AI for GovCon BD, Part 2: Using AI Safely on Government Work, and Building Your Own

/in /by

By Matt Simonson, Senior Product Marketing Manager – Unanet 

In Part 1, we covered when a general AI tool is good enough for GovCon business development, and when you need a purpose-built capture platform. This time we’re answering the question that stops most contractors before they start: can I actually use AI on government work without creating a problem? 

Short answer: yes, for most of what your BD and proposal teams do every day. The longer answer depends on one thing, the kind of data the AI is touching. That’s the whole game, and it’s simpler than the acronym soup makes it sound. 

This post lays out the what and the why. Which kinds of GovCon work are safe to run through AI, why the rules exist, and what to do when the work is sensitive enough that you can’t send it to a cloud service at all. We’ll finish with a plain-language walkthrough of building your own in-house AI, the option most people assume is out of reach and isn’t. 

It comes down to the data, not the tool 

Here’s the one idea to hold onto: an AI tool takes on the same handling rules as the information you put into it. Feed it public information and you’re free to use almost anything. Feed it sensitive government information and that tool now has to meet the same standards your contract already requires of you. 

So the right question is never “is this AI tool allowed?” It’s “what am I about to put into it?” 

A simple way to sort your work into three buckets: 

  1. Public, market-facing work. Researching agencies, tracking opportunities, drafting outreach, summarizing public solicitations. This is the bulk of BD, and almost any reputable AI tool is fine. Nothing sensitive is going in. 
  1. Controlled but unclassified work. Draft proposals, pricing, anything marked CUI (Controlled Unclassified Information, the government’s label for sensitive-but-not-classified material). This needs an AI service that’s been authorized for government data and is covered under the right contract terms. A consumer LLM is not that.  
  1. Classified work. Secret and above. This never goes into a tool you stood up yourself. It runs only inside the customer’s approved, walled-off environment, using whatever AI they’ve authorized. 

You don’t need to memorize the regulations behind this. You need to know which bucket a task falls in before you open an AI tool. Build that habit and you avoid almost all of the trouble. 

The one mistake to watch for is “shadow AI,” someone pasting a draft proposal full of sensitive data into a free chatbot because it was faster. That’s the compliance problem nobody meant to create. It’s a people-and-policy fix, not a technology one: make sure your team knows the buckets. 

The government already settled the “is AI safe?” debate 

If your team is still hearing “AI is too risky for government work,” that argument is over, and you can say so with a straight face. 

Over the past year the government moved aggressively to adopt AI itself. It launched a platform called GenAI.mil that put commercial AI on the desktops of roughly 3 million service members, civilians, and contractors. In 2026 it expanded that platform to handle Secret and Top Secret work, with several major AI vendors approved to operate at those levels. 

The takeaway for you isn’t the platform, it’s the signal. The government is training its own people, your customers, on what good AI-assisted work looks like. When your buyer uses AI every day, “we don’t use AI” stops sounding cautious and starts looking like a gap. The pressure now is to show fluency, not to prove it’s safe. 

When you actually need your own AI 

For most BD and proposal work, a properly chosen cloud AI service is the right answer and far less hassle. You’d only reach for your own in-house setup in specific situations: 

  1. You handle ITAR, IL-6, IL-7 or other export-controlled technical data that legally can’t leave U.S.-controlled systems. 
  1. A customer or contract explicitly forbids sending their data to any outside cloud. 

“On-prem” (short for on-premises) means the AI runs on hardware you own and control, with nothing leaving the building. No data goes to OpenAI, Anthropic, Google, or anyone else. That’s the whole appeal: the information never crosses your walls. 

The good news is that the open-source AI models you can run yourself have gotten genuinely capable. A few years ago this meant a real drop in quality. Today it’s a reasonable tradeoff for the control you get. 

How an on-prem setup actually works (the plain version) 

You don’t need to be technical to understand the shape of it. Picture three pieces: 

  1. The model. The “brain.” An open-source AI model (names you’ll hear: Llama, Qwen) that runs on your own machine instead of in the cloud. A free tool called Ollama is the common way to run one locally. This is not only a secure way of incorporating AI into sensitive proposal work, but it’s also a cheaper way since you will not be spending the same amount on tokens as you would with a frontier model/API connected provider.  
  1. The library. Your AI is only useful if it can reference your material, past proposals, capability statements, agency research. That document store, plus the plumbing that lets the AI search it, is the “library.” 
  1. The interface. You can go with the simple chat window your team is used to, but proposal work is long and the process you complete it in should help you ensure all proposals are compelling and compliant. That’s where a purpose built workflow for proposal work comes in.  

Now the part that surprises people. You can use a powerful cloud AI to build the in-house system, then unplug it. Building and running are two different phases: 

  1. Building it. A developer (yours or a contractor) uses a cloud coding assistant like Claude Code to assemble the pieces: wire up the model, connect the library, build the interface. This happens on a normal computer with an internet connection. The one firm rule: during the build, use only fake or sample data, never real sensitive material. 
  1. Running it. Once it’s built, the finished system is deployed onto a machine that’s walled off. From there it runs entirely on its own. No internet, no outside calls. The cloud AI that helped build it is gone from the picture. 

That’s the move most people miss. You get top-tier AI help while you’re building, and you ship something that operates completely on infrastructure you own. 

What you’ll need, realistically: 

  1. A capable machine. A workstation or small server with a strong graphics card (GPU). This is the real hardware cost, so budget for it. 
  1. A technical person. This is not a no-code weekend project, but it’s far more achievable than “build our own AI” sounds. One capable developer, or a small technical partner, can stand up a working version. 
  1. Someone to keep it running. Models get updated, security patches come out, the system needs care. Plan for ongoing ownership, not a one-time build. 

The honest tradeoffs 

  1. Open-source models are very good, but the absolute best capability still lives in the big cloud services. For sensitive work that can’t leave your walls, that’s a fair trade. For everyday BD, it usually isn’t worth giving up the convenience. 
  1. You own everything: the upkeep, the security, the updates. A cloud vendor handles all of that for you. On-prem, that’s your job. 
  1. If the system touches regulated data, it has to be formally reviewed and approved before use. That’s a real process, and the machine running the AI is what gets examined, not the laptop it was built on. 
  1. It’s overkill for most of what BD and proposal teams do. Reach for it only when the data genuinely can’t go to the cloud. 

Bottom line 

For the vast majority of GovCon BD and proposal work, you can use AI today, safely, through a properly chosen cloud service. The skill isn’t avoiding AI. It’s matching the tool to the sensitivity of the data, and building the habit of checking that before you hit enter. 

When the work is sensitive enough that nothing can leave your walls, an on-prem setup is a real, reachable option, not a moonshot. Build it with cloud help, run it disconnected, and you keep both the capability and the control. 

Either way, the contractors who win the next few years will be the ones whose teams are already fluent. Your customers already are.