Commercial AI tools are already on most desks. The risk isn't the tool. It's what gets typed into it. Every input is a disclosure decision, and it's made before you open the session, not after.
State, county, or local buyer? Read the state and local edition, which replaces the federal rules with public-records guidance.
Before you open a tool
Use only the tools your organization has approved, under its written AI policy. If there's no policy or approved list, ask before you type anything that isn't public.
Sort every input into one of three tiers
| Tier | What to do | Examples |
|---|---|---|
| SAFE | May go into an approved tool. | Information that is already lawfully public: a posted solicitation, published regulations and policy, vendors’ public websites and capability statements. Inputting it discloses nothing new. |
| CAUTION | Remove the identifying or sensitive specifics, then use only an approved tool. | Internal drafts and notes that contain names, prices not yet public, or parties’ positions. |
| NEVER | Stays out of every AI tool unless your agency has authorized that tool, in writing, for that kind of information. | Classified information. Controlled unclassified information (CUI). Source selection information and contractor bid or proposal information (protected under FAR 3.104). Vendor proprietary or trade-secret material. Personal information (PII). |
State and local buyers: your procurement code and public records law set the equivalents of these federal rules, and a prompt you type may itself be a public record. The state and local edition covers this in full.
How to anonymize a CAUTION input
One prohibited practice, whatever the tier
A vendor document can carry instructions hidden in white text, alt text, or metadata that change what an AI tool tells you about it. You can’t see them, and the tool may follow them. And you can’t audit that after the fact. So a vendor-submitted document never goes into any AI tool, including an enterprise tool your agency has approved, for any purpose, even anonymized. The workaround is to use AI earlier: build your evaluation criteria and their rationale before proposals arrive, then evaluate the proposals yourself.
Write it down
For any AI-assisted work that touches an action, record which tool you used, what went in, and what you kept or changed. The file has to stand on its own if someone reviews it later.
This primer is a working guide, not legal advice. Your organization’s AI policy, your procurement rules, and your counsel govern.
Keep going
Free. Enter your email and we'll send the one-page PDF. Newsletter sign-up is optional.
Where AI can help assemble procurement work, and where judgment stays with you.
Commercial GenAI for Public Sector Procurement
Five self-paced modules for federal, state, and local procurement professionals. Each module is $395 and ends with a certificate of completion.
Module 1: Using GenAI Safely in Government Procurement. Available now.
Covers data classification, anonymization, and documentation in depth.
Module 2: Regulatory Compliance Across Government Levels. Available now.
Federal acquisition under the Revolutionary FAR Overhaul, state procurement codes, local requirements, ethics, public records, and records management.
Module 3: Prompt Engineering for Government Procurement. Available now.
Prompt fundamentals, procurement-specific prompt patterns, and evaluating and improving outputs.