The Small Business Administration spent more than a year with nearly all of its artificial intelligence work frozen — and it still hadn't told the public which AI systems it uses, six years after Congress first required that disclosure. That's not a contradiction buried in a footnote. It's the headline finding of a new Government Accountability Office report, and if you bid on federal contracts or chase an SBIR or STTR grant, it's worth five minutes of your attention.
What GAO actually found
GAO-26-107828, "Artificial Intelligence: Uses and Risks for Small Business Contracting and Innovation Research," released May 4, 2026, looked at how the SBA and the network of federal agencies it oversees handle AI. The findings split into two threads.
The pause. In March 2025, the SBA froze essentially all AI activity so it could review compliance with federal executive orders and reset its priorities. As of GAO's April 2026 fieldwork, that freeze was still largely in effect — with one exception: seven pilot projects were allowed to keep running, testing security, performance, and value before any broader rollout resumes.
The transparency gap. Separately, federal law has required agencies to publicly report their specific AI use cases — what the system does, how it was built, how it was procured — since 2020. The SBA didn't publish its first such inventory until March 2026. GAO attributes the six-year delay to weak internal documentation processes and turnover in the staff responsible for reporting. GAO's recommendation was narrow and procedural: establish a formal policy that actually assigns who's responsible for compiling and publishing that inventory going forward. SBA agreed. As of the report, GAO lists the recommendation as still "Open," meaning it hasn't yet verified SBA followed through.
Underneath both findings, GAO also convened expert panels to map out where AI could plausibly help. The list is useful because it previews what's coming once the pause lifts: market research on which small businesses are capable of a given contract, faster proposal review, fraud detection across the volume of submissions agencies receive, data analysis of the reports agencies file with SBA, and drafting the annual reports SBA itself has to produce. The flip side — the risks GAO flagged alongside those uses — are the ones that should actually change what you do this week: inaccurate outputs, data privacy and security exposure, biased results, and a federal technical workforce that panelists said is too thin to properly vet any of it before deployment.
Zoom out one level and the SBA's freeze looks almost contrarian. Generative AI use across federal agencies broadly has grown roughly nine-fold since 2023. The SBA hit pause while most of the rest of government sped up — which means the systems evaluating your contract bids or grant applications at other agencies may already be leaning on AI today, even where SBA's own tools are still shelved.
Why this matters if you bid on federal contracts
Two of GAO's flagged use cases — market research and fraud prevention — touch you before you ever submit a word.
If an agency is using AI to identify which small businesses are qualified for a given opportunity, that system is only as good as the data it's pulling from. Your SAM.gov registration and your Dynamic Small Business Search (DSBS) profile are the record it reads. A stale NAICS code, an outdated capabilities narrative, or a certification that lapsed and never got renewed doesn't just look sloppy to a human contracting officer anymore — it can mean an algorithm never surfaces you as a match in the first place. GAO's own report notes that market research built on incomplete data risks excluding capable firms. Practically: review and refresh your SAM.gov and DSBS listings at least annually, and any time your certifications, past performance, or core capabilities change — not just when you happen to remember.
The second piece is about how you respond when something looks off. AI-assisted screening, wherever it's deployed, produces false positives and false negatives like any classifier does. If a proposal gets rejected or a bid outcome seems inconsistent with your past performance on similar work, don't assume the process was purely human and therefore error-free, and don't assume an automated flag is correct either way. Ask the contracting officer directly whether AI tools played a role in the evaluation, and request an explanation of the criteria used. That question is reasonable to ask today, and it will only get more relevant as SBA's paused tools come back online.
What it means if you're chasing an SBIR or STTR award
The timing here overlaps with a bigger structural change: the Small Business Innovation and Economic Security Act of 2026, signed April 13, 2026, reauthorized the SBIR and STTR programs through September 30, 2031, after a six-month lapse. Agencies are now required to track award types more precisely in federal procurement data — flagging direct-to-Phase-II awards, Strategic Breakthrough awards, and Phase III follow-ons, and referencing the originating SBIR/STTR contract number when a follow-on contract is recorded. That's more structured data flowing through the same systems GAO says could eventually get an AI layer for analysis and fraud prevention.
Two things follow from that combination.
First, on the application side: if AI-assisted proposal screening becomes part of how your Phase I or Phase II submission gets triaged, treat it the way you'd treat any automated first pass — assume a human still needs to see the full picture, and don't rely on formatting tricks or keyword stuffing to game a system that may not even be deployed yet at your reviewing agency. Write for the technical reviewer, not the filter.
Second, and more concretely: SBIR/STTR compliance already runs on documentation, independent of anything AI-related. Awardees are required to maintain contemporaneous timekeeping records showing how each employee's hours map to the funded research, keep subcontractor invoices and agreements consistent with the award's terms, and follow cost accounting standards under the FAR. None of that is new. What is new is the direction of travel: an agency ecosystem that's getting better at cross-referencing award data, adding fraud-detection tooling to its roadmap, and tracking follow-on contracts back to their original SBIR/STTR number. Clean, consistent records stop being just an audit-readiness best practice and start being the thing that keeps your file from standing out for the wrong reasons in a system built to spot anomalies.
Practical steps to take now
- Refresh SAM.gov and your DSBS profile at least once a year, and immediately after any change to certifications, NAICS codes, or past performance — treat it as live data an algorithm reads, not a form you filled out once.
- Keep a separate ledger or cost center per award. Commingled costs across contracts are the single most common finding in federal award audits, AI-assisted or not.
- Maintain contemporaneous timesheets for anyone charging time to a cost-reimbursement or time-and-materials contract — reconstructed-after-the-fact records are a recurring audit red flag.
- Reconcile subcontractor invoices against award terms monthly, not the week before a report is due. Consistency over time reads very differently to a reviewer — human or automated — than a pile of invoices assembled retroactively.
- Ask directly whenever a bid, proposal, or grant outcome seems inconsistent with your track record: was AI involved in this evaluation, and what were the criteria?
Keep Your Federal Contract Records Audit-Ready
Whether or not AI ends up screening your next proposal, the underlying discipline is the same one federal award compliance has always demanded: records that are complete, consistent, and easy to trace back to the source. Beancount.io offers plain-text, version-controlled accounting, so every entry — and every change to it — has a permanent, auditable history instead of living in a black box. Get started for free and keep your books as defensible as your proposals.