AI Leadership in 2026: Governance Is Table Stakes, Delivery Is the Job

What actually changed in federal AI policy — and what didn’t?

It’s worth being precise and even-handed here, because the policy shift is easy to over-read. In January 2025, Executive Order 14179 revoked the prior administration’s EO 14110; in April 2025, OMB issued M-25-21 (“Accelerating Federal Use of AI through Innovation, Governance, and Public Trust”) and M-25-22 (on AI acquisition), rescinding the earlier M-24-10 and M-24-18; and in July 2025 the White House released “Winning the Race: America’s AI Action Plan.” What changed was posture and mechanics: a more explicitly pro-innovation tone, a Buy-American preference in procurement, and a consolidation of the old “rights-impacting” and “safety-impacting” categories into a single “high-impact AI” tier — which still carries mandatory minimum practices like pre-deployment testing, impact assessments, ongoing monitoring, human oversight, and the ability to pause or discontinue a non-compliant system. What stayed is more striking than what changed: every covered agency still must have a Chief AI Officer, an AI governance board, a public AI strategy, and an annual use-case inventory. The honest read, across the EO 13960 → M-24-10 → M-25-21 arc and both administrations, is that the governance architecture is recognizably continuous. That’s the point. When the scaffolding is universal, having it is not leadership.

If governance is universal, where’s the bottleneck?

In delivery — and the evidence is consistent. The GAO has documented federal AI use cases nearly doubling in a year (from 571 to 1,110 across selected agencies) while finding that agencies “had to figure out how to acquire AI on their own,” with none of the four it studied requiring systematic capture of acquisition lessons learned. Industry research tells the same story from the other side: ICF’s 2025 government survey found that while 41% of agencies are running AI pilots, only about 8% have reached scaled, measurable deployment, and MIT’s widely-cited “GenAI Divide” study reported that roughly 95% of enterprise AI pilots delivered no measurable bottom-line impact — failing not on model quality but on the “messy middle” of data, integration, and change management. The VA’s own inventory makes it concrete and a little bracing: of 227 use cases in 2024, 72 were marked retired in the 2025 inventory. That ruthless deprecation is a healthy sign — it’s what an organization that’s actually trying to ship looks like. The lesson for anyone claiming to lead: the model is rarely the constraint. Working software is.

What does responsible AI leadership actually look like in practice?

Six concrete things — none of which fit on a strategy slide.

1. Honest scoping. Refuse to call something “AI” when a deterministic rules-engine is the right tool, and refuse to ship anything without a defined kill-criterion.
2. Human-in-the-loop by default. The ambient scribe drafts the note; the clinician edits and signs it. Automated decision support assists the claims processor; it does not deny the claim. REACH VET flags risk; a human does the outreach. The principle is constant: the human stays in control, and the consequential decision stays inside the VA.
3. Governance documentation as a first-class artifact — impact assessments, monitoring plans, and discontinuation criteria are how trust is built and audited, covered in the M-25-21 spoke.
4. Bounded scope. A 90-day fixed-scope build with a real “scale, re-scope, or kill” decision at day 90 beats a 24-month strategy engagement on every dimension that matters to the mission.
5. Knowing what not to build. The clearest test of AI leadership in 2026 is the maturity to say: this is a sensitive domain — suicide prevention, crisis triage, benefits and clinical decisions — and the bar is augment a trained human, never replace one. The REACH VET evidence is the case study: associated with measurable process improvements and a modest reduction in documented suicide attempts in the 2021 evaluation, but without a demonstrated statistically significant reduction in suicide deaths, and with later analyses flagging low predictive precision. Honest leaders state that evidence plainly rather than overselling it.
6. Equity and bias auditing as leadership work. Reporting on REACH VET’s earlier model found it weighted some demographic combinations and omitted risk factors disproportionately affecting women veterans — the kind of finding that should inform every high-impact deployment, not surface in a post-mortem.

Why does this favor small, technical, veteran-owned firms?

Because delivery culture is the part of AI work that strategy decks can’t pre-cook — and because the structural tailwinds are real. The FY2024 NDAA raised the governmentwide SDVOSB goal from 3% to 5% and ended self-certification for goal credit; SBA cleared its 2,700-case VetCert backlog in November 2025 and cut average processing from 81 days to 12; and the VA’s Veterans First priority (38 U.S.C. 8127) puts SDVOSBs at the top of its set-aside order — the VA awarded about 23.6% of its prime dollars to SDVOSBs in FY2024, versus roughly 5% governmentwide. And the AI work is genuinely flowing to veteran-owned firms: Rise8 (an SDVOSB) and Thoughtworks Federal were awarded the contract in March 2026 to scale the VA’s ambient scribe from a 10-site pilot to more than 130 medical centers, and the Oddcore SDVOSB joint venture won a ~$15M VA.gov AI chatbot task on SPRUCE. The honest caveat — the one running through this whole cluster — is that small firms rarely prime the megaprograms; they win by priming bounded, accountable work and subbing on the capability-heavy task orders under T4NG2 and other primes. Leadership at that scale isn’t measured in ceiling value. It’s measured in what reaches production.

Myth versus reality: the 2026 scorecard

Working with Truvisory

A word on who’s saying this. Truvisory is a brand-new SDVOSB — solo technical founder, combat veteran, Denver — SBA VetCert-certified.

A firm that new can’t credibly claim to lead the federal AI conversation on scale or decades of past performance, and we won’t pretend to. What a small technical firm can lead on is point of view, scoping discipline, and the practiced habit of shipping: working software, not strategy decks; fixed 90-day scopes; Cloudflare-native; FedRAMP-aware (not CMMC); bounded to use cases where the human stays in control. That ethos is itself the argument. The VA’s AI estate in 2026 doesn’t need more strategy — it has a strategy, a CAIO, an inventory, and 367 use cases. It needs disciplined delivery against the strategy that already exists. If that’s the kind of partner you’re looking for — to sub on a task order or ship one bounded capability — that’s the work we do. And if you want the rest of the map, start at the pillar: the compliance trilogy, the capability spokes, the vehicles and teaming, and the BD how-tos — the capability statement, forecasting, events, and the buyer map.