The AI Inventory Problem You're Not Solving (But Your Competitors Are)

By WALLY ANGEL, ROSE FINANCIAL SOLUTIONS

Here's the uncomfortable truth most GovCon CFOs won't say out loud: your employees are already using AI tools. The question isn't whether AI is part of your operations—it is. The question is whether you know which tools, where, and under what governance. That gap is a competitive liability.

The Competitive Reality

Let me be direct. If you're running a government contracting firm without using AI tools, you're losing bids to competitors who are. Full stop. The math is brutal. A proposal team using AI for compliance matrix generation cuts turnaround from 40 hours to 8. A finance shop using AI for indirect rate modeling runs scenarios in minutes instead of days. Your competitors aren't waiting for perfect policy, they're deploying tools and winning contracts while you debate.

But here's where it gets complicated for GovCon specifically: the same tools giving you competitive advantage create exposure you may not see coming.

The Two-Layer Problem

Most executives think of AI adoption as a single issue, employees using ChatGPT or similar tools. That's layer one, and yes, it's happening across your organization whether you've approved it or not. A 2024 Salesforce survey found 55% of employees have used AI tools at work without explicit approval. In my experience with GovCon clients, that number is higher. But there's a second layer most firms miss entirely: vendor dependencies.

Your ERP system? Likely has AI capabilities embedded or planned. Your cybersecurity tools? AI-driven threat detection is standard now. Your cloud provider, your project management platform, your timekeeping system, many now incorporate AI models from third-party providers.

Here's a real scenario: Palantir's government platforms use Anthropic's Claude. If you're a subcontractor using Palantir-based analytics for a DoD program, you have downstream exposure to Anthropic's AI models. Do you know that? Does your security officer? Does your contracting officer?

When DoD issues guidance restricting specific AI vendors or requiring disclosure of AI dependencies, you'll need to answer fast. The firms that have this inventory ready will respond in hours. The firms that don't will scramble for weeks.

The CMMC Angle You're Missing

CMMC 2.0 codifies what good security practices already demanded: know your assets. The Asset Management (AM) controls in NIST 800-171 require organizations to inventory and control assets throughout their lifecycle.

Here's the gap: those controls were written assuming you know what your "assets" are.

When your Marketing Director signs up for an AI writing tool using a corporate card, that's an asset touching your data. When your subcontractor deploys AI-based analytics on shared project data, that's a dependency affecting your authorization boundary. When your accounting system vendor adds AI features in a quarterly update, that's a change to your technical architecture.

Most GovCon firms treat CMMC as a static compliance exercise. Smart firms recognize it as a living system that must account for AI proliferation. The firms that figure this out now will have cleaner audits and faster ATO cycles. The firms that don't will face remediation timelines that cost contracts.

What "Inventory" Actually Means

Let me be specific about what a functional AI inventory looks like for GovCon operations:

• Direct Tools: Every AI-enabled application employees access, including sanctioned tools (Copilot, approved AI assistants), shadow IT (personal ChatGPT accounts used for work), and embedded features (AI in your existing software stack).
• Vendor Dependencies: AI models and providers used by your technology vendors, contractual rights to change AI providers, and data handling practices for AI training.
• Data Flows: What organizational data touches AI systems, classification levels and CUI exposure, and consent and authorization documentation.
• Governance: Who approves new AI tools, how you evaluate vendor AI changes, and incident response for AI-related issues.

Most firms have pieces of this. Almost none have it systematized. That's the gap.

The Growth Positioning

Here's where this becomes a strategic advantage rather than just risk mitigation. Firms with clean AI inventories can scale AI adoption faster. When a new AI capability emerges, and they're emerging monthly now, you can evaluate and deploy because you understand your current state. You're not starting from scratch every time.

Firms with clean AI inventories negotiate better with vendors. When you know exactly what AI dependencies exist across your tech stack, you negotiate from knowledge, not assumptions. You ask the right questions in vendor reviews.

Firms with clean AI inventories win on trust. Prime contractors increasingly require AI transparency from subs. Agencies ask about AI in proposals. Being able to answer definitively, "Yes, we use these specific tools under this governance framework", differentiates you from competitors who hedge.

The Action Step

This isn't about stopping AI adoption. It's about knowing what you have, governing it properly, and positioning your firm to scale faster because you've built the foundation. Start with a basic inventory: catalog every AI tool your teams currently use, document your vendor's AI dependencies, and establish approval processes for new AI capabilities. Most importantly, assign ownership. Someone needs to own AI governance at your firm, and that ownership needs clear authority and accountability.

The GovCon firms that dominate the next decade will be the ones that figured out AI governance in 2026, not the ones that waited until DoD mandated it.

Wallace Angel

VP, Finance and Accounting, Client CFO

Wallace “Wally” Angel is a strategic CPA with more than 20 years of experience in the government contracting and consulting environments with companies ranging from start-ups to $800M. His government contracting expertise includes FAR and DCAA compliance, indirect rate calculation, forward pricing, proposal writing, pricing, and cradle to grave contracts management and system design and implementation. In his position as Partner, Financial Operations, Wally serves as a trusted advisor to the C-suite in controllership and cash management, revenue recognition, system design and implementation, and full financial planning and analysis.