Pillar of the week
The clearest signal this week for anyone running an AI governance programme: review your AI systems' compliance posture now. The US General Services Administration has opened a request for comment on draft LLM data-safeguarding requirements for federal contracts — a sign that large-language-model controls are moving from guidance into procurement conditions. If you sell to, or through, US federal channels, the safeguards you can evidence today are about to become contract terms.
Alongside it, NIST published a mathematical proof that continuous monitoring outperforms static, point-in-time AI security models — formal backing for shifting validation away from periodic audits toward real-time drift detection. Read together, the two set the direction: compliance is becoming continuous, and it's becoming contractual.
Read the GSA notice and submit comments →
Three to watch
- GSA data-safeguarding requirements for federal AI contracts — GSA seeks feedback on draft LLM data-safeguarding requirements for federal contracts; review your compliance posture and submit comments before the deadline. Source: federalregister.gov
- NIST proof backs continuous-monitor security for AI — NIST proves continuous monitoring outperforms static AI security models; shift validation from periodic audits to real-time drift detection. Source: nist.gov
- NIST Quantum Manufacturing Engineering Center — NIST establishes a Quantum Manufacturing Engineering Center with SRI International; review quantum supply-chain risks and update vendor-assessment protocols. Source: nist.gov
- NRC modernizes security requirements — The NRC revises security and fitness-for-duty rules to reduce burden while maintaining safety assurance; update your compliance protocols accordingly. Source: federalregister.gov
Sample of the week
This week's sample is the AI Vendor Assessment — a structured due-diligence workbook for evaluating third-party AI and LLM suppliers against your governance requirements. With GSA moving data-safeguarding into contract terms and NIST flagging quantum supply-chain exposure, a repeatable vendor assessment is exactly the artefact those questionnaires will ask you to produce.
Practitioner takeaway
Two of this week's four items point the same way: the controls you assert are being replaced by the controls you can continuously evidence. GSA is drafting them into procurement, NIST is proving the case for real-time monitoring, and the NRC is trimming static requirements in favour of risk-based assurance. If your programme still relies on annual audits and one-off vendor sign-offs, the cheapest move now is to close the gap between what your policy says and what your systems actually do.
This week's starting point
If you need to see that gap clearly, start with the AI Governance Gap Analyser → — it maps your current controls against the frameworks and obligations you're in scope for, and shows where continuous-monitoring and vendor-assessment evidence is missing.