired today? And maybe Nishant, you could start by sharing your experience in Maryland, and then Kay, we will ask you to kind of share what you're seeing across the states and jurisdictions that you're working with. Yeah, absolutely. Thanks, Beth. And I love your sweater, by the way, that is awesome. Okay. So, you know, I think the headline is that AI is entering government through a lot of different doors. And a lot of it is opportunistic, sort of given the constraints, despite our best efforts to keep it strategic. So you know, for some context here, the lens that we look at AI adoption from in Maryland over the last few years was, you know, A, sort of get tools in hands alongside training so that folks can learn by doing, B, do that in line with security, privacy, governance, policy standards that we created and continue to evolve, sort of C, evolve, you know, or really sort of that build that community and advisory and partnerships and get in talent to power sort of this adoption learning iteration flywheel, do these things, you know, like understanding that the tools and capabilities will change rapidly so that our approach has to be, you know, building a sort of flexible catcher's mitt, in addition to solving for these more near term needs.

[4:54](https://youtu.be/qyR2AWHwqHs?t=294) And then to take the position that much of the innovation from AI as a sort of platform technology will really come bottom up from, you know, like the business analyst who powers a specific permitting workflow or the accessibility expert doing remediation on external documents or the call center, you know, worker fielding a huge backlog of requests. So all that said, as sort of context, you know, trends that I saw in Maryland and elsewhere will probably be honestly like familiar to many of you in this discussion, and I'll note a few, but I'll say up front that these are not mutually exclusive nor exhaustive, and there's a pretty big Venn diagram sort of between them. So, you know, one common pattern is just enabling AI within existing enterprise relationships. And, you know, these are often the collaboration platforms in use. So this is like the Googles, the Microsofts of the world. Maryland, for example, enabled a good portion of its state workforce to leverage Gemini and a broader suite of tools around that.

[5:59](https://youtu.be/qyR2AWHwqHs?t=359) And this is attractive because, you know, it enables AI use where a lot of folks' workflows already exist and sit. It sort of enables AI use in your own environment and in line with your own security and privacy and data and compliance requirements. It gets you access to, you know, cutting edge tools and models. And generally, it's the fastest path to getting folks experimenting with these tools at scale. It's also heavily discounted, you know, at this stage. Gemini, for example, was available at no additional cost. So it's sort of doable as a first step in a highly budget constrained environment. But of course, the downside risk there, which I think we'll talk more about later, is like the risk of lock in, the fact that pricing will likely change over time, and that if all of that goes in a direction that you don't like, you know, your options can be sort of severely curtailed. I think another, you know, common and broad pattern is leveraging extensions of existing contracts. So especially cloud and platform contracts.

[7:09](https://youtu.be/qyR2AWHwqHs?t=429) And that includes, you know, enabling AI features for existing tools. Think like Zoom AI or standing up a sandbox, you know, for experimentation with more bespoke builds. So, you know, for which, you know, for Maryland was on AWS Bedrock or sort of on the talent side, you know, bringing on AI technical expertise, leveraging existing contracts for specific projects. And again, this is often a faster path. And it's often the way that we started sort of leveraging APIs from hyperscalers or foundation model providers, sort of including the approach of, you know, building wrappers on that infrastructure, which a number of states and federal and state and sort of cities have done as well. And so, you know, that said, like this approach, I think, needs really strong governance pathways to ensure that any contract extensions are actually in line with your security and privacy requirements and standards. And in the sort of like really manual and fire driven workflows that are so common in government, it's super easy, we found, for things to fall through the cracks here, particularly where, you know, IT purchasing and building and monitoring is highly decentralized or federated in a state.

[8:28](https://youtu.be/qyR2AWHwqHs?t=508) I think another cut on this is like targeted pilots and proofs of concept, often prioritized top down and sort of framed as a low risk learning exercise. I think this is super helpful and valuable to build expertise and sort of generate evidence and see the art of the possible. But there's also, you know, sort of this like graveyard of proofs of concept, taking up resources with no path to production. So at this stage, you know, a pilot or a POC like really shouldn't be the aim in and of itself, as it often was in a lot of sort of governments sort of back in 2023 and 2024. Nishant, maybe let me jump in here if I can and just to bring Kay in to see what she's seeing. And if you can multitask in the chat to just give us a sense of some timelines between sort of pilots, a sandbox, full scale, hyperscaler, like what that look like for you. And then, Kay, let's bring you in and then we'll open it up to both of you again.

**Kaye Sklar**

[9:30](https://youtu.be/qyR2AWHwqHs?t=570) Sure thing. So I would just say that a lot of what we're seeing echoes what Nishant has seen in the state of Maryland. So I'm sorry. And so Open Contracting Partnership recently put out a guide around buying AI. And as part of our research process, we spoke to folks here in the U.S., across levels of government, as well as to people around the world. So I can say that a lot of the trends that Nishant saw for the state of Maryland really resonate in the U.S. and around the globe. And those, in summary, like those big, big trends are a lot of buying through enterprise licenses. Often those are being purchased centrally. We're seeing pilots with the private sector and academia, as mentioned, and those are particularly interesting because they're not necessarily going through procurement per se. So if you're seeking to use procurement as a lever, just be aware that that AI might not be entering through the procurement process at all.

[10:31](https://youtu.be/qyR2AWHwqHs?t=631) And then again, to echo Nishant, we are seeing people or companies integrate AI into their products, whether or not they're asked for. So this is kind of like the sneaky, the sneaky AI that either you may have already bought some type of technology and the vendor is integrating it after you've purchased it, or the government is seeking to buy some technology and they never actually asked for AI, but the vendors are providing it as part of their proposals anyways. So those are some of the three buckets that I would say that we're seeing in terms of how AI is entering the government today. Very interesting. And again, if people here are seeing similar models in your jurisdiction or something different, we'd love to hear from you in the chat as well about how things are rolling out in this almost unintentional way that you're describing or sometimes intentional and sometimes unintentional and sometimes a total surprise to find out that a tool now is in AI enabled. So that really segues to the next question, which Nishant already started to raise about risks.

[11:45](https://youtu.be/qyR2AWHwqHs?t=705) And so I want to ask you really, what is the biggest structural risk that you're seeing in terms of the way that governments are adopting AI? If we have time, we can talk about P-HEXS and Anthropic and OpenAI, but let's focus at the moment on the more on the less highly visible things that are happening in states for the most part. What are we seeing in terms of what are we worried about here? Is it vendor lock-in? Is it the risk of AI that you don't even know is there? Is it this policy and governance gap that people are using stuff in ways you don't know, or is that we're not acquiring AI fast enough and therefore people are off using their commercial free version of chat GPT and typing in Social Security numbers? Anyway, what do you what do you see as being the biggest risks in terms of how things are working now? Nishant, let's go back to you.

**Nishant Shah**

[12:48](https://youtu.be/qyR2AWHwqHs?t=768) All of the above, I think, you know, a lot of the risks stem from essentially like an emergent industry selling probabilistic and generative technology with like capabilities that are evolving at an unprecedented rate and continually shifting risk management and security practices with the side of like political and legal risk in the background. So we're sort of at this like Web 1.0 days of AI with all the implications therein. I think the biggest risk, if I just point to one, is vendor lock-in. We know the next few years is going to bring a lot of change in capabilities, yes, but also like the business models themselves, the vendor landscape, the pricing norms, maybe the nature of how we actually work, leveraging agents. And in that world, you can easily get locked in via contracts. But then also the non-contract stuff like non-portable prompts or workflows or memory or agent scaffolding or evaluation methods that only work with one provider and one system with connectors or just internal habits that people build.

[13:59](https://youtu.be/qyR2AWHwqHs?t=839) And so that'll make the switching costs really high, higher than I think almost any type of technology we've seen before. And I see that as a sovereignty issue as well. Like if a government can't easily move its data or port its workflows or evaluate its systems, I think, independently or switch vendors without major pain, I think we're essentially ceding like a measure of operational sovereignty there. Yeah, Kay, over to you.

**Kaye Sklar**

[14:30](https://youtu.be/qyR2AWHwqHs?t=870) Agreed on the issue of workflow dependencies and vendor lock-in, I mean, it is especially worrisome to us given that companies are offering a lot of these technologies at what is likely discounted pricing. So if you're becoming dependent on this technology for your day to day work and all of a sudden your vendor jacks up the price, you're going to be stuck. Stuck. Another risk that hasn't been mentioned so far that we see as being really important. To have front of mind is the importance of knowing your data. So as with leveraging any type of data tool, when it comes to AI, it's garbage in, garbage out. So organizations really need to look closely at their data readiness and organizational data practices and just in general understand what is going on with their data. So of course this is important and relevant if you're leveraging your data for training or fine-tuning some models, but it also just matters generally if you're trying to use these AI tools. And that's kind of something that's it's a little bit more basic, but it's extremely important if you're trying to get good results

**Nishant Shah**

[15:42](https://youtu.be/qyR2AWHwqHs?t=942) from your technology tools. If I could add one more thing there, Beth, or do we? Yes, no, no, no, no. I was going to ask you a follow-up on this. So follow it up yourself and then I'll follow up the follow-up. Two things. One is that like that just as like a note on the cost component, like this is a space where it's really easy to get surprised with a massive bill that you didn't expect because often pricing is based on usage here. And if you're not monitoring that effectively, that can really explode. This is a new way of purchasing software often for folks, like the compute or on a token basis. So it's like more like OpEx than it is, sort of other approaches. And so you need sort of the processes in place in your budgeting teams and your procurement workflows and then tracking and monitoring. So that's like a whole capability to stand up. And then beyond that, I don't know, Beth, if you like your follow-up is going to be on like sort of the operating model within which all of this sits. This is the decentralization question. Yes. Okay. Yes. I, because I want to, I think it's worth saying out loud because a lot of people here are in jurisdictions where they don't control the IT spend or build. They've got 50 CIOs, one in every agency. In some cases it's totally centralized. So how does that for both of you, like how does this look different that, and if this is what we're talking about in terms of operating model within the jurisdiction, how did it look for you? In Maryland, we are a highly distributed environment, quite decentralized with a number of centralized functions. So TLDR, it's complicated. In that sort of environment, I think the benefits are that you preserve more, I think experimentation and let's call it like local fit. But there's also a lot of fragmentation.

[17:47](https://youtu.be/qyR2AWHwqHs?t=1067) So duplicative buying and inconsistent controls and incompatible workflows and more shadow IT probably because of that. And here, what we saw is like the service model becomes a really germane issue. Like if you are a federated shop, you often need to offer different service levels to different agencies with like different types of support. And that can get complicated and heavy to manage with scarce resources. And if that's not done well, this sort of like second order effect is that it can create an incentive for agency customers to find your ways around that process, because they have to move quick. They have customers and constituents they're trying to solve things for, and you have this process and that process is taking a while to do because you have 50 different agencies. On the AI side, that will become more complicated. And what does a good like AI centralized services provision operating model look like is sort of something that's being iterated on the sort of like enterprises across the country.

**Kaye Sklar**

[18:54](https://youtu.be/qyR2AWHwqHs?t=1134) I would add that. So we see a lot of centralized purchasing of licenses, which makes it more important than ever that you have good communication across the government around what it is you're buying, how you're going to be using it, how you're doing that contract implementation. Because right now, people just are not quite talking to each other as much as they could or should be to get the best results from these products and also to think through how to use them safely and procure them safely. So Zoe's question in the chat and which I'm seeing and Zoe Durbin from Massachusetts is asking a question, which is a good segue into sort of both this and where I want to take this. So she's asking the question essentially about the switching costs and the difficulty of getting people to switch vendors, how slow it is to procure, to create a new procurement contract, how difficult that switching can be. So I want to ask you about this by way of sort of pushing us towards the next topic, which is like, where does government still have leverage?

[20:08](https://youtu.be/qyR2AWHwqHs?t=1208) And is it using procurement? Is it in some other way? Is it through the procurement terms that they're writing now? Is it through a more agile approach to procurement? There's a lot to unpack here. So I want to both ask you about sort of whether we think that switching is still as difficult in the AI world as it has been in the digital world, or do we have any new forms of leverage now that we need to be taking advantage of? I can dive in first on this one, maybe. So yes, vendor lock-in is a significant challenge, and there's a lot we could talk about here. But to kind of get us going in terms of the leverage question, first, to have any sort of leverage, you really need to start with organizational capacity. So our big advice at OCP is to use enterprise licenses as a foundation, not a destination. But in order to do this, you really need to start with organizational capacity. But in order to do this, you really have to have a strong collaborative team that understands the technology, how AI works, as well as procurement. And this is important to be able to just negotiate enterprise license agreements that work for you, but it also matters to be able to use it in a safe and effective way. Otherwise, leverage really depends upon whether you're buying, how much you're buying, and realistically, how much money is at stake. So of course, if you're a large state buying software development services to build something, you're going to have a lot more power than a small city buying an enterprise license. So areas where we think that we can push vendors on are things like independent oversight, ideally, so reviews to validate quality and compliance, and protecting exit rights, so requiring open APIs and full data access, and transition support.

[22:06](https://youtu.be/qyR2AWHwqHs?t=1326) And then we get a lot of questions about enterprise licenses in particular, since we do see people buying a lot of these. And so people ask us, what is the leverage governments have here? And we see the most leverage around things like due diligence items, such as clear service level agreements or SLAs, and transparent cost structures and usage monitoring. So these three pieces might sound a bit smaller, but honestly, they're really important and should not be overlooked. So for example, if you have clear and enforceable service level agreements, when things go wrong or not working as anticipated, and you have those clear uptime defect and response targets with penalties, you'll be in a much stronger position. And I'm happy to speak more about transparency and accountability that I've been talking about. So Nishant, your thoughts?

**Nishant Shah**

[23:02](https://youtu.be/qyR2AWHwqHs?t=1382) Plus one to all of that, I think Kay is really the expert here, and Beth probably knows more than me about this topic as well. But just a few thoughts. I think at a state and local level, there's obviously less direct market power and regulatory power compared to federally. But there's probably a lot that state and local is leaving on the table. So for example, it'd be awesome to have aggregated procurement requirements synced across many states on what makes something interoperable, and what are our set of expectations there around portability, auditability, logging, sort of data rights, model switching options, context and memory, et cetera, et cetera. And I would love to have some sort of clear 50 state standard for providers of what we'd want an interoperable contract and bundle to look like, or maybe it's something driven federally, but either way, a standard that is sort of trusted, that sort of forces commercial players to sort of up their game there, I think also is aggregating demand for specific features more effectively. Like I was a product manager in another life, sort of on the other side of the equation here. And I'll tell you that if you have a lot of customers jointly and loudly asking for a set of features, it's more likely to be prioritized on the roadmap. And I think we just often don't ask in the way that we should or demand at state and local, and we can, it's within our ability. I think another is really sort of like integrating governance policies into procurement processes more effectively, so pushing the mitigations more upstream rather than on individual users. Right now, we often govern by a policy that doesn't work so well at scale. And so we need more programmatic governance and more

[25:08](https://youtu.be/qyR2AWHwqHs?t=1508) upstream in the governance process. And the final thing I'll add here is more effectively leveraging benchmarks and evals in procurement. And even helping sort of craft standard benchmarks or testing approaches that commercial players know that they'll need to meet for different types of use cases and sort of setting off like what in industry they often call like hill climbing competitions sort of amongst the frontier labs on those things. There is some, if I'm not trying, I'll try to find the links, but maybe one of, among us, we can find some of the links to people who are doing that work on suggesting some different kinds of benchmarking other than can this model pass the bar exam or can this model, you know, pass the MCATs, but some benchmarking that is more relevant to people who are doing things like delivering Medicaid and SNAP and writing laws and other such things. So do you, while we're still on this topic of sort of making demands of vendors before we get into talking about alternatives to or sort of large scale commercial alternatives, do you see a future or a prospect or a pathway for a more shared procurement effort? So in other words, is there, and it's been tried around digital before and I don't think we succeeded, do we see a pathway now to saying what happens if 10 states sit down together? What happens if three cities sit down together and start making some more demands or is it everybody making the same kind of noise to signal to vendors that there's just greater demand around transparency and auditability and portability and other things?

**Kaye Sklar**

[26:56](https://youtu.be/qyR2AWHwqHs?t=1616) Personally, I mean, I personally would love to see more states and cities come together. I know that there are some local government folks on here, so I'll give a quick shout out to the GovAI coalition and they're thinking about things like cooperative purchasing and how to leverage their power. So yes, I would love to see more of that myself. I know it can be easier said than done sometimes, but it's a great thing to aim for and I would love to see more collaboration around it. Nishant, is it realistic when you have a governor breathing down your neck saying, we need AI now because we're at risk of being perceived as

**Nishant Shah**

[27:40](https://youtu.be/qyR2AWHwqHs?t=1660) falling behind? Yeah, I think you have to just do everything. Those incentives and those realities are there, but at the same time, I think we are now just getting to the point where procurement shops are really starting to understand where AI and procurement intersect more so than a year or two ago where that was actually a hard thing to say. It's like AI is like everything else, just fit it into our existing processes and for a whole bunch of reasons that we're talking about here and not here, that's not exactly right. So I think we're maybe just getting to the point where you can actually have the right operating model, like a human or two that can rep a state and influence its efforts if they're part of a work group like that. And I imagine there's smaller scale efforts here. Is there just copy-paste contract language that we can take effectively that's agreed upon by everyone that we integrate effectively? Maybe starting there and building. Fantastic. And we'd love again to hear in the chat from folks who are having experiences of cooperative buying or who want to argue and say this is just not realistic in the way things work because surfacing those challenges I think will help us to figure out how to overcome them. Let's talk because we have so many questions coming in. I want to talk for a minute about sort of other kinds of alternatives. And we may have I think many Europeans also here and people who are working on building their own models, smaller models, fine-tuning on top of existing models. What are you seeing that's interesting that sort of helps to push the needle towards more public interest, democratic, publicly controlled uses of AI or other approaches maybe outside that sort of that are not just in the procurement context?

[29:40](https://youtu.be/qyR2AWHwqHs?t=1780) Are you seeing any specific public sector models emerging either outside the U.S. or inside? And what other things might we do to help advance the public interest in the acquisition of AI? And while we're talking, you spoke of GovAI and I hope somebody here can share some resources. I'll share one of theirs which is about Getting More Communities Involved in the Development of AI. Who wants to take it?

**Kaye Sklar**

[30:10](https://youtu.be/qyR2AWHwqHs?t=1810) I can kick us off. So, yes, on the participatory AI resources that you're sharing. But at a big picture level, what we're seeing a lot of interest in is starting from a place of values. Rather than reacting to whatever a vendor might be pitching you, we're encouraging and thinking with our partners around going into procurement with clarity around what your values are, what your policies are, what your outcomes are that you're trying to achieve, and then building or buying based off those values and what's feasible given your capacity. And no matter what you're doing, we advocate to be iterative and fine-tune your approach based on what you're using and learning. In terms of actual more concrete strategies, I would say don't be afraid to ask the market what is possible. Certainly this can happen through just conversations, but you can also consider more formal processes such as some type of bake-off style competition, show-and-tells, creating some type of vendor pool that enables fast pilots, and really trying to open the door to those smaller vendors that haven't traditionally worked with government before. So those are some of the more tangible approaches.

[31:40](https://youtu.be/qyR2AWHwqHs?t=1900) We also do advocate for transparency and participation with the public as well, and there's a lot of interest in that work. Nishant, before you go, just a quick shout-out to remind people to put your questions for the speakers in the Q&A because we'll be

**Nishant Shah**

[31:58](https://youtu.be/qyR2AWHwqHs?t=1918) turning to those momentarily. Nishant, over to you. I don't have a lot to add on to what Kay already noted. I think from more like the types of models and like the architecture component, I think it's probably less about alternatives than sort of just getting to real clarity about what the best approach is for your specific operating model and where you need flexibility and sovereignty on the one hand, and where you need convenience and frontier capability on the other. And that Venn diagram is increasing in size over time, and sort of continually updating that clarity as new approaches emerge. I think one rich area which the private sector has been better than us sort of in moving faster on is sort of open weight and open source models, I think many of which increasingly offer viable performance for like narrow use cases that are a parody of what frontier models can provide. Of course, leveraging those models also assumes a level of sort of technical and governance sophistication, so there is a sort of like you have to get kind of your house in order, and it makes security shops really nervous, and so you'll have to go through that set of things. But a lot of enterprises have figured this out, so there's no reason that governments also can't. Beth, you also mentioned like smaller models, like these are ones that essentially can run more cheaply and more locally, excuse me, and sometimes like on your device itself. So for a lot of like more operational use cases, you don't necessarily need the largest, most expensive model, which could be an order of magnitude higher cost than these smaller ones. You need one that's just essentially like good enough, and that you can govern well, and that's cost effective. So like generally, I think, you know, we're moving towards a world where you'll use multiple models with like logic

[34:00](https://youtu.be/qyR2AWHwqHs?t=2040) that helps you pick the right one to use, probably programmatically in the course of your work. How do you see this changing over time? So there's been this first wave of banning AI, then the panic to give access to AI, the race to buy something, and then we're having the kind of everything has its AI add-on. So you have your coffee maker, and now suddenly it has AI in it, and your whatever email program, and this and that. So give us the picture like where we're going with all of this. So in terms of these, you know, as we're thinking about procurement, as we're thinking about making demands on vendors, as we're thinking about alternative tools, where do you see the future going, both in terms of how AI is coming in, but also where do we need to focus our attention? Because soon everything will have AI in it. So is it really on these foundation models where we have to focus? Is it on these add-on layers, the kind of AI plus?

[35:07](https://youtu.be/qyR2AWHwqHs?t=2107) Or where do you see really where we need to be focusing our attention? So let me start there. Happy to take a shot at it first. I think this goes back to sort of like first principles of like, what is an AI-shaped problem? And do you have the ability like in your shop to start from the problem and work backwards for what the best tool is for that set of things? It's like good product thinking integrated into your problem-solving frameworks, and then how do you think about your problem-solving frameworks in a state or government or wherever you are? I think if you start from there, like the rest of it, whether it's like an add-on or there's like all of these different components, like will sort of come more clearly into view. This sounds like an easy thing, but actually building this operating model is like really tough. And like the challenge I think for governments today, I think like this, there's this build versus buy question that's inherent in that, which is like, will probably become one of the defining questions I think over the next few years.

[36:27](https://youtu.be/qyR2AWHwqHs?t=2187) And like the only answer really that to give there is that the calculus is probably going to change pretty significantly and how much it'll change is sort of unclear. And I don't know, Beth, if it's useful to talk about this build versus buy thing more right now, happy to go more into it, but also want to give Kay a chance though. Yeah, we'll give Kay a chance. And then I want to just come back to you or ask both of you, what part of the stack is government going to build, if any? What part is it going to buy or what part should it build or buy if it has to focus on building some piece of things? Kay, over to you first and then back to Nishant and let's take some questions.

**Kaye Sklar**

[37:03](https://youtu.be/qyR2AWHwqHs?t=2223) Yeah. So returning back to your question of like looking ahead into the future, what does it look like? I can say what I hope it looks like. I hope that it looks like we get to a point where we treat AI like a tool and a technology that like any other tool or technology that has strengths and weaknesses. And I think right now I still see people trying to say like, AI for everything, AI will solve everything. And I am increasingly hopeful that we're moving to a point where we say like, AI is good at some things, it's less good at others. Let's think about where it really makes sense and where it makes less sense for us as we, yeah, so move to a more like strategic sense and kind of like some of the hype dies down and we can have some more grounded conversation. So that's what I hope for the future. And then in terms of what to pay attention to, I would say no matter what you're trying to, like no matter what you're trying to do, the government should be owning your strategy and oversight. So right now it feels like sometimes we're in such a rush that people want to outsource the overall strategy and oversight for some of these products. And yes, like you can, to a certain degree, you can outsource some of the oversight, but the government should really own what it looks like. And the government really should be paying attention to if it has the capacity to do that and be really thoughtful about what they need there. And that's, so as far as what to pay attention to moving forward, I would be really thoughtful about that side of things.

[39:00](https://youtu.be/qyR2AWHwqHs?t=2340) Nishant, let me give you the last word on that and then we will start to dig into some of these questions in the Q&A.

**Nishant Shah**

[39:07](https://youtu.be/qyR2AWHwqHs?t=2347) If you don't mind, I'll go to the buy versus build thing, because I think it's an important point to- Yeah, sure. I think that like historically, agencies often bought these like, bought customized solutions or like brought in contractors because like custom software was slow and expensive to build and to maintain and to secure. I think AI could potentially change that, not everywhere, but at least in some places and probably more over time. And what I mean there is that like existing enterprise tools are becoming more capable and configurable. And in parallel, and in parallel, you have these like AI coding tools like Cloud Code and OpenAI Codex and Replicator and others that make it dramatically easier to prototype tools and lightweight applications and sort of increasingly more complicated ones as well. And that'll likely lead to lots of slop in the short term. And then we'll get much better at knowing how to leverage them for like production applications in the medium term. And I think that implies that like some things that agencies used to buy as standalone products might be assembled like internally using a combination of enterprise AI and cloud services and agentic coding and internal developers. And I'm not an enterprise architect, so take this with a grain of salt, but to get ready for that, I think that like investing in strengthening your enabling layers is something that like everyone should probably be doing right now, which is like secure infrastructure and sandbox environments, identity access and like audit controls, AI evaluation tooling, orchestration capabilities, governance and moderning capabilities. And if you can build that stack effectively and like an AI ML up sort of practice with the right folks who sort of understand sort of culturally that space and how to build and ship and execute in it, you can probably do a lot of things in house that you used to have to buy very expensively externally.

[41:17](https://youtu.be/qyR2AWHwqHs?t=2477) Okay, we have a ton of questions that have come in, lots of discussion happening in the chat. I'm going to ask you one of them unless you've seen in the Q&A one that you particularly want to latch on to an answer first, in which case I'll defer to both of you. Otherwise, I'm going to ask you one of them, give you a chance to play catch up on reading everything.

**Kaye Sklar**

[41:38](https://youtu.be/qyR2AWHwqHs?t=2498) Yeah, I haven't read everything, but I will say I liked Simone or Simone's point about how the build first buy debate can feel like a false dichotomy because it's like a little mix of both, like often governments when they're building are buying software development services, and that's mushed up with where they're going to have to use these enterprise licenses. Anyways, it is a little bit of a mush, but there's a question that Simone has at the end, which is around, have you seen procurement or operating models work well with a more module hybrid reality? I would say my organization believes strongly in modular procurement and advocating for that and thinking through it, as well as it being a modular procurement being a very good strategy to think about how to fight vendor lock-in. And we do work with partners on this. It is easier, again, I said this phrase earlier, easier said than done. To do modular contracting well, it does require an unprecedented level of collaboration and conversation between technology and procurement staff, as well as whatever department or buying agency is trying to use the technology. So it's doable, but I think in our prep call, we agreed that sometimes the technology is the harder side of things and the communication and collaboration can be the trickier, stickier point. So that's what I would add in there.

[43:16](https://youtu.be/qyR2AWHwqHs?t=2596) Dishan, anything you've seen there on sort of really good, more agile, more modular approaches or things that open up the vendor space in interesting ways?

**Nishant Shah**

[43:30](https://youtu.be/qyR2AWHwqHs?t=2610) I'm not sure I would have anything to add, what Kay already like effectively noted there. I'm also sort of looking at these other questions on here and there's some... Sure, grab another one, tell us the question you're answering and then answer it. As I warned you, we have a lot of expertise in the room. They're very smart questions. Shall I ask you one? Yeah, why don't you pick one, Beth, then? Well, since Maryland is shouted out in particular, I'm going to start with this last one here, which is to ask you to share a little bit more about sort of how you did your contracting in Maryland. I think it's not so much a factual question as I want to push it a little bit sort of towards how you worked in this decentralized environment, I think is what it's getting to, is this question of what is the delegated authority within agencies to buy for themselves? Is that a good thing? Is that, I mean, this is now that you're not in the role, how would you like to see it work? How does it actually work? And are there better governance mechanisms? Like if you do have decentralized purchasing authority, are there governance mechanisms that you've seen for bringing agencies around the table for education across agencies that have worked better? And is it for pure...

[45:00](https://youtu.be/qyR2AWHwqHs?t=2700) How do we think about managing in a decentralized environment? And, um, so we've been working with a number of different, um, agencies. Interestingly, on the AI front, um, because of a piece of legislation, SB 818, um, it was actually required to have a centralized intake process for any AI use case in the state. Um, and so essentially, um, we had to stand up a process that integrated, um, some form of labeling for a given use case, and then based on the risk level, whether it's like low, medium, high, to do a set of like additional impact assessments and mitigation work.

[46:07](https://youtu.be/qyR2AWHwqHs?t=2767) And sort of that was where governance initially sort of lived. And then that would either go to a formal procurement, or we would look to see if there's existing contracts we could leverage or, um, partnerships like internally, or can we build it using tools that we already had? Um, that, like, I think is a good approach to start with, because it allows us to get a sense of what's happening across the state, where the weaknesses, where the strengths are. It allows us to figure out like who needs help, and then to stand up office hours and advisory groups to specific folks and build workshops to see like, okay, everyone is asking these five questions. So we should probably be, you know, developing some collateral and information that actively in an FAQ or in some other mechanism, we have a community of practice, bringing together a lot of folks leveraging AI across the state, where we sort of speak to that.

[47:07](https://youtu.be/qyR2AWHwqHs?t=2827) There was also AI that had already been deployed prior to like this law existing. And then sort of that which happened afterwards. And so we built this AI inventory, which captured all use cases across the state. And that was really tough to do. And it took like a year to get going, because you have to align on what are definitions of AI and, you know, what is high risk and what should go in there versus what shouldn't and how do you like most effectively, like take our transparency principle and abide by its spirit. And you know, that will continue to get better and better over time. But it is really the foundation for governance in the state, because now we can, if we have a centralized set of all of our use cases, we can do a set of like continuous monitoring over time. And we can start understanding, you know, like is what types of monitoring tools do we need to get for a specific type of use cases.

[48:15](https://youtu.be/qyR2AWHwqHs?t=2895) So that's kind of where we are. When I had left the state, we had the centralized intake process. We had office hours and advisory and sort of different communication and consulting mechanisms with groups that were coming in to show, okay, what should the next set of steps be? We were working on a set of essentially like more fit for purpose procurement vehicles as well. So like a proof of concept procurement pathway that allows us to go from POC to a scaled solution more effectively. And in parallel, we're seeing what we already had and seeing where a lot of the asks were and building these things called like governance cards, which would look at the use cases that were always asked. So like coding assistance, transcription tools, translation services, a number of others, and then building the do's and don'ts and best practices and approved tools and sort of approved software list, working backwards from those for common use cases.

[49:16](https://youtu.be/qyR2AWHwqHs?t=2956) I've been talking a lot. So I'll pause there. Olga, we have a lot of great conversation and questions coming in. Katrina has been helpful to answer some of them in the Q&A, but I want to surface one that she answered, but we can do it out loud because I think it would be helpful for people. This gets back to the topic we were discussing before about unexpected vulnerabilities that come from software that's integrating AI. We have sort of two different questions about this, about this sort of world of the AI add-ons essentially. And I'm wondering if you're feeling, I'm just trying to find the second question here, whether you're seeing anything else there in terms of specific vulnerabilities and specific protections there and whether it's sort of issues around terms of service in the context of existing software that then brings in AI.

[50:16](https://youtu.be/qyR2AWHwqHs?t=3016) So we have two questions about AI tooling in the context of software as a subscription service and then another one about sort of those AI add-ons. So anything we haven't covered on that?

**Kaye Sklar**

[50:28](https://youtu.be/qyR2AWHwqHs?t=3028) Maybe I would say at the high, I don't want to see exactly what my colleague Katrin said, so I'm not sure if I'm repeating what she replied. But at the highest level, a link in the chat, which I will add, at the highest level, I would say that this is why having a strong governance strategy matters from the outset. Sometimes we see issues around all of these, like the great challenges around like transparency or data security, like come up during procurement or happen after the fact, like you said, like maybe you've already bought something. But for us, it's like a reminder that these issues should be thought about long before the procurement process ever takes place. There should be, in a perfect world, and I know that not everyone is operating in that perfect world too, but in a perfect world, there's a broad organizational strategy that helps people think this stuff through, because it shouldn't be left up to procurement to decide a lot of these things.

[51:38](https://youtu.be/qyR2AWHwqHs?t=3098) Like they can help think these things through, but this should be like a whole government effort and not something that's like left to procurement to figure out, but that there should be these conversations and strategies should be happening from the top. Nishant, let's take one more here. Sean's question about what evidence matters most at source selection, prior performance, sandbox demos, security posture, or measurable outcomes? What evidence is the most important? You're on me.

**Nishant Shah**

[52:13](https://youtu.be/qyR2AWHwqHs?t=3133) All of those things, like you, I don't think it's like necessarily super different from evaluating like other software, like is it doing what you want? Are there a set of metrics that you can measure to see like, does it move the needle on those things or not? Does it abide by your governance practices, encompassing security and privacy and all these other things? Which can often be gotten by like risk assessments or like vendor fact sheets. Are there like risks around like what they've trained on that you believe will become like a legal issue in time that you agree or disagree with in terms of like leveraging that model? What is its pricing sort of over time? There's sets of questions around interoperability, which are like often, you know, I don't know like often super sort of crucial to add at the front, you know, like can we export agent logic in some like a useful form?

[53:16](https://youtu.be/qyR2AWHwqHs?t=3196) Can we export memory or like context stores or like embeddings in some documented format? Like there's like a set of things that you would, you know, want to see if they're able to do. And then, and this is not something that we actually got to doing effectively in Maryland, but it was sort of like the next thing. And maybe there's someone from Maryland here who knows if we're like doing this now or not. But like, you know, the way you do this like elsewhere is sort of really around like evals, like building use case specific test sets that continuously measure like edge cases and can create like a dashboard of like how effective a given solution is at like actually getting the outputs you want, given the set of inputs. And like building those evals is a skill by itself, but like leveraging those is probably the best method to see if like all vendors tool is really doing what you want. And that'll help you get past the snake oil part. Like a lot of folks have gotten really good at creating like really slick decks and creating demos.

[54:21](https://youtu.be/qyR2AWHwqHs?t=3261) But like where the rubber meets the road is like building an eval that will show you. I know we have a lot of questions for those we didn't get to, for those that remain outstanding. We have five more of these excellent conversations coming up. We will put a link to the rest of the series in the chat and how to sign up. If you're signed up for this, you're signed up for the rest. But I want to encourage you to come back and join us next week for that conversation and come and bring your questions for that. But let me close this out by asking both of you, you have advised ministers and governors and the like. So if tomorrow you're advising a new minister, a governor, a mayor, what's the one decision they need to get right in the next year? What's the one procurement decisions, to focus us, that they need to get right to avoid vendor lock-in, unaccountable tech, or is it a bill decision?

[55:22](https://youtu.be/qyR2AWHwqHs?t=3322) What's the one, give us the one piece of advice that's most important for the coming year. Nishant, let me start with you and I'll end with Kay. I'd say, like, actually focus on embedding governance and a focus on interoperability into the procurement process. Like, there are ways to do that well, like, we need to get much better at it, but there are things that you can do. And a lot of us are not doing them. And so, like, that's, I think, a low-hanging fruit thing to start with.

**Kaye Sklar**

[55:54](https://youtu.be/qyR2AWHwqHs?t=3354) I love that. And then I would add on, I would ask that the governor or mayor enable procurement to really pursue agile and innovative procurement practices, because sometimes, like, the procurement folks have their hands tied by various policies. So even if they want to pursue agile and innovative procurement practices, there's a lot of barriers that prevent them from doing so. So from leadership, from leadership's perspective, if they can make that enabling environment possible, that would be great. Fantastic. And I'll end on a final plug, which is maybe ironically, AI can help us make those procurements more faster and more agile. And working with partners for public good, we use AI to do that. We are releasing a new course on procuring with AI coming up soon, as distinct from procuring AI, but how to use AI to help you make those procurements more effective, more competitive, and more agile.

[56:57](https://youtu.be/qyR2AWHwqHs?t=3417) We will see you next week. Thank you, everybody, for your fabulous questions and conversation. Thank you to Nishant and Kay. And next time, pets only. Thank you, everybody. Bye-bye.

* * *

Original page: https://innovate-us.org/how-governments-are-buying-ai-now-opportunities-risks-and-leverage · Licence: CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/), as stated on innovate-us.org