Government AI Deployment in Arizona: Step-by-Step Procurement Checklist for 2026

Arizona agencies can move from scattered AI pilots to compliant, fundable deployments for 2026 by following a sequenced procurement checklist that ties use cases, data classification, CJIS/FedRAMP/StateRAMP requirements, and staffing to a tightly written AI RFP and SOW.

---

Why Arizona AI Procurement Needs Its Own Playbook for 2026

Arizona state, county, and city agencies face a specific mix of pressures:

• Residents and legislators expect faster digital services.
• Vendors are pushing “AI-powered” everything.
• Security teams must align to NIST, StateRAMP/FedRAMP, and CJIS.
• Budgets for FY25–26 are already tight.

Generic AI best-practice docs are not enough. Arizona procurement officers, CIOs, and program owners need a step-by-step, procurement-ready checklist tailored to:

• State and local government procurement realities
• Public safety and CJIS constraints
• Shared services and regional collaborations
• Realistic staffing models (internal, contractors, and AI specialists)

This article walks through a sequenced checklist that an Arizona agency can use to:

1. Clarify business value and data risk.
2. Decide on hosting and compliance baselines.
3. Draft AI-specific RFP/SOW language.
4. Set vendor evaluation criteria suited to AI.
5. Plan staffing that can actually deliver production AI in 2026.

Throughout, we reference complementary guides like /insights/government-ai-procurement-guide and /insights/government-ai-deployment-arizona where you can go deeper on specific decisions.

---

Step 1: Establish AI Strategy and Governance for Arizona Agencies

Before you write a single RFP clause, you need a lightweight but explicit AI governance structure.

1.1 Form a cross-functional AI working group

Include:

• Business/program owner (benefits, unemployment, corrections, transportation, etc.)
• CIO/IT leadership
• Information security / privacy officer
• Legal and records management
• Procurement
• At least one technical AI practitioner (internal, or from a partner like Gain America)

This group:

• Approves AI use cases and risk levels.
• Reviews major procurements.
• Owns agency AI standards (prompting, data retention, human oversight).

In practice, procurement moves faster when governance decisions are made once at the working-group level and then “snap into” each project, rather than renegotiating risk and ethics from scratch in every RFP.

1.2 Align with national frameworks, not ad hoc rules

Arizona agencies can save time by anchoring AI governance to established frameworks:

• NIST AI Risk Management Framework (AI RMF): for risk identification, measurement, and mitigation.
• NIST SP 800-53 / 800-171: to align AI systems with existing security control baselines.
• CJIS Security Policy: for criminal justice information.
• FedRAMP / StateRAMP: for cloud-based AI solutions, especially those handling sensitive data.

Document:

• Which risk tiers of AI (low/medium/high) your agency recognizes.
• Expected controls per tier (e.g., human-in-the-loop requirements, logging, model explainability).

This documentation becomes attachment language in your RFPs.

---

Step 2: Inventory Use Cases and Data Classifications

Your procurement checklist should begin with a use-case and data inventory, not with model names or vendors.

2.1 Classify data for each candidate AI use case

For each use case, tag the data:

• Public (e.g., website FAQs)
• Internal non-sensitive (work instructions, SOPs)
• Sensitive but non-CJI (PII, benefits records, health data, education records)
• Criminal Justice Information (CJI) (NCIC data, arrest records, investigative notes)
• Critical infrastructure or security-sensitive data

Ask:

• Does any data fall under CJIS?
• Does any data require HIPAA-like protections or FERPA sensitivity?
• Are there retention and records requirements (public records laws, evidentiary records)?

For public and low-risk data, you can procure AI solutions much more quickly. For CJIS or high-risk data, your checklist must explicitly route to CJIS-aligned and FedRAMP/StateRAMP workloads, as well as stricter SOW language.

For more on this decision pattern across governments, see /insights/government-ai-deployment.

2.2 Prioritize “thin slice” use cases for 2026

Select 1–3 thin but production-relevant use cases:

• Document summarization for case workers
• Draft response generation for citizen emails or chat
• Search and retrieval over regulations or policy manuals (government RAG assistants)
• Back-office process automation with human review

Avoid starting procurement with:

• Fully autonomous decision-making
• High-risk enforcement or adjudication uses
• AI that directly changes benefits or sanctions without human oversight

Your procurement checklist for 2026 should target assistive AI with clear human-in-the-loop checkpoints, aligning with best practices in /insights/public-sector-agentic-ai.

---

Step 3: Decide Hosting, Security, and Compliance Baselines

Only after data classification and use-case selection should you lock in hosting and compliance parameters.

3.1 Cloud vs on-prem vs hybrid in Arizona context

Consider:

• State data center capacity and readiness for GPU workloads.
• Existing contracts with major cloud providers that already support FedRAMP or StateRAMP.
• Network connectivity from agencies and local jurisdictions.

Use this decision tree:

• If workload handles CJI or critical justice operations → strongly favor CJIS-compliant cloud or state-operated secure environment; ensure vendor maps to CJIS Security Policy.
• If workload handles sensitive but non-CJI data → require cloud that meets FedRAMP Moderate-equivalent and state security assessments (including StateRAMP where applicable).
• If workload handles public data only → you can allow more vendors but still enforce security, logging, and data isolation standards.

For Arizona governments planning more intensive AI workloads (training or large-scale inference), see infrastructure considerations discussed in /insights/ai-data-centers-for-government-workloads.

3.2 CJIS and justice workloads

For DPS, sheriffs, prosecutors, courts, or any agency touching criminal justice information:

• Treat CJIS alignment as non-negotiable for systems that:
  • Store or process CJI
  • Provide admin access to systems holding CJI
  • Integrate with RMS, JMS, or CAD systems

Key checklist items:

• Vendor must provide a CJIS security addendum or equivalent contractual commitment.
• Detail data residency (where is data stored? which data centers?).
• Clarify encryption in transit and at rest, access controls, and audit logging.
• Ensure any subcontractors are covered under the same CJIS obligations.

You can use patterns from /insights/cjis-compliant-ai when drafting your requirements.

3.3 FedRAMP and StateRAMP for Arizona AI workloads

For cloud-hosted AI systems:

• Prefer solutions that run on FedRAMP-authorized services at Moderate or higher for sensitive data.
• Where StateRAMP is in scope, ensure the vendor either:
  • Is StateRAMP authorized or in process; or
  • Provides a detailed mapping to NIST 800-53 and allows your security team to perform a risk review.

Core checklist items:

• Require documentation of FedRAMP boundary and which components are in-scope vs. out-of-scope.
• Require an up-to-date System Security Plan (SSP) summary or equivalent.
• Confirm incident response obligations and notification timelines.

See /insights/fedramp-ai-compliance and /insights/stateramp-govramp-ai-compliance for deeper compliance patterns that apply to many Arizona environments.

---

Step 4: Build a 2026-Ready AI RFP Checklist for Arizona Procurement

With governance and hosting sorted, you can structure a modular AI RFP that Arizona procurement teams can reuse across agencies.

4.1 Core RFP sections specific to AI

In addition to your standard state or local boilerplate, add:

1. AI Use Case Description

   • Business process, volumes, and systems in scope.
   • Data classification and any CJIS/PII constraints.

2. AI Functional Requirements

   • Retrieval-augmented generation (RAG) over agency documents.
   • Summarization, translation, or classification tasks.
   • APIs and integration needs with case management or ERP systems.

3. AI Risk Management and Human Oversight

   • Required human review steps before an AI output can affect a case or resident.
   • Procedures for correcting errors and updating training data or prompts.
   • Explainability or traceability expectations.

4. Security, Privacy, and Compliance

   • NIST AI RMF alignment.
   • Mapping to NIST 800-53 controls.
   • FedRAMP/StateRAMP level and CJIS obligations if applicable.

5. Data Use, Retention, and Model Training

   • Prohibit vendors from training foundation models on your sensitive data without explicit consent.
   • Spell out data retention, deletion, and export rights.
   • Require clear handling of logs and prompts.

6. Performance, Testing, and Evaluation

   • Benchmarks for accuracy, latency, and robustness.
   • Requirements for bias assessment and red-teaming.
   • Conditions for acceptance and go-live.

7. Monitoring and Incident Response

   • Logging of prompts, outputs, and system decisions.
   • Incident definition (e.g., hallucination leading to material harm, security breach).
   • Vendor SLAs for fixes and communication.

4.2 Sample AI-specific SOW clauses for Arizona agencies

Below is sample language to adapt (not legal advice):

• Scope of Work:
  “The Contractor shall design, implement, and operate an AI-assisted document summarization and retrieval system for [Agency], using agency-provided documents classified as [classification]. The system shall provide recommendations to human staff and shall not autonomously issue determinations affecting eligibility, adjudication, or enforcement actions.”

• Human-in-the-loop requirement:
  “AI-generated content or recommendations shall be treated as advisory only. Agency personnel shall retain full authority and responsibility for final decisions. The Contractor shall implement controls to ensure no AI output directly triggers case changes without recorded human approval.”

• Data and training rights:
  “Agency data, including prompts and outputs, shall remain the exclusive property of the Agency. The Contractor shall not train or fine-tune foundation models on Agency data for purposes other than delivering the contracted services, unless explicitly authorized in writing.”

• Evaluation phase:
  “The Contractor shall support a pilot evaluation phase of at least [X] weeks, using representative workloads, during which the Agency will measure accuracy, latency, usability, and risk indicators. Progression to full deployment shall be contingent on Agency acceptance criteria defined in Attachment [Y].”

Align your SOW depth to the complexity of the project; high-risk or CJIS workloads should have more detailed technical appendices.

---

Step 5: Design AI Vendor Evaluation Criteria for Arizona Governments

Traditional RFP scoring (price, references, basic functionality) is insufficient for AI.

5.1 Technical evaluation criteria

Include at least:

• Model performance on realistic tasks
  • Agency-provided test datasets.
  • Measured accuracy, hallucination rate, and coverage.
• Robustness and bias testing
  • How the vendor tests against demographic or topic bias.
  • Ability to tune prompts or policies to Arizona-specific requirements.
• Architecture fit
  • Support for retrieval-augmented generation using your document repositories.
  • Integration with existing identity management, case systems, and logging tools.
• Security and compliance posture
  • FedRAMP/StateRAMP status, CJIS commitments where relevant.
  • Documented mapping to NIST controls.

Arizona agencies that plan to use AI agents or multi-step workflows should also address agent observability and control, similar to patterns in /insights/agentops-observability and /insights/agentic-deployment.

5.2 Non-technical criteria

• Public-sector experience
  • Prior work with U.S. states, counties, or cities.
  • Experience with records retention, discovery, and open records obligations.
• Transparency and documentation
  • Clear data-flow diagrams.
  • Policy documents for error handling and user training.
• Change management and training
  • Curriculum for staff.
  • Support for initial and ongoing training.

5.3 Weighted scoring

Consider a weighting scheme such as:

• 30–40% Technical solution and security
• 25–35% Implementation and change management approach
• 20–30% Cost (including long-term consumption)
• 10–15% Vendor experience and risk

This keeps AI and security quality from being overshadowed by headline license pricing.

---

Step 6: Plan Staffing Models and Delivery Structures

Even the best SOW will fail if you do not have the right people to implement and operate AI systems.

6.1 Core roles Arizona agencies should plan for

Minimum internal team:

• Product owner / program lead: defines outcomes, resolves tradeoffs.
• Business analysts / subject-matter experts: encode policies and workflows.
• Security and privacy officer: continuous oversight.
• Technical liaison / AI lead: coordinates with vendor and reviews designs.

On the vendor or partner side:

• Forward-deployed AI engineers: embed with your program to integrate AI into existing systems and workflows. (See /insights/forward-deployed-engineers-for-government for this model.)
• ML/LLM engineers or solution architects: design RAG pipelines, evaluation harnesses, and scaling approaches.
• Data engineers: connect data sources, clean records, and manage access control.

Gain America frequently supports Arizona-like agencies by staffing:

• Forward-deployed AI engineers who work alongside case workers and IT.
• RAG and MLOps specialists to turn pilots into production-grade systems.
• AI governance and evaluation experts to align with NIST AI RMF, CJIS, and FedRAMP baselines.

6.2 Staff augmentation vs. traditional IT consulting

Traditional IT staff augmentation and times-and-materials work often underestimates:

• Prompt engineering and guardrail design
• Continuous evaluation and monitoring of AI behavior
• Specialized model and GPU operations

For AI projects, many agencies adopt a hybrid model:

• Use AI-focused staff augmentation (e.g., from specialized firms) for forward-deployed AI engineers and LLM ops. See /insights/ai-staff-augmentation-vs-it-staff-augmentation-government.
• Use traditional systems integrators for broader integration and project management.
• Retain a small, permanent internal team to own AI product roadmaps long term.

This staffing pattern maintains flexibility across FY25–26 budgets while giving your agency access to scarce AI skill sets.

---

Step 7: Move from Pilot to Production With Controls and Monitoring

By 2026, Arizona agencies will be judged not just on whether they “do AI,” but whether they operate AI safely and reliably in production.

7.1 Define clear “exit criteria” from pilot

In your SOW and internal plans, specify:

• Quantitative metrics (accuracy, time saved, error rate reduction).
• Qualitative feedback (staff satisfaction, training needs).
• Risk thresholds (acceptable hallucination rates with human oversight).

Only authorize broader rollout when:

• Metrics are consistently met over a meaningful period.
• Staff feel confident using and supervising the system.
• Security and audit teams confirm logging and access controls.

7.2 Implement continuous monitoring and evaluation

AI systems change over time as:

• Models are updated by vendors.
• Your documents and data evolve.
• Policies and laws change.

Your production checklist should include:

• Automated evaluation jobs on a fixed test set of cases or prompts.
• Drift detection for model performance over time.
• Audit logs that capture prompts, outputs, and user actions.
• Regular review meetings involving program, IT, and security.

Arizona agencies that adopt AI agents or complex workflows should treat agent operations (AgentOps) similarly to application monitoring, as discussed in /insights/why-ai-agents-fail-to-reach-production.

---

Step 8: Align With FY25–26 Budget and Contracting Cycles

AI procurement must fit within Arizona budget and contracting realities.

8.1 Phased contracts and options

Structure your SOW with:

• Phase 1: Discovery and design
  • Finalize requirements, data flows, and governance.
• Phase 2: Pilot implementation
  • Limited scope but production-grade controls.
• Phase 3: Scale-out and optimization
  • More users, departments, or jurisdictions.

Use options for later phases so you can commit current FY funds while preserving the right to expand later.

8.2 Multi-jurisdiction and shared services

Arizona cities, counties, and special districts can often:

• Leverage state contracts or co-op purchasing agreements.
• Share AI platforms across jurisdictions with tenant isolation.
• Pool funding for common workloads (e.g., knowledge assistants, document processing).

When designing your RFP, explicitly note if:

• Other jurisdictions may ride the contract.
• The solution should support multi-tenant or multi-agency operations.

---

Arizona AI Procurement Checklist for 2026 (Summary)

Use this condensed checklist as a working tool inside your agency:

1. Governance & Strategy

   • Create AI working group with program, IT, security, legal, procurement.
   • Adopt NIST AI RMF and NIST 800-53 as baseline frameworks.
   • Define AI risk tiers and oversight expectations.

2. Use Cases & Data

   • Inventory candidate AI use cases with business value.
   • Classify data: public, internal, sensitive, CJI.
   • Prioritize 1–3 assistive, human-in-the-loop use cases for 2026.

3. Hosting & Compliance

   • Decide cloud vs on-prem vs hybrid for each use case.
   • Determine need for CJIS, FedRAMP, StateRAMP.
   • Document data residency and encryption requirements.

4. RFP & SOW

   • Add AI-specific sections: functional, risk, data, evaluation, monitoring.
   • Include human-in-the-loop and data-use clauses.
   • Define an evaluation/pilot phase with clear acceptance criteria.

5. Vendor Evaluation

   • Score technical performance on realistic agency tasks.
   • Assess security, NIST alignment, and compliance posture.
   • Evaluate change management, transparency, and public-sector experience.

6. Staffing & Delivery

   • Identify internal product owner, SMEs, and security lead.
   • Plan for AI-specialized roles (forward-deployed AI engineers, RAG/LLM experts).
   • Decide on staff augmentation vs. traditional consulting blend.

7. Pilot-to-Production

   • Set quantitative and qualitative success metrics.
   • Implement monitoring, logging, and evaluation harnesses.
   • Formalize go/no-go criteria for broader rollout.

8. Budget & Contracting

   • Phase the contract (discovery, pilot, scale-out).
   • Use options for future capacity and new use cases.
   • Consider multi-jurisdiction use and shared services.

When Arizona agencies anchor AI procurement in governance, data classification, compliance, and realistic staffing, AI stops being a risky “moonshot” and becomes another disciplined part of digital transformation—one that can be funded, contracted, and audited like any other critical system.

This structured approach gives Arizona state, county, and city leaders a 2026-ready, procurement-centered roadmap for moving from scattered pilots to secure, compliant AI deployments that actually deliver value.