Already in the Environment: Why State Agencies Need a Mid-Contract AI Review Protocol

Product availability and agency approval are separate decisions

A platform may offer an AI feature through an add-on, a revised package, an administrator setting, or a release update. Each route raises practical questions: what is included, who can activate it, what data can it reach, and which review applies? The answer depends on the product, contract, tenant, deployment environment, and intended use.

Primary product materials illustrate why a feature-level inventory matters:

• Microsoft Copilot: Microsoft describes organizational context drawn from emails, chats, and documents through Microsoft Graph, subject to the user's permissions. Its documentation also describes administrative controls for connected agents. Review the exact license and government environment rather than assuming that a feature available in one Microsoft offering is available or approved in another. Microsoft privacy and security documentation.
• Salesforce: Its Spring 2025 release guide describes limited Agentforce access through Salesforce Foundations in supported editions, while other features require add-ons. The guide also describes case summaries and resolution planning tied to specific licenses. This supports checking edition, entitlement, configuration, and use case separately—not treating every Einstein or Agentforce feature as standard in every subscription. Salesforce’s release guide.
• ServiceNow: On April 9, 2026, the company announced AI-enabled products and new packages spanning assistance and agentic automation. An agency should confirm its contracted package, available capabilities, activation settings, and approval evidence against that vendor announcement. ServiceNow’s announcement.
• Oracle and SAP: Oracle publishes an inventory of embedded Fusion AI features and configuration guidance across its enterprise applications. SAP describes Joule integration into S/4HANA Cloud Public Edition and directs customers to check activation prerequisites. For HR, finance, procurement, and other business systems, use those product-specific materials to identify the features relevant to the agency's actual subscription. Oracle feature inventory guidance, SAP’s Joule announcement.

Availability is the start of the review. A license entitlement, a production activation, and an authorized use are different records, and they should be reconcilable.

Apply the policy that actually governs the use

Colorado provides a clear example of review extending beyond a new acquisition. Its OIT AI guide says all generative-AI efforts and use cases, including those conducted by third-party vendors, must go through OIT for risk assessment. An existing contract does not place a use outside that stated requirement. Colorado OIT AI guide.

California’s March 30, 2026 Executive Order N-5-26 directs agencies to develop recommendations concerning AI procurement and vendor certifications. That order is a specific procurement initiative, not a complete description of every California AI approval requirement. Read it alongside the policies applicable to the agency and deployment. Signed order, directives 1 and 3.

At the federal level, OMB M-25-21, dated April 3, 2025, replaced M-24-10 and expressly covers new and existing AI developed, used, or acquired by or on behalf of covered agencies, subject to its scope provisions. It governs covered federal agencies; it does not automatically establish a state's obligations. Its lifecycle scope is nevertheless a useful reference when checking whether an internal process reaches deployed systems. M-25-21, pages 1 and 4.

The implementation question is concrete: can the agency demonstrate that a relevant feature activation reaches the required reviewers? If an administrator can enable a feature without that handoff, fix the workflow. If the review already exists, connect it to tenant-level evidence and avoid creating a duplicate approval process.

Review data reach, model dependencies, and change controls

Data reach. A tool that retrieves information across multiple repositories can make existing access permissions especially consequential. Microsoft states that Copilot surfaces organizational information the user can already view. The useful test is whether those permissions remain appropriate for the intended task, including inherited group membership and shared folders. A permission-respecting tool can still expose an agency's overly broad sharing configuration more readily. Test relevant use cases before extending access.

Foundation-model and service dependencies. Trace prompts, retrieved records, outputs, logs, and connected-agent requests through the actual service. Identify the contractual protections that apply to the platform vendor and its subprocessors. Microsoft, for example, states that prompts, responses, and Graph data are not used to train foundation models and describes contractual commitments and additional terms for particular integrations. Confirm the terms for the selected service and connected tools. Do not infer retention, residency, or training treatment from another product's policy.

Model and feature changes. Microsoft states that its models are regularly updated while security, privacy, and compliance settings remain unchanged. Unchanged settings do not establish unchanged task performance. An agency should specify the changes that trigger a new evaluation: a model replacement, a new connector, expanded permissions, altered retention, or movement from drafting to taking action. Use available release information and contract provisions to determine notice, testing, and deferral options.

Administrative activation. Identify who can enable features, assign licenses, add agents, or change data connections. A central policy is more useful when those administrators know the required review and can find the approval record. Reconcile production settings with the authorized scope periodically and after material changes. These are recommended controls; whether a particular approval is mandatory depends on the applicable policy and contract.

A five-part mid-contract review

Keep the review focused on decisions the agency can make and evidence it can maintain.

1. Inventory the capabilities. Ask each platform owner and vendor for the AI features available under the current agreement, their release status, license requirements, and relevant government-environment limitations. Link the answer to the platform, tenant or instance, contract, business owner, and intended users. Include features available but disabled so a later activation can be identified.
2. Check actual activation and use. Compare vendor entitlements with administrative settings and available usage records. Distinguish an enabled feature from one that is actively used. Record connectors, permissions, agents, and action authority. Resolve unexplained differences with the system owner before expanding deployment.
3. Classify the specific use. Apply the relevant risk framework to the data, action, users, and consequences. A personnel-record assistant and a ticket-summary tool both need context: a ticket may itself contain sensitive information or privileged instructions. Prioritize by the actual exposure and potential effect, not the product name. Record restrictions and the evidence supporting the classification.
4. Review the agreement and data terms. Identify which terms apply, when they were accepted, and who had authority to accept them. Map residency, retention, training use, subcontractors, incident handling, and deletion obligations to the technical data flow. Distinguish an unanswered question from a verified contractual gap; route unresolved material terms to procurement, privacy, security, and counsel as appropriate.
5. Connect activation to approval. For sensitive systems—including Medicaid, SNAP, child welfare, criminal justice, personnel, and tax—define approval authority and acceptance evidence before enabling the proposed use. CIO and CISO involvement may be appropriate, alongside program and data owners; use the state's actual allocation of responsibility. Approval should identify the permitted task, data boundary, oversight, and conditions for reassessment.

If the review discovers an active use without required evidence, document the disposition. Options may include a bounded evaluation, a narrower data scope, remediation before expansion, or suspension where warranted. The decision should reflect the actual risk and applicable rules, with an owner and completion date.

Follow an enabled feature back to its approval

Consider a hypothetical review of a document assistant enabled within an existing platform. The license record shows entitlement and the administrator confirms activation. Neither establishes that the agency approved the connected repositories or the employees' actual uses. The reviewer follows the chain from entitlement to configuration, data permissions, intended task and approval evidence.

Suppose the approved pilot covered public policy documents, but the deployed configuration also permits retrieval from an internal case repository. The first question is whether this configuration is authorized and appropriate, not whether the platform has violated permissions. A user may legitimately access a record for one duty while the proposed AI use of that record needs separate review. Check the actual policy and contract rather than assuming either permission or prohibition.

The service owner may be able to restrict the connector, narrow the user group or disable the feature while the agency resolves the discrepancy. Verify that the chosen restriction works in the product and does not interrupt another required function. Where isolation is impossible, that constraint belongs in the decision about continued use.

Before restoring or expanding access, test the permitted task and boundary with representative cases, record the disposition and confirm who will receive future change notices. This exercise does not require repeating every procurement assessment. It requires closing the specific gap between what the agency approved and what its platform is doing.

Use amendments and renewals to make controls durable

A renewal or amendment is an opportunity to clarify obligations. Prepare the position before negotiations, using the deployed configuration and intended roadmap. Recommended terms include:

• Feature disclosure: a maintained inventory of AI capabilities relevant to the licensed product, including material additions.
• Change notification: a defined notice process for consequential model, data-processing, permission, or activation changes, with practical lead times and exceptions stated.
• Assessment and deferral: the agency's ability to evaluate a proposed capability and restrict or defer activation where agreed.
• Dependency transparency: identification of relevant model providers, subprocessors, connected services, and the terms governing their processing.
• Evidence and audit access: appropriate logs, evaluation evidence, and access to outputs needed for oversight, subject to privacy, security, retention, and third-party rights.

These are negotiation objectives, not a representation that every vendor currently offers each term. Reconcile them with existing change-management, data-protection, and audit provisions so that responsibilities are clear. Define what happens if a required capability cannot be isolated or a vendor cannot provide the requested evidence.

Once agreed, connect the terms to operational owners. Procurement should know who receives change notices; administrators should know what they may enable; reviewers should have the evidence needed to approve the use; and program leaders should know how to report a problem. That operating connection makes mid-contract review useful long after the amendment is signed.

Sources and further reading

• Colorado OIT: AI guide and statewide assessment scope
• California: signed Executive Order N-5-26
• OMB: M-25-21
• Microsoft: Copilot data, privacy, and security
• Salesforce: Spring 2025 feature and license examples
• ServiceNow: April 2026 packaging announcement
• Oracle: Fusion AI feature inventory and rollout guidance
• SAP: Joule availability and activation prerequisites

Spartan X's AI consulting, cybersecurity, and engineering capabilities support this connection between policy and deployed systems: identifying the relevant features and data flows, defining practical acceptance evidence, and making approval and change controls usable by the people operating the platform.