Security Software
Sourcing Guide & Market Intelligence

The European Union’s Artificial Intelligence (AI) Act enters into force

• In August 2024, the European Union (EU) began enforcing its new regulation on artificial intelligence. Although EU legislation, the act will have a major effect on global technological companies operating in the AI space, similar to the General Data Protection regulation.
• The legislation aims to apply a risk-based framework to AI regulation, meaning different AI applications will be treated differently. The law applies a general ban for “unacceptable” uses, such as social scoring and predictive policing.
• For general-purpose AI models, companies will be required to comply with EU copyright law and intellectual property provisions, carry out regular testing, issue transparency disclosures, and implement adequate cybersecurity protections. For “high-risk” AI applications, such as autonomous vehicles, medical devices, financial services, and biometric identification systems, companies must meet stricter requirements in terms of risk-mitigation systems, documentation, human oversight, and cybersecurity.
• Companies that breach the AI Act may face fines ranging from 7.5 million euros or 1.5% of global annual revenues to 35.0 million euros or 7.0% of global annual revenues, whichever amount is higher.
• While the blanket ban on unacceptable systems entered into force in February 2025, most of the obligations do not take effect for a full year. In August 2025, requirements for general-purpose AI will come into effect, and in August 2026, obligations for high-risk AI systems will be enforced.

GSA memo asks agencies to review consulting contracts

• The General Services Administration (GSA) recently issued a memorandum asking government agencies to review their consulting contracts with the ten highest-paid firms. The ten firms are Accenture PLC (Accenture Federal Services), Booz Allen Hamilton Inc., CGI Group Inc. (CGI Federal), Deloitte Touche Tohmatsu (Deloitte Consulting), General Dynamics Corporation (General Dynamics IT), Guidehouse Inc., Huntington Ingalls Industries Inc. (HII Mission Technologies), International Business Machines Corporation (IBM), Leidos Holdings, Inc., and Science Applications International Corporation, Inc. (SAIC).
• The memo states that agencies are strongly encouraged to cut non-essential consulting contracts, providing a list of those intended to be terminated by March 7, 2025. By April 19, 2025, agencies must submit their reviews of non-GSA consulting service contracts.
• According to the GSA, the ten consulting firms identified are set to receive $65.0 billion in fees in 2025. The Department of Defense (DoD) has stated its intention to terminate or descope contracts non-essential to the DoD’s purposes; some of the largest market players with high-value DoD contracts include Booz Allen Hamilton, Deloitte, and Accenture.
• According to the Government Accountability Office, in the fiscal year 2023, government agencies spent $478.0 billion on services, with the DoD accounting for $230.0 billion and non-defense agencies accounting for the rest. The DoD spent $21.3 billion on support, professional, and engineering and technical services, while non-defense agencies spent $21.4 billion on professional services, which includes consulting, training, and support services.
• The Department of Veterans Affairs (VA) initially cancelled 875 contracts (amounting to around $2.0 billion) but has currently paused efforts. However, contract terminations across most agencies are expected to continue.

The DOJ proposes Google breakup in latest tech antitrust action

• In August, Google was found guilty of operating as a monopoly and engaging in anti-competitive practices through the operation of its search engine business.
• In response to this ruling the Department of Justice (DOJ) has stated it will seek a breakup of Google’s business segments, among other similarly harsh penalties. While the actual penalty Google receives must be approved by the judge, the DOJ’s proposed penalties signal a zero-tolerance policy toward tech monopolies.
• During the last few years, the Federal government has significantly increased its enforcement actions against major technology companies in an effort to contest the high level of market share concentration in this sector.
• These actions include high-profile anti-trust lawsuits against Amazon, Apple, and Meta, in addition to the case against Google. Consequently, the results of these lawsuits could significantly affect the structure of a wide range of tech markets.