Artificial intelligence (AI) is changing how federal contractors prepare proposals and how government agencies evaluate them. AI tools can summarize lengthy documents, organize technical information, and speed up repetitive tasks. Proper oversight ensures these tools support fair, secure, and trustworthy evaluations, helping the audience feel empowered to manage AI responsibly.
Consider an evaluator who relies on an AI-generated summary that overlooks a critical technical strength. Another offeror receives a more favorable evaluation, and the agency cannot clearly explain why. If the issue involves a material error in the evaluation, it could become a basis for a bid protest.
This is where Shadow AI becomes a concern for government contracting.
Shadow AI refers to the use of AI tools without appropriate organizational authorization, oversight, data controls, or documentation. In federal contracting, it can occur when agency personnel use unapproved AI tools to evaluate proposals or when contractors use unauthorized tools to prepare sensitive bid materials. Transparency in AI use helps the audience trust the process and avoid risks.
Why Shadow AI Matters in Federal Proposal Evaluations
Federal procurement decisions must follow established evaluation requirements. Under FAR 15.305, agencies must evaluate competitive proposals using the factors and subfactors specified in the solicitation. They must also document the strengths, deficiencies, significant weaknesses, and risks supporting their evaluations.
These requirements remain important when AI tools assist the process.
An AI system may help organize proposal information, but its output does not replace the agency’s responsibility to evaluate proposals against the stated criteria and maintain supporting documentation. Verifying AI outputs ensures the audience feels diligent and confident in the integrity of the evaluation process.
Other rules address information protection. FAR 3.104-4 establishes protections against unauthorized disclosure of contractor bid or proposal information and source selection information. FAR 52.204-21 establishes basic safeguarding requirements for covered contractor information systems that process, store, or transmit Federal Contract Information (FCI).
These provisions do not create a blanket prohibition on AI. Instead, they highlight why organizations must understand how AI tools access, process, and handle procurement information and establish specific mitigation strategies to prevent Shadow AI-related errors.
The central question is not simply whether AI was used. It is whether that use affected the procurement process in a way that violated applicable requirements or undermined the basis for the award decision.
5 Shadow AI Risks That Could Create Protest Exposure
1. Undisclosed AI Changes the Evaluation Method
AI tools can summarize proposals, assign preliminary scores, rank submissions, or identify potential weaknesses. These functions may help evaluators manage large volumes of information.
Problems can arise when an AI tool materially changes how proposals are evaluated.
For example, an agency’s solicitation may emphasize technical capability, staffing experience, and past performance. An evaluator uses an AI tool to rank proposals, but the tool gives substantial weight to writing style or terminology that the solicitation does not identify as an evaluation factor.
If the agency relies on that output in a way that materially changes the evaluation, an offeror may have grounds to question whether the agency followed the solicitation.
Under FAR 15.304, evaluation factors and significant subfactors must be established for the acquisition. FAR 15.305 requires evaluations to be based on those stated factors and subfactors.
However, using AI does not automatically establish a violation. The relevant questions are how the tool was used, whether it influenced the actual evaluation, and whether the process remained consistent with the solicitation.
Governance check:
- Define approved AI uses in evaluation workflows.
- Identify which decisions require direct human judgment.
- Verify that AI-assisted evaluations follow the stated criteria.
- Document material changes to evaluation methods and workflows.
2. AI-Generated Errors Distort Proposal Findings
Generative AI can produce incorrect statements while presenting them confidently, known as AI hallucinations. Proposal managers and evaluators should verify AI-generated content against original data to prevent reliance on false information.
In a GovCon evaluation, an AI tool might incorrectly summarize a contractor’s technical approach, misstate a staffing commitment, or claim that a proposal lacks a capability that it actually describes.
The consequences can be significant if evaluators rely on incorrect information.
The NIST Generative AI Profile identifies confabulation, or the generation of false or misleading content, as a risk associated with generative AI.
For example, suppose a proposal describes a documented cybersecurity testing process. An AI-generated summary incorrectly states that the process is missing. If the evaluator relies on that summary when assigning a weakness, the contractor could challenge the evaluation.
Whether such a challenge succeeds depends on the facts, the applicable evaluation requirements, and the evidence in the procurement record.
The same problem can affect contractors preparing proposals. AI may generate inaccurate past-performance details, unsupported technical claims, or incorrect certifications. Submitting these statements without verification can undermine the credibility of the proposal.
Governance check:
- Verify material findings against the original proposal.
- Require human review of AI-generated claims and summaries.
- Check technical statements against authoritative records.
- Preserve the evidence supporting important evaluation conclusions.
3. AI Summaries Omit Important Strengths or Differences
Federal proposals can contain hundreds of pages of technical information, staffing plans, past-performance records, and compliance documentation.
AI can help summarize this information. However, summarization can remove details that matter to the evaluation. A summary might omit a contractor’s relevant experience, overlook a condition attached to a technical commitment, or fail to capture a meaningful difference between competing approaches.
These omissions can affect how evaluators compare proposals.
For example, two offerors may propose similar technical solutions, but one includes a documented implementation method that reduces delivery risk. If an AI-generated summary leaves out that distinction, the evaluation may not fully reflect the information in the proposal.
Under FAR 15.305, agencies must document the strengths, deficiencies, significant weaknesses, and risks supporting their evaluations.
If an AI-generated summary contributes to a material omission or an unreasonable evaluation, the affected contractor may have grounds to challenge the decision. However, an omitted detail does not automatically establish a protestable error. Its significance depends on the solicitation, the evaluation record, and the effect on the award decision.
Governance check:
- Keep original proposal documents available during evaluation.
- Compare summaries against source material.
- Review whether material strengths, limitations, and conditions remain intact.
- Document the reasoning behind significant evaluation findings.
4. Different AI Tools or Prompts Create Inconsistent Treatment
Consistency is essential when agencies evaluate competing proposals.
For example, one evaluator may use AI to identify technical risks, while another uses a different tool that emphasizes cost savings and delivery speed. If those differences materially influence how competing proposals are assessed, the agency may face questions about the consistency of its evaluation.
Another concern is the introduction of unstated evaluation criteria.
An AI tool may emphasize a feature that appears important in its generated analysis but is not part of the solicitation’s stated evaluation approach. If evaluators rely on that feature in a way that changes the assessment, the process could become difficult to defend.
FAR 15.304 establishes requirements concerning evaluation factors and significant subfactors. FAR 15.305 requires agencies to evaluate proposals using the factors and subfactors specified in the solicitation.
The concern is not that every evaluator must use identical software. It is that AI-assisted methods must not undermine fair, solicitation-based evaluations.
Governance check:
- Establish approved AI tools and workflows.
- Standardize prompts where appropriate.
- Train evaluators on the limits of AI-generated recommendations.
- Document material differences in tool use.
- Review evaluations for consistent application of the stated criteria.
5. Weak Documentation Makes the Award Decision Difficult to Defend
Even when AI produces useful results, an organization needs to understand how those results influenced its decisions.
A weak audit trail can make that difficult.
For example, an evaluation report may contain an AI-generated finding, but the agency cannot identify the source information supporting it. The record may also fail to explain whether a human evaluator verified the finding or how it influenced the final assessment. These gaps can make it harder to demonstrate that the evaluation was reasonable and consistent with the solicitation.
FAR 15.305 requires agencies to document the findings supporting proposal evaluations. It does not expressly require every agency to retain a specific set of AI metadata. Nevertheless, maintaining appropriate records of material AI assistance can help organizations explain their decision-making process.
The relevant documentation may include the tool used, the purpose of its use, the source material reviewed, the human review performed, and the rationale for the final decision. Recordkeeping must also follow applicable security, privacy, and records-management requirements.
Governance check:
- Define documentation requirements for material AI-assisted work.
- Record human review and approval of important findings.
- Preserve supporting evidence for evaluation decisions.
- Establish procedures for reviewing and correcting AI-generated errors.
- Align retention practices with applicable records and security requirements.
What Recent GAO Decisions Tell Us About AI Risks
Recent decisions from the Government Accountability Office (GAO) illustrate the risks of relying on unverified AI-assisted legal work. However, they should not be presented as decisions establishing that undisclosed AI use by agency evaluators is itself a basis for sustaining a protest.
In Raven Investigations & Security Consulting, LLC, B-423447, issued May 7, 2025, GAO dismissed a protest as academic after the agency terminated the challenged order. GAO also warned that citation irregularities could result in sanctions.
In Oready, LLC, B-423649 et al., issued September 25, 2025, GAO addressed repeated problems involving nonexistent or inaccurate legal citations in protest filings.
These cases demonstrate why AI-generated legal research and citations require careful verification. They do not establish that agency-side AI-assisted proposal evaluation has been recognized as a standalone protest ground.
For contractors, the broader lesson is clear: AI-generated information must be checked before it becomes part of a formal procurement submission or decision.
Contractor-Side Shadow AI: Risks Beyond the Evaluation Process
Shadow AI is not limited to government evaluators. Contractors can also create risk when employees use unauthorized AI tools to develop proposals.
Three areas deserve particular attention.
1. Confidentiality and data exposure
Employees may upload pricing information, proprietary technical material, customer information, or nonpublic government information to external AI services.
Whether this creates a specific compliance violation depends on the information involved, the applicable contract terms, agency requirements, and tool configuration.
Contractors should classify information before using AI and verify that approved tools provide the necessary safeguards.
2. Unsupported proposal claims
AI can generate inaccurate descriptions of past performance, employee qualifications, certifications, technical capabilities, and delivery commitments.
Contractors remain responsible for the representations they submit. Every material claim should be checked against reliable records before inclusion in a proposal.
3. Noncompliance with solicitation or contract requirements
A solicitation, contract clause, or agency policy may restrict particular AI uses or impose disclosure and data-handling requirements.
Contractors should review the applicable requirements for each opportunity rather than assume AI use is always prohibited or always permitted.
For additional context, OMB Memorandum M-25-22 addresses federal agencies’ acquisition of AI. It should not be interpreted as a universal requirement for contractors to disclose every AI tool used in every proposal.
A Practical Shadow AI Governance Checklist for GovCon Teams
Effective AI governance does not require organizations to abandon useful technology. It requires clear rules for how AI can be used, what information it can access, and how its output must be verified.
BD leaders, proposal managers, and compliance officers can start with these steps:
- Create an approved AI tool list: Identify permitted tools and the business purposes for which they may be used.
- Classify sensitive information: Define what employees can and cannot enter into AI systems.
- Require human verification: Check generated claims, citations, summaries, and recommendations before relying on them.
- Protect solicitation compliance: Ensure proposal development and evaluation remain aligned with applicable requirements.
- Document material AI assistance: Establish appropriate records of important AI-assisted decisions and human reviews.
- Train employees: Explain acceptable AI use to BD, proposal, technical, and compliance teams.
- Review opportunity-specific requirements: Check solicitation instructions, contract clauses, agency policies, and applicable security obligations before using AI.
These controls help organizations identify risks before they affect a proposal, an evaluation, or a contract decision.
How CyberX Gov Solutions Can Help
CyberX Gov Solutions can help your organization strengthen its governance approach. We support government contractors with proposal development and compliance-focused consulting. If your team needs clearer AI-use policies, stronger proposal controls, or a more consistent review process, schedule a free consultation at cyberxgovsolutions.com/schedule-a-meeting/
Frequently Asked Questions About Shadow AI
1. What is Shadow AI in government contracting?
Shadow AI is the use of AI tools without appropriate organizational approval, oversight, or safeguards. In GovCon, it can involve proposal development, document analysis, or contract evaluation.
2. Can AI use lead to a federal contract bid protest?
AI use alone does not establish a valid protest. A challenge may be possible when the evidence shows that AI contributed to a material procurement error or an evaluation inconsistent with the solicitation.
3. Does the FAR prohibit contractors from using AI to write proposals?
There is no blanket prohibition in the cited FAR provisions against all AI-assisted proposal writing. Contractors must review applicable solicitation instructions, contract clauses, agency policies, and information-handling requirements.
4. What are the biggest risks of using AI in federal proposals?
Key risks include inaccurate claims, exposure of sensitive information, missed solicitation requirements, unsupported evaluation findings, and inadequate documentation.
5. How can government contractors prevent Shadow AI risks?
Contractors can establish approved-tool policies, restrict sensitive-data sharing, verify AI-generated content, train employees, and document important review and approval steps.
6. Does OMB M-25-22 require disclosure of every AI tool used by a contractor?
No. The memorandum addresses federal AI acquisition and includes guidance on disclosure in certain circumstances. It does not establish a universal disclosure requirement for every AI use in every contractor proposal.
7. Why is human review important when using AI for proposal development?
Human review helps identify inaccurate claims, unsupported citations, missing requirements, and technical errors before they reach the customer or become part of a formal submission.
This article provides general information, not legal advice. Procurement requirements and their application depend on the specific solicitation, contract, agency policies, and circumstances. Consult qualified procurement counsel when assessing a potential bid protest or legal obligation.
