Ex-VA FOIA Chief: FedRAMP Gate Is Slowing Federal AI Adoption

Three AI categories already operational

Sarich, a 2025 Fed100 IT Winner, says the AI tools that work in FOIA today are those that solved a real workflow problem at scale. He names three categories that he describes as operational now, not experimental: FedRAMP-authorized generative AI for review and summarization, predictive coding for exemption-likelihood scoring, and clustering for related-records identification.

He calls the first the most consequential recent milestone. In his view, Everlaw's FedRAMP authorization gave federal agencies a path to AI-assisted document review without an exception process, shifting the conversation from whether to try it to how fast to deploy it. Note that the interview is published on Everlaw's own blog. Sarich says clustering finds connections in big document sets that human reviewers will miss, and he calls these tools the operational baseline for any agency processing at scale.

Looking ahead, he is most interested in agentic FOIA, where AI moves requests through the pipeline within defined guardrails while humans stay in the loop on the decisions that matter. Done right, he says, it is not a 10% productivity gain but a structural change in how a FOIA shop operates. He also points to LLM-assisted scope dialogue, better OCR and handwriting recognition for legacy paper records, and an expected convergence of records management and FOIA platforms.

Why Sarich says the FedRAMP gate is falling behind

Asked whether the current authorization process is sufficient, Sarich separates security from innovation. He says the gate is working as a security baseline, which matters because agencies hold some of the most sensitive personal information in the country. But he says it is failing as innovation infrastructure, with the cost landing on agencies and not only on vendors.

He lists two structural problems:

• Cost: a FedRAMP High authorization runs north of two million dollars and takes between 12 and 18 months, which startups cannot absorb. Sarich says this gates innovation by capital, not by capability.
• Sponsor-agency dynamics: vendors with existing federal relationships get a head start unrelated to product quality, leaving agencies with a vendor pool narrower than the actual market.

The deeper issue, he says, is speed. FedRAMP was designed for an era when enterprise software shipped major updates quarterly, while frontier AI models now ship significant capability updates weekly. Agencies end up authorized to use last year's AI while the commercial market is two years ahead, and he argues the public bears the cost.

His proposed fix is tiered, modular authorization that preserves the security envelope while letting underlying model components update faster. He calls FedRAMP 20x the right direction and says it needs to land.

FOIA University and what makes a strong leader

Sarich says FOIA has training but no core curriculum. FOIA University has three levels, and the first track is meant to let someone walk into a FOIA shop with full confidence. He says a lack of confidence slows FOIA the most, noting that he did not know anything until he had handled his first 200 cases and was slow. With headcount dropping, he says, agencies no longer have that time.

He names three leadership qualities, in order of how often they are overlooked:

• Operational fluency: having actually processed requests, plus enough familiarity with modern tools to judge their limits, set realistic timelines and defend processing decisions to litigators.
• Coalition-building: FOIA touches legal, records, IT, communications and every program office, so leaders need standing relationships across those silos, including with IT and procurement.
• Political resilience: leaders are squeezed by requesters wanting more and leadership wanting less drama.

A smaller next generation and a more modern process

Sarich says a new generation is coming up, but it is smaller than it should be. Workforce reductions hit FOIA shops hard, and the Deferred Resignation Program removed a layer of mid-career practitioners who would have mentored newcomers. Institutional knowledge was lost that he says will not come back easily.

His advice has four parts: get credentialed, build a network outside your agency, learn the tools including ones your agency does not use yet, and find a mentor who is not your supervisor. As he puts it, the supervisor knows your job, while a mentor knows your career.

On modernization over the past year, he says AI-assisted review is FedRAMP-authorized on multiple platforms and within procurement reach. Requester portals have gone from a handful of leading agencies to an expected baseline, and vendor accountability infrastructure has matured. The published text breaks off while discussing the NexGen showcases, so his remarks on remaining gaps are not included here.