NewsAI regulationCloud securityPublic sector

FedRAMP 20x: First full 'Class C' certification for an AI provider

Perplexity is, according to FedRAMP, the first company to meet the fully accelerated 20x process in Class C. FedRAMP says more certifications are on the way.

First full FedRAMP 20x Class C certification (Perplexity)

FedRAMP 20x: First full 'Class C' certification for an AI provider

Perplexity has become the first provider to receive a FedRAMP "Class C" certification that fully complies with the new rules and the accelerated "20x" process. FedScoop reports this, citing several announcements from the past week. According to the source, Class C is most closely aligned with FedRAMP's old "Moderate" level and is the most common class in the marketplace.

Background

The certification complies with the FedRAMP Consolidated Rules for 2026, which were released over the summer together with the opening of the 20x pipeline. According to a FedRAMP blog, the first 20x Class C certification marks the real start of the effort to significantly expand the marketplace of cloud services available to federal agencies. Security capabilities are increasingly assessed through outcome-based "Key Security Indicators" rather than purely narrative descriptions.

According to the blog, there are now seven "Class A" certifications, a new entry-level tier that has been rolling out since August. Twelve "Class B" certifications are in the pilot phase, including Google Gemini for Government and Flock Safety. OpenAI's ChatGPT and Filevine hold pilot Class C certifications, as do about a dozen others. According to the source, nearly 100 products have started the certification process, including offerings from Anthropic and Cisco.

What the certification concretely enables

Perplexity's certification allows the General Services Administration and the Department of Agriculture to use the Perplexity Enterprise and API Platform. According to the company blog, it brings live web search and source-cited answers into the certified environment. The company describes itself as an American company.

Assessment

For companies outside the US federal government, FedRAMP is not directly binding. However, those selling cloud AI services to US agencies, or using such security evidence as a benchmark, could benefit from the outcome-based assessment if the requirements prove workable in practice. It remains open how quickly the announced further certifications will follow; FedRAMP itself describes a long road to thousands of products.

Sources

Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.

Share
← All articles

All analyses are based on i6eal's own measurements or on clearly labelled sources. Figures are snapshots and may change; corrections are disclosed transparently.