The Federal AI Market Map
The Lede: The Pipes Are Winning
Here is the finding that every BD director at a defense prime, every federal sales lead at a hyperscaler, and every defense-tech VC needs to internalize before their next pipeline review: The four companies that generated the most media coverage of the federal AI market in 2025 — Anthropic, Google, OpenAI, and xAI — collectively received $800 million in ceiling contracts from the Pentagon's Chief Digital and AI Office. Palantir received $10 billion from the Army alone, plus a separate $1.3 billion Maven Smart System contract. The companies your competitors are writing case studies about are selling access vehicles. The company no one in your BD team is positioning against is selling the pipes. The pipes are winning.
"The CDAO awards bought the right to experiment at scale. Palantir bought a program of record. Those are different categories of procurement, and the market has been confusing them for two years."
— Pedro Rubio, GovAI Analysis · April 2026
The CDAO frontier AI awards triggered coverage treating them as evidence that frontier model providers had cracked federal. They had not. Those are Other Transaction Authority agreements with no guaranteed obligations and no FedRAMP authorization requirements in the base period. They are two-year research access vehicles. Palantir's Army Enterprise Agreement is a different category entirely — it made Palantir the Army's default data and AI platform in a way that no single contract had previously done. This is the single most important analytical frame for understanding who is actually winning. Every other analysis confuses the two. This one will not.
The Data Problem: Why Every Number You've Seen Is Wrong
CONFIRMED AI — Award explicitly names AI, ML, LLM, computer vision, NLP, or generative AI as primary deliverable. Count at face value.
LIKELY AI — Vendor or product strongly implies AI; description vague or deliberately broad. Mark as estimate.
AI-ADJACENT — Cloud, data, analytics, or automation that supports AI but does not deliver it. Never count in AI total. Track separately.
EXCLUDED — Generic IT or cyber contracts caught by keyword proximity. Name and remove. Most market reports don't bother. That's why their numbers are consistently wrong.
The Vendor Map: Who Is Actually Winning
| Vendor | Category | Est. FY2025 Obligations | Primary Agency | Vehicle | Confidence |
|---|---|---|---|---|---|
| Palantir Technologies | Infrastructure/Platform | $800M–$1.2B | DoD / Army | IDIQ, EA | Likely AI |
| Booz Allen Hamilton | Prime Integrator | $800M (self-disclosed) | DoD, IC, Civilian | OASIS+, AAMAC, MAS | Confirmed |
| Microsoft (Azure Gov) | Cloud Infrastructure | Undisclosed · Large | DoD, All Civilian | JWCC, EA | Adjacent |
| AWS GovCloud | Cloud Infrastructure | Undisclosed · Large | IC, Civilian, DoD | JWCC, CIO-SP4 | Adjacent |
| Scale AI | Boutique AI | ~$200M | CDAO, Army | OTA | Confirmed |
| Leidos | Prime Integrator | Est. $100–200M | DoD, DHS, HHS | OASIS+, CIO-SP4 | Likely AI |
| SAIC / GDIT / Peraton | Prime Integrators | Est. $80–150M each | DoD, Civilian | OASIS+, STARS III | Likely AI |
| Anthropic / Google / OpenAI / xAI | Model Providers | $200M ceiling each | CDAO / DoD | OTA (prototype) | Confirmed |
| Accenture Federal / Deloitte Federal | Prime Integrators | Est. $150–300M combined | Civilian, DoD | OASIS+, MAS | Likely AI |
The Agency Map: Serious Buyers vs. Box-Checkers
DoD — Serious buyer, infrastructure investment confirmed. Palantir's Army EA and Maven ceiling expansion are the evidence. When a military service consolidates 75 contracts into a single 10-year enterprise agreement, it has made an organizational commitment that transcends any individual program manager.
VA — Serious buyer with a specific problem set. NLP applications against medical records: benefits claim processing, clinical decision support, prior authorization review. High-volume, high-stakes applications where performance gaps cost money and lives.
DHS — Uneven, but CBP is real. CBP's AI deployment for border screening and document verification is among the most mature civilian AI programs in the federal government measured by volume of decisions influenced. CISA's programs remain early operational.
The box-checkers. A meaningful number of agencies in the OMB inventory are describing: (a) commercial off-the-shelf tools with AI features used under existing enterprise licenses, (b) analytics platforms that predate modern AI and have been relabeled, or (c) RPA that is not AI by any meaningful technical definition. Any BD strategy treating all 3,611 use cases as equivalent procurement opportunities will waste resources chasing agencies that resolved their "AI" need with a software subscription renewal.
The DoD vs. Civilian Divide
How Money Moves: The Vehicle Breakdown
The CO Lens: What I Saw From the Other Side of the Table
This section is first person. It will be forwarded most within the GovCon community because nothing in it appears in any existing market analysis.
Every AI vendor I evaluated cited benchmark performance from academic datasets, commercial evaluation suites, or their own proprietary test sets. None of these are government data. Government documents — contracting records, logistics databases, benefits claims, intelligence reports — have vocabulary, structure, and error rates that commercial training data does not reflect. When I asked vendors to demonstrate performance against a sample government dataset provided in the solicitation, approximately 70% either declined (citing "security concerns" that were actually performance concerns) or showed material performance drops relative to their benchmark claims. The vendors who won had worked on government data before. This is Palantir's enduring moat: two decades of DoD data. They do not have a benchmark problem. They have a deployment track record.
When I put this question in an RFI for a DHS program, 14 of 22 respondents either did not answer it or described their commercial security posture as a substitute for FedRAMP authorization. FedRAMP is not a security standard — it is a procurement authorization. An agency cannot legally deploy a cloud-hosted AI service that has not completed FedRAMP, regardless of what security certifications the vendor holds. Vendors who had not internalized this distinction were disqualified before technical evaluation. As of early 2026, AI-specific FedRAMP-authorized services fit on one page: Azure OpenAI (via Microsoft), AWS Bedrock (via GovCloud), and a small number of specialized products. Almost every other AI product marketed to federal agencies is operating under an agency-issued ATO on a project-by-project basis. Not scalable. Not portable.
A federal agency provides the vendor with government data to fine-tune a model. The vendor improves their model using that data. The agency's data — including sensitive operational patterns, mission-specific terminology, and classified-adjacently-derived insights — is now embedded in a commercial model the vendor owns. Most commercial AI vendors' standard terms do not contain adequate data rights protections for federal use. Most contracting officers reviewing AI contracts do not have the technical background to identify where the vulnerability is. The FAR data rights regime (FAR 52.227-14) was not designed for machine learning model derivatives. GAO-26-107859 specifically identified "data and intellectual property rights protections" as one of six challenge areas agencies are failing to address consistently. No standardized solution exists as of April 2026.
Why most federal AI pilots never become programs of record: A program office identifies a problem. They run a pilot. Results are compelling. Then pilot funding expires and the program goes dark. The reason is not that the technology failed. It is because no one coded a follow-on funding line in the next year's budget submission — usually due 12–18 months before the pilot completes. The O&M transition plan was not required in the base period. The ATO was a one-year authorization, not a multi-year accreditation. The vendors building recurring federal AI revenue — Palantir being the most visible — solved the program-of-record transition problem first. Every other vendor is still figuring it out.
What Is Next: Pipeline Signals for FY2026–2027
The recompete wave. Most federal AI pilots funded in FY2022–2024 are entering their recompete window. First-generation generative AI pilots procured under emergency RFPs and short-term task orders are now expiring. The recompete market is more valuable than the new award market because the incumbent has a performance record, an established data pipeline, and CPARS. Any company without incumbency positions on first-generation AI pilots should be focused on protest strategies and technical proposals that attack incumbent performance gaps directly.
The FedRAMP 20x inflection. When GSA's FedRAMP 20x process reaches broad availability in Q3–Q4 FY2026, the civilian AI market opens to companies previously locked out by the agency sponsorship requirement. The window between FedRAMP 20x availability and market saturation is 12–18 months. Companies that have built government-grade security postures and are waiting for authorization should be in the pipeline today.
CDAO's next move. The $800 million in frontier AI OTAs expires approximately mid-2027. Before that date, CDAO will decide which agentic AI pilot capabilities are worth converting to programs of record. This conversion decision is the most important pending procurement decision in the federal AI market. The companies doing the best work on agentic AI for specific DoD mission areas right now are building the case for that conversion. The ones doing generic GenAI demonstrations are not.
The classified segment. Every number in this analysis excludes classified AI programs. The Intelligence Community, SOCOM, NSA, and classified DoD programs are running AI at a scale not visible in any public dataset. My estimate, based on the ratio of classified to unclassified spending in analogous technology categories, is that classified AI spending is 1.5–2.5x the unclassified figure. The ceiling for both returns and analysis is the same: the classification boundary.
The federal AI market is four layered markets with different buyers, vehicles, competitive dynamics, and maturity levels. The companies winning Layer 1 and Layer 2 have already won. The contestable market is Layers 3 and 4, and the window for Layer 3 entry is closing as FedRAMP authorization timelines create durable moats for incumbents.
The single most important thing I learned in a career signing federal contracts: the government buys what it can buy, not what it wants to buy. The vendors who win consistently make themselves buyable — authorized, compliant, structured for government acquisition, priced within existing program budgets. The AI companies that entered this market in 2023–2025 expecting to replicate commercial sales cycles are discovering this now. The ones that survive will be the ones who hired a CO first.