On 1 May 2026, the Department of Defense announced agreements with eight AI companies (OpenAI, Google, NVIDIA, SpaceX, Microsoft, Amazon Web Services, Oracle, and Reflection) to deploy their AI on classified networks at Impact Level 6 and Impact Level 7. Those are the tiers for secret and top secret work. This wasn't a pilot announcement or an R&D contract. It was a decision to put AI to operational use, although DoD didn't say when the models would be available (DefenseScoop).
At the same time, DoD said more than 1.3 million personnel had used GenAI.mil, its unclassified AI platform launched in December 2025. In about five months, they generated tens of millions of prompts and deployed hundreds of thousands of AI agents.
Let that sit for a moment. The customer you're serving, the government program office on the other side of your contract, is using AI at scale right now. The question for defense contractors isn't "is AI relevant to my business?" It's "am I using it responsibly enough to keep up, and to protect myself when something goes wrong?"
What Just Happened: The War Department's AI Deployment
IL6 and IL7 are DoD's classification tiers for handling sensitive and classified information in cloud and network environments. Getting approval to deploy AI at those levels is a significant policy and security milestone. It means the government intends to let these platforms process information that previously couldn't touch a commercial AI tool at all.
The eight companies that signed agreements in May 2026 aren't just selling licenses. The agreements are meant to bring their AI into networks where real operational decisions get made. This isn't a research project. It's the beginning of AI becoming infrastructure inside the defense enterprise.
What IL6/IL7 means in plain English: IL6 covers classified information up to SECRET. IL7 covers information above SECRET, including Top Secret/SCI workloads. For years, these environments were AI-free zones because commercial platforms couldn't meet the security requirements. That's now changing, and changing fast.
On the unclassified side, the GenAI.mil numbers tell you exactly how fast adoption has moved. More than 1.3 million users. Tens of millions of prompts. Hundreds of thousands of agents, all in about five months. The DoD workforce isn't waiting for permission to use AI. They're already using it, at scale, to speed up their work.
If you're a contractor PM or BD professional and you haven't internalized what that means for your program office relationships, your proposals, and your performance expectations, this post is for you.
What This Means on the Contractor Side
Expect AI questions in solicitations
Expect the procurement shift to show up in solicitations. DoD's January 2026 AI strategy promised new criteria for future AI model acquisitions, and Covington's summary says contractors should expect contract language permitting "any lawful use" of AI systems. Evaluators are likely to ask not just if you use AI, but how you use it, what governance you have in place, and whether your AI use fits DoD data policies.
The FY2026 NDAA, signed 18 Dec 2025, added AI rules of its own. Section 1513 requires a framework of cybersecurity and physical security standards for AI and machine learning, with DFARS changes to follow, and Section 1533 sets up a team to build a standard way to evaluate, buy and oversee AI models. DoD's January 2026 AI strategy memos also revived the "DoD Data Decrees" on sharing data. If you're proposing on a program with an AI component and your technical approach doesn't address cybersecurity, data governance, and a modular open systems approach (MOSA), you're leaving evaluation points on the table.
Assume your competition is already using AI for proposals. The question isn't whether they are. It's whether they're doing it in a way that creates bid risk or reduces it. The contractors who figure out the responsible use framework early are the ones who will be able to point to it in their proposals as a differentiator.
ITAR exposure is real and underappreciated
This is the one that I see contractors dismiss too quickly, and it worries me.
ITAR (the International Traffic in Arms Regulations) controls the export of defense-related technical data. When you run technical data through a commercial AI tool that routes queries to servers outside your controlled environment, you may be creating an export control exposure. It doesn't matter if you're just "summarizing a document" or "writing a draft." If that document contains ITAR-controlled technical data, and that data passes through a system you don't control, you have a potential problem.
That's why "no source, no claim" is a good rule for any serious GovCon shop. If you can't trace where the AI output came from (what data it ingested, what it may have retained), you can't certify compliance. And in a regulated environment like defense contracting, you have to be able to certify compliance.
The practical test: Before using any AI tool on a work product, ask: Does this document contain ITAR-controlled technical data? If yes, it should not pass through any AI tool that isn't running in a government-approved, ITAR-compliant environment. The risk isn't theoretical. It's an enforcement reality. Willful ITAR violations carry criminal penalties of up to $1 million and 20 years in prison (22 U.S.C. 2778).
ITAR-compliant AI exists, but it's not every tool your team uses day-to-day. Until you've done the work to identify which tools are approved for which data classifications, the safest default is conservative use: drafts only, uncontrolled information only, human verification before anything goes anywhere.
Where AI Actually Helps Contractor PMs Right Now
Let's get specific. Not "AI can help with efficiency". That's not useful to anyone. Here's where AI is actually working in contractor program management today, broken down by phase.
Find Phase: Market Research Compression
The market research process (tracking SAM.gov, synthesizing opportunity data, qualifying leads, building out the competitive picture) is one of the most time-consuming parts of the BD function. It's also one of the safest places to use AI, because most market research involves publicly available, uncontrolled information.
What's working: AI tools that can summarize SAM.gov opportunity language, extract evaluation criteria from lengthy solicitations, and flag past performance patterns across USASpending.gov data. Opportunity qualification (deciding which RFPs to chase and which to pass) can be compressed significantly when you're not reading every solicitation word by word.
For example (hypothetical): a BD team that spends about a week on market research for a new pursuit might get a first pass done in a day or two with AI help, then spend its time checking sources and deciding. The key is that a human still makes the go/no-go call. AI qualifies. Humans decide.
Win Phase: Proposals
This is the highest-value use case and the highest-risk one. Here's what actually works:
- First drafts of proposal sections: AI can generate compliant first drafts against Section L/M criteria faster than any human writer. The output needs significant human editing, but starting from a structured draft is faster than starting from a blank page.
- Compliance matrices: Parsing an RFP and building the compliance matrix is tedious, mechanical work. AI handles it well. A human still has to verify every line, but the AI-generated matrix saves hours.
- BOE narratives: Basis of Estimate narratives follow predictable structures. AI can generate the framework; your technical team fills in the actuals. Again: AI drafts, humans verify, humans sign.
What doesn't work, or more precisely, what creates unacceptable risk: letting AI write a proposal section and submitting it without detailed human review. AI hallucinations in proposals are real. I've seen it happen. The AI will generate authoritative-sounding text that cites regulations that don't exist, references contract vehicles that don't apply, or makes technical claims your team hasn't validated. If that gets into a submitted proposal, you find out at debriefs.
Deliver Phase: Program Execution
This is where the time savings are most measurable and the risk is lowest. Program execution documentation (status reports, meeting notes, CDRL packages) is highly structured and often unclassified. Plenty of it is Controlled Unclassified Information, though (the category that replaced FOUO markings in 2020), so check each document's marking before it goes near an AI tool.
What's working:
- Status reporting: AI can draft weekly status reports from structured inputs (schedule data, milestone log, issue tracker). The PM reviews and certifies. Consistent format, faster turnaround.
- Meeting synthesis: Summarizing action items, decisions, and issues from meeting notes or transcripts. Strong use case. Human reviews before anything goes to the government customer.
- CDRL documentation: AI can produce first drafts of deliverable packages. For example (hypothetical): if a monthly CDRL package takes about 40 hours to draft, an AI first draft might trim the drafting time, but the review time doesn't shrink. On a cost-reimbursable contract, any savings show up for the customer too.
The qualifier that applies to all of this: any document that goes to the customer (any CDRL, any report, any deliverable) has a human name on it. That human is accountable. AI can draft. Only humans can sign.
The Governance Rule That Protects You
"AI drafts, humans verify, humans sign."
That's it. That's the governance principle that separates contractors who are using AI responsibly from the ones who are creating liability. Let me explain why each word matters.
AI drafts: You're using AI for generation, not for decision-making or certification. The AI produces a starting point, not a final product. This preserves the human's role as the expert and the accountable party.
Humans verify: A qualified human (your technical lead, your PM, your contracts specialist) reviews the AI output against the actual contract requirements, the actual data, and their own professional judgment. This is where hallucinations get caught. This is where compliance gets confirmed.
Humans sign: Any deliverable that carries your company's name and goes to the government customer has a human signature. Not "AI-assisted by." Not "generated with AI tools." A human's name, and that human stands behind the content.
This matters for three specific reasons in GovCon:
CPARS. Your Contractor Performance Assessment Report ratings reflect your performance on the contract: accuracy of deliverables, responsiveness, quality of work. If an AI-generated report contains inaccurate information and the government discovers it, that goes in your CPARS. Source selection teams use CPARS ratings for three years after the work ends (six for construction and architect-engineer work, per FAR 42.1503), so an Unsatisfactory rating can sink you in recompetes. No AI tool is worth that.
Protests. If a competitor protests your contract award and your proposal contained AI-generated content that misrepresented your technical approach, even unintentionally, you're exposed. Proposal integrity isn't just an ethical standard; it's a legal one.
Customer trust. Defense contracts are long-term relationships. The program office you're working with has a mission. They need to trust that your deliverables are accurate. The moment they catch something wrong that came from an AI that wasn't verified, you've damaged a relationship that may have taken years to build.
The trap is the opposite of this principle: AI writes, humans rubber-stamp. This happens when a team under deadline pressure lets AI generate a deliverable, does a quick read, and sends it. The human is "reviewing," but they're not actually verifying. They're blessing output they haven't validated. This is exactly how AI hallucinations end up in government deliverables. And in GovCon, the human who signed it owns the consequence.
Get the Acqlerate Acquisition Starter Kit (Free)
Key terms, ACAT levels, career roadmaps, and the 5 most common acquisition mistakes. Tailored to your role: USG, contractor, or career changer.
Where to Start If You're Not There Yet
If your company is early in AI adoption, or if AI is being used but without clear governance, here's the sequence that makes sense for most contractor shops:
- Inventory what tools your team is actually using. You might be surprised. Individual contributors often adopt AI tools informally before any company policy exists. Know what's in use before you set policy around it.
- Classify your data. What's uncontrolled and publicly available? What's CUI? What's ITAR? What's classified? Different data categories need different tool policies. You can't build an AI governance framework if you haven't classified your information.
- Write a one-page AI use policy. Not a 40-page document nobody reads, a one-pager that says: what tools are approved, for what data classifications, with what review requirements. Post it, communicate it, enforce it.
- Build the "AI drafts, humans verify, humans sign" discipline into your workflows. This means reviewer checklists for AI-generated content, clear sign-off requirements for any customer-facing deliverable, and training for your team on what AI hallucinations look like.
- Start tracking it. Which tasks are you using AI for? What's the time savings? What errors are you catching in review? You need this data because "AI maturity" is becoming an evaluation factor, and you'll need to be able to talk about your program credibly in an oral presentation or technical volume.
I'm not anti-AI. I use it. Acqlerate uses it. The practitioners I respect most in this industry use it. But I've watched people submit proposals with AI hallucinations in them and not realize it until debriefs. I've seen CDRL packages where the AI summarized the wrong contract requirements because nobody verified against the PWS. The tool is only as good as the human checking it. In GovCon, that human has a name on the cover letter. That name is accountable to the program office, to the contracting officer, and to the customer mission. No AI tool changes that, and you shouldn't want it to.
The Bottom Line
The DoD has crossed a threshold. AI is no longer a future capability or a lab experiment. It's operational, it's headed onto classified networks, and the government workforce is using it at a scale that would have seemed impossible two years ago. The more than 1.7 million people who have used GenAI.mil aren't going back. The eight AI companies signed up for IL6/IL7 networks aren't going away.
For defense contractors, this creates both opportunity and obligation. The opportunity: AI really does compress the most time-intensive work in the Find-Win-Deliver cycle. The obligation: you have to do it right, with proper governance, in compliance with ITAR, in a way that puts a real human behind every deliverable.
The contractors who figure that out (who can tell a credible story about their AI governance, who have the documentation to back it up, and who aren't rubber-stamping AI output) are going to have a real advantage in RFP evaluations and program execution over the next 18 to 24 months.
The ones who don't are going to find out at debriefs. Or worse, at protests.