FedRAMP AI: Which AI Models and Tools Are Authorized in 2026, and When You Need Your Own ATO Instead

What FedRAMP covers, and what it does not

FedRAMP is a scope question before it is a security question. OMB memo M-24-15 sets the program’s scope as cloud computing products and services, such as IaaS, PaaS and SaaS, that create, collect, process, store or maintain federal information on behalf of an agency. If a vendor operates the service and an agency’s data flows into it, FedRAMP applies.

Two consequences follow for AI.

First, FedRAMP authorizes services, not models. Anthropic’s own government page says it plainly: FedRAMP and Impact Level authorizations apply to cloud services, and models are deployed inside authorized environments. So “FedRAMP AI models” is shorthand for “models offered inside a FedRAMP authorized service”. The same model can sit inside an authorized boundary on one platform and outside it on another.

Second, software an agency installs and operates itself is outside the program. FedRAMP’s 2026 change notes describe the purpose of the classes as helping agencies meet their FISMA duties when they use cloud services they do not operate. When the agency operates the servers, nobody is offering it a cloud service. Its own authorizing official grants an authority to operate (ATO) under OMB Circular A-130, using the NIST Risk Management Framework and the SP 800-53 control baseline. OMB’s AI use memo, M-25-21, repeats that agencies must keep following A-130’s ATO requirements for AI systems.

FedRAMP also changed its vocabulary this year. Its Consolidated Rules for 2026, in effect since 4 July 2026, use “FedRAMP Certification” to avoid confusion with an agency ATO, and replace the Low, Moderate and High impact levels with Classes A to D. Existing authorizations keep their status. This guide uses “authorized” because vendors and most agency documents still do.

FedRAMP 20x and the AI prioritization track

FedRAMP 20x is the program’s faster assessment path, built on automated validation and continuous evidence rather than a long document package. According to fedramp.gov, the Low pilot ran from April to September 2025 and the Moderate pilot from November 2025 to March 2026, with the first Moderate pilot authorizations issued on 6 March 2026. Phase 3, wide-scale adoption, is active now. A High class is planned for Phase 4, estimated for the first half of fiscal 2027, and FedRAMP will stop accepting new Rev5 certifications on 11 June 2027.

On 25 August 2025 GSA announced that FedRAMP would put certain AI services at the front of the 20x queue. The criteria on fedramp.gov/ai targeted conversational AI for routine federal work. A service had to:

• offer enterprise features such as single sign-on, automated user provisioning, role-based access control and usage analytics;
• keep customer data separated, including any model information derived from it;
• show demand from at least five CFO Act agencies, or carry a CIO Council recommendation;
• be buyable through the GSA Multiple Award Schedule;
• be able to meet 20x requirements within two months of acceptance.

FedRAMP now describes the track as complete. It began in August 2025, finished in April 2026 and is closed to new entrants. Three services are listed as certified in early 2026: ChatGPT Enterprise and API Platform from OpenAI, Gemini for Government from Google, and Perplexity Enterprise Pro for Government.

Which AI services hold FedRAMP authorizations in October 2026

The table maps each common route to the authorization behind it and the data levels the provider documents. It reflects vendor pages, Microsoft Learn and fedramp.gov as checked on 22 October 2026. Tenant configuration and contract terms still decide what a given agency may do.

Vendor notes behind the table

OpenAI

OpenAI announced FedRAMP 20x Moderate for ChatGPT Enterprise and its API Platform in April 2026. The authorization applies to a separate FedRAMP environment. A commercial ChatGPT Enterprise workspace bought outside that program is not automatically inside it, so ask OpenAI or the reseller to state the boundary in writing.

Anthropic

Anthropic lists several routes with different answers. Claude for Government runs in the Claude desktop app against a dedicated government environment inside Palantir’s FedRAMP High boundary, which is why the Marketplace listing sits under Palantir rather than Anthropic. Anthropic says it is open to federal, state and local agencies and to contractors supporting them; trade press reported general availability on 30 September 2026. The model API reaches FedRAMP High through Bedrock in GovCloud or Vertex AI with Assured Workloads. Claude Enterprise is not FedRAMP authorized; Anthropic is pursuing Moderate through 20x without a confirmed date.

Defense buyers have one more item to check. The Department of War designated Anthropic a supply chain risk in March 2026, and the D.C. Circuit upheld that designation on 25 September 2026. Anthropic states that the designation covers Claude used as a direct part of Department of War contracts and does not apply to civilian agencies, state and local governments or commercial use.

Google

Gemini for Government was one of the three prioritized services. Google’s deployment guide requires agencies to place every Gemini for Government resource inside an Assured Workloads folder configured for FedRAMP High or IL4, and it marks some newer agent features as submitted rather than authorized at IL4. Check the current version of that guide before enabling a feature.

Microsoft

Microsoft runs AI inside government clouds it already operates. Azure OpenAI is in the Azure Government audit scope at FedRAMP High and DoD IL2, IL4 and IL5 with workload isolation, and at IL6 in Azure Government Secret. Microsoft 365 Copilot is available in GCC, GCC High and DoD, keeps prompts and responses in the government tenant, and inherits that tenant’s controls. Features usually arrive later than in commercial Microsoft 365.

xAI and Meta

GSA’s OneGov deal with xAI, announced on 25 September 2025, offers Grok 4 and Grok 4 Fast for 42 cents per agency until March 2027, with an upgrade path to enterprise subscriptions that xAI describes as aligned with FedRAMP and DoD Impact Levels. Meta’s deal, announced on 22 September 2025, is different in kind: Llama is open-weight, so GSA’s work was checking the models against federal requirements, and agencies decide where to run them. Running Llama on agency hardware puts it under the agency ATO, not FedRAMP.

OneGov pricing: the $1 offers and what replaced them

GSA’s OneGov strategy buys software for the government as one customer. In August 2025 it announced ChatGPT Enterprise and Claude for $1 per agency for a year, and Gemini for Government for 47 cents. Those prices were promotional and are winding down.

• OpenAI. On 10 September 2026 GSA announced a 27-month offer starting 1 October 2026: a 50 percent discount on token-based usage across ChatGPT models, including those in FedRAMP environments. Federal agencies in all three branches and state, local and tribal governments can use it.
• Anthropic. Trade press reported that the $1 offer was extended to 31 October 2026.
• Google. Nextgov reported that the Gemini offer was extended to 15 November 2026.

A low or free licence does not change the authorization question. The agency still needs a service inside an authorized boundary for the data it plans to use, and it still owns the configuration.

The OMB AI memos that sit on top of FedRAMP

FedRAMP answers whether a cloud service is secure enough to hold federal data. Three OMB memos govern how agencies use and buy AI.

M-25-21, 3 April 2025, on AI use. Agencies had 60 days to name a Chief AI Officer and must publish an annual AI use case inventory. The memo defines high-impact AI as AI whose output is a principal basis for decisions with legal, material, binding or significant effect on rights, safety or access to services. For those uses, agencies must run pre-deployment testing, complete an AI impact assessment and keep human oversight, and had 365 days to document those practices. Non-compliant high-impact uses must stop.

M-25-22, 3 April 2025, on AI acquisition. It applies to solicitations issued 180 days or more after the memo. Contracts must permanently bar vendors from using non-public agency inputs and outputs to train publicly or commercially available models without explicit consent. Agencies are told to avoid vendor lock-in through knowledge transfer, data and model portability, clear licensing and transparent pricing, and to maximize the use of American-made AI.

M-26-04, 11 December 2025, on unbiased AI principles. It implements Executive Order 14319 by requiring truth-seeking and ideological neutrality terms in contracts for large language models, with agency procurement policies updated by 11 March 2026.

None of these memos is a FedRAMP rule, but all three bite on the same purchase. A FedRAMP authorized chat tool still needs a contract with the M-25-22 data terms, an entry in the use case inventory and, if it supports high-impact decisions, an impact assessment.

FedRAMP AI agents change the boundary question

Agents raise a problem that chat tools mostly avoid. A chat assistant receives what a user pastes into it. An agent reads mailboxes, queries case systems, files tickets or drafts responses, so it holds credentials into agency systems.

The vendor’s authorization covers the vendor’s environment. Every connector the agent uses is an interconnection the agency has to document, and every tool it can call is a permission the agency has to justify. For agents, the practical controls are:

• a named owner and a use case inventory entry for each agent;
• tool grants scoped to one task, with read and write permissions separated;
• human approval before any action that changes a record, sends a message outside the agency or supports a high-impact decision;
• a log of every prompt, retrieved document, tool call and output, retained under the agency’s records schedule;
• a way to switch an agent off without touching the systems it connects to.

These controls apply in the same way whether the agent runs in an authorized cloud or inside the agency’s own data center.

Running AI inside your own ATO boundary

Some workloads fit a cloud authorization badly: classified or near-classified material, law enforcement data, networks with no internet route, or programs where the agency does not want an outside provider holding prompts at all. For those, the alternative is an open-weight model on hardware the agency already operates.

That route does not skip security work. The model servers, vector store, conversation history and logs become components of an existing system, or a new one, and the authorizing official assesses them against the SP 800-53 baseline the system carries. The trade-offs are concrete:

Many agencies will use both: an authorized chat service for everyday drafting, and a private deployment for data that should never leave the agency. The air-gapped deployment guide covers offline model transfer, and the public sector sovereignty article covers the policy case. Contractors handling CUI face different rules, which our CMMC and CUI guide for defense contractors maps tool by tool.

How VDF AI fits a federal authorization boundary

VDF AI takes the second route. It is a self-hosted platform for private assistants, governed agents and retrieval that installs on servers an agency controls, on-premises, in a government cloud tenancy the agency already authorizes, or on an air-gapped network. Models, retrieval indexes, conversation history and audit logs stay on that infrastructure. VDF AI holds no FedRAMP authorization or Impact Level of its own; the agency assesses it as part of its system under its own ATO.

The workflows in this guide map to platform controls. Staff sign in through Microsoft Entra ID single sign-on, with Entra security groups mapped to roles; other identity providers connect through an SSO-aware reverse proxy. Role-based access control assigns permission groups and per-role tool grants, retrieval respects document permissions, and agents can be held at human approval gates before they act. Every prompt, retrieved source, tool call and response is logged and exportable to the agency SIEM. The VDF AI Router registers local model endpoints such as vLLM or Ollama, and air-gap mode keeps every request on those local models.

For the wider public sector picture, see the government and defense solution, the government executive brief and the private AI guide for government. Agencies evaluating it on their own hardware can begin with a three-month platform trial. This guide describes rules and vendor statements as of 22 October 2026 and is not legal advice.