Frontier Artificial Intelligence (AI) has been purchased as a subscription, with deployment handled by the enterprise's own team or its existing systems-integration contracts. OpenAI's Deployment Company, launched May 11 with 19 global partners and a $4 billion fundraise, makes OpenAI a services counterparty inside enterprise operations. The simultaneous acquisition of Tomoro brings 150 forward-deployed engineers into OpenAI's operating structure, making this a consulting-firm launch inside an AI lab wrapper.
Three procurement objects change: the Master Services Agreement (MSA) with any existing OpenAI engagement needs a clause distinguishing the Deployment Company as a separate data processor; the approved-vendor list needs re-scoring to account for partner commercial relationships; and a data-processing addendum (DPA) review is needed before embedded engineers access production data. Ask your General Counsel this week: does the Deployment Company structure create new data-protection obligations under your current OpenAI contract?
The measurement architecture built for AI deployments rarely matches what a Chief Financial Officer (CFO) or internal audit team needs to assess business value. The AI Operations Report 2026, produced by Coastal and Oxford Economics from a survey of 800 US business and technology leaders (self-reported methodology; no independent validation), finds 74% are increasing AI investment while 46% report their initiatives have not met expectations.
Three controls are absent in most programmes: a standardised measurement framework for AI-attributed business outcomes, an internal audit mechanism aligned to production deployments, and a FinOps discipline tracking cost-per-outcome rather than cost-per-token. Ask your FinOps and internal audit leads this week: for the three largest AI deployments in production, what is the cost-per-measurable-outcome, and is that number in the next board update?
Enterprise vendor risk registers have treated compliance readiness as binary: a vendor either meets data-protection requirements or it does not. Voluntary government inspection agreements introduce a second evaluation axis that procurement teams have no current framework to score.
Microsoft, Google, and xAI signed agreements with the Center for AI Standards and Innovation (CAIS) at the US Department of Commerce between May 5 and 8, granting pre-release model evaluation rights covering national security and public safety. No equivalent agreement has been confirmed from Anthropic or Meta as of May 12. Add CAIS participation as a scored criterion to your vendor risk review and RFP template before the next procurement cycle. Ask Enterprise Risk and Procurement this week: which lines of business should require pre-launch government testing as a threshold for contract award?