Show the site for
Oh My AIJob helper Beta
Choose a botAsk with

PrivacyNothing you type here is sent to us or saved by us. When you press Go, your question goes to the bot you picked, in a new tab, and that bot’s company handles it under its own privacy policy. Please don’t type personal details.For some bots we also copy your question to your clipboard so you can paste it. How this site handles data

Home · Handbook · Standards & buying

Build & rules · AI Policy Handbook

Standards & buying

Technology, law, and practice. As of November 3, 2026.

Facts checked November 3, 2026

As of November 3, 2026

Voluntary frameworks and the written questions that commonly appear in public-sector evaluations.

Standards and frameworks frequently cited

NIST AI RMF 1.0Jan 2023 voluntary U.S. framework: Govern, Map, Measure, Manage.[25]
NIST AI 600-1Jul 2024 Generative AI Profile with GAI-specific risks and suggested actions.[26]
ISO/IEC 42001:2023Certifiable AI management-system standard.[27]
C2PA / Content CredentialsProvenance standard for media origin and edits.[47]
OECD AI PrinciplesIntergovernmental soft law on trustworthy AI.[44]
TX-RAMP / FedRAMP analoguesAuthorization programs for cloud services used by government.[13]

Questions officials commonly ask vendors (in writing)

  • Data locationWhere are prompts, embeddings, and files stored and processed? Which affiliates and subprocessors?
  • TrainingAre customer inputs used to train or improve models for others under this exact SKU?
  • RetentionDefault log retention? Deletion on request and at contract end, with written confirmation?
  • GroundingDoes the product cite sources? Can retrieval be limited to an approved corpus?
  • EvaluationWhat benchmarks, red-team results, and bias tests are available for the deployed version?
  • Access controlSSO, role-based access, customer-managed keys, and admin audit logs?
  • AgentsWhich tools can the agent call by default? How are permissions changed and logged?
  • IncidentsNotification timeline for security or safety incidents? Cooperation with public records requests?
  • ExitExport formats for prompts/outputs/knowledge bases? Transition assistance and fees?
  • Compliance mappingHow does the vendor map features to TRAIGA disclosure, EU AI Act roles, or NIST AI RMF functions if claimed?

Contract terms often requested

  • No training on customer content for the stated plan, in writing.
  • Deletion and certification at contract end.
  • Security-incident notice within a defined number of days.
  • Right to test performance and bias on agreed datasets before and after go-live.
  • Exit assistance and data return without punitive lock-in fees (parallel to themes in OMB M-25-22).[20]
  • For Texas state agencies: TX-RAMP where applicable.[13]
← Policy topicsFor public bodies →