Written and maintained by CASRAI Editorial Board
Last updated
FedRAMP AI refers to the FedRAMP AI Prioritization initiative: a program run by the U.S. Federal Risk and Authorization Management Program that moved selected AI cloud services to the front of the authorization queue. As described on the official FedRAMP page (checked 2026-10-29), the initiative began in August 2025, was completed in April 2026, and is no longer available for new entrants. There is no application to file. What remains useful is the criteria it applied and the services it prioritized, because they show what the federal government treated as the minimum for routine, repeated use of conversational AI by its workers.
The gap most pages leave open is how the initiative connects to the newer FedRAMP 20x authorization path. This guide sets out the eligibility criteria, the services named, the link to 20x, and what a university or research office can and cannot conclude from a service appearing on the list.
What FedRAMP AI prioritization is and who runs it
FedRAMP is operated within the General Services Administration; the official site identifies itself as an official website of the GSA’s Technology Transformation Services. The official AI page marks the initiative as historical and states its purpose as prioritized authorization of AI-based cloud services that give federal workers access to conversational AI engines for routine, repeated use.
The initiative ran from August 2025 until April 2026. The page states: “This opportunity is no longer available for new entrants.” The FedRAMP Marketplace is the searchable database of FedRAMP certified cloud services, authorizing agencies and recognized assessors, and is the place to look up whether a given service holds a certification today.
Eligibility: the five criteria
The official page lists five criteria, all of which a service had to meet. They are paraphrased from the official page, checked 2026-10-29.
| # | Criterion | What it says |
|---|---|---|
| 1 | Enterprise-grade features | Features such as single sign-on, SCIM provisioning, role-based access control and real-time analytics. |
| 2 | Data separation and protection | Model information from training on customer data will not leave the customer environment without customer authorization. |
| 3 | Demonstrated demand | Demand from at least five CFO Act agencies, or a specific recommendation from the CIO Council. |
| 4 | Government availability | Available for government use through the GSA Multiple Award Schedule. |
| 5 | 20x readiness | Ability to meet FedRAMP 20x authorization requirements within two months of acceptance for prioritization. |
What it funds or requires
The initiative did not fund anything; it changed the order of work. Its benefit was prioritized authorization, and its requirement was the five criteria above. Criterion 2 is the one with the most practical weight for research offices, because it is a statement about customer data and model training, not about product features.
The official page names three prioritized services, reported as receiving FedRAMP certification in early 2026:
- ChatGPT Enterprise and API Platform (OpenAI)
- Gemini for Government (Google)
- Perplexity Enterprise Pro for Government (Perplexity AI, Inc.)
Note the product names. The certification attaches to the named enterprise or government offering, not to the vendor’s consumer product of a similar name. The page does not state impact levels for these three services, so none is given here.
Application or compliance steps
The AI Prioritization page describes no application process, and the initiative is closed, so there is no AI-specific route to apply through today. A cloud provider seeking FedRAMP authorization now works through the standard FedRAMP paths, including the 20x approach described below. An institution that is a customer rather than a provider does not apply to FedRAMP at all; it checks the Marketplace for the service it wants to use and reads the authorization details there.
For the authorization concept itself, see the CASRAI guide to the authority to operate (ATO), and for the highest baseline see FedRAMP High.
How AI prioritization connects to FedRAMP 20x
FedRAMP 20x is described on the official site as a new approach to cloud security assessment and authorization, focused on security decisions rather than traditional compliance. Two links to AI prioritization appear on the official pages. First, criterion 5 required a prioritized service to meet 20x requirements within two months of acceptance. Second, the 20x Phase 2 pilot admitted providers that had passed Phase 1, “AI-prioritized offerings,” and critical-need services such as trust centers and GRC tools.
The 20x page defines authorization classes (checked 2026-10-29):
| Class | Status on the official page |
|---|---|
| A | Available now |
| B | Available now |
| C | Available now; described as common enterprise services |
| D (High) | Not yet available; developed in Phase 4 |
For how a major cloud provider’s offerings sit within these programs, see AWS and FedRAMP.
Typical timeline phases
The official 20x page organizes the program into phases and states that future dates are estimates that may change. As of 2026-10-29: Phase 1 (20x Low pilot) completed in fiscal 2025, Q3 to Q4; Phase 2 (Moderate pilot) completed in fiscal 2026, Q1 to Q2; Phase 3 (wide-scale adoption) is active in fiscal 2026, Q3 to Q4; Phase 4 (Class D, High, pilot) is estimated for fiscal 2027, Q1 to Q2; and Phase 5 is estimated for fiscal 2027, Q3 to Q4 and ends acceptance of new Rev5 certifications. The AI Prioritization initiative itself ran inside this window, from August 2025 to April 2026.
Common mistakes
- Looking for an application. The AI initiative is closed to new entrants and describes no application path.
- Treating a product name as covering every edition. The page names specific offerings, such as ChatGPT Enterprise and API Platform, not every product from the same vendor.
- Assuming High authorization is available through 20x. On the 20x page, Class D (High) is not yet available.
- Reading certification as a data-handling decision. Criterion 2 is a requirement on training and customer data, but a research office still decides what data may go into a service. For that question, see zero data retention AI tools for research.
- Forgetting the separate research-data rules. Controlled unclassified information in sponsored research is governed by its own requirements; see NIST 800-171 and CUI in university research.
Related programs
| Program | What the official page says |
|---|---|
| FedRAMP AI Prioritization | Prioritized authorization of conversational AI cloud services; August 2025 to April 2026; closed to new entrants. |
| FedRAMP 20x | A new approach to cloud security assessment and authorization, in five phases, with Classes A to D. |
| Rev5 certification | Phase 5 of 20x is estimated to end acceptance of new Rev5 certifications; the page lists June 11, 2027 as the date FedRAMP stops accepting them. |
| FedRAMP Marketplace | Searchable database of certified cloud services, authorizing agencies and recognized assessors. |
FAQ
What is FedRAMP AI?
It is shorthand for the FedRAMP AI Prioritization initiative, which prioritized authorization of AI cloud services offering conversational AI for routine federal use. The official page now marks it historical.
Can a company still apply for FedRAMP AI prioritization?
No. The official page states the opportunity is no longer available for new entrants, and it ran from August 2025 to April 2026.
Which AI services were prioritized?
The page names ChatGPT Enterprise and API Platform, Gemini for Government, and Perplexity Enterprise Pro for Government, reported as receiving FedRAMP certification in early 2026.
Does a FedRAMP-certified AI tool mean research data can go into it?
Not by itself. Certification applies to the named offering, and an institution still decides which data classes are allowed under its own policies and sponsor terms.
Sources
- FedRAMP AI Prioritization, fedramp.gov, checked 2026-10-29.
- FedRAMP 20x, fedramp.gov, checked 2026-10-29.
- FedRAMP home page, fedramp.gov, checked 2026-10-29.
Facts are stated as described on the official pages on 2026-10-29. Programs change; the official pages govern.
