“Everything’s different and nothing’s different all at the same time.”
That is how U.S. General Services Administration (GSA) Chief Information Officer (CIO) David Shive describes the current moment in federal technology.
The foundation of the job remains familiar: Government still needs compute, memory, networks, devices, and dependable systems to serve the public. What has changed sharply, Shive said, is how federal technology leaders must deliver them – and how quickly they need to adjust.
For years, agencies have worked to improve federal technology incrementally. Shive believes that approach has produced meaningful progress, but it has not always kept pace with the world around it.
“Every once in a while, you have to stop, pause, and kind of rip the Band-Aid off,” Shive told MeriTalk in a recent interview. “Maybe not go in a whole new direction, but do things in a whole new way.”
He sees that opening now, as artificial intelligence (AI) reshapes how people interact with technology. At GSA, Shive’s answer is to draw on lessons from earlier disruptions, test aggressively, and stay committed to developing, operationalizing, and iterating on long-term strategies.
Pulling out the playbooks
AI may “suck all the oxygen out of every room,” Shive said, but its place at the center of the federal technology agenda is warranted.
He views AI as the third true technology disruption of his career – a shift on the scale of mobility and cloud.
“With AI, we suspected that this was going to be a big disruption, and so we pulled out our playbooks – the ones we used for mobility and the ones we used for cloud – and we’ve been applying them to AI as well,” Shive said. “It’s serving us very well.”
The reusable part of the playbooks show teams how to move through uncertainty: explore widely, measure what happens, concentrate resources, and build expertise on both sides of the government-industry partnership.
Exploring widely and then narrowing the field
GSA began its generative AI work with what Shive called “deep exploration,” prototyping more than 200 technologies across the agency’s broad business portfolio.
Then it stopped to analyze the results.
The team asked: “What’s proving value? What’s not proving value? Where should we make more wholesale investments … and where should we kill things that deserve killing?” Shive said.
Then GSA narrowed its focus to eight to 10 areas and shifted from exploration to full-scale implementation. The contraction gave internal teams time to build expertise and helped keep the agency from overwhelming industry partners whose capacity was also developing.
Shive said the aim was to keep government and industry from outpacing one another. The strategy has also produced governmentwide value. Some tools first built for GSA’s own use have become shared services, including USAi.
The USAi platform gives agencies access to configurable AI tools and helps them understand how those tools perform. Shive said GSA built telemetry into the platform so agencies can use usage and technology patterns to inform government requirements.
He also specified that each agency controls its own USAi environment, models, users, and risk decisions. “We’re just the infrastructure layer giving them these configurable tools,” he said. “GSA is not in the business of controlling that use for our partner agencies. We’re in the business of giving them the tools.”
Matching risk to the mission
Cybersecurity and risk management are essential components of GSA’s approach to AI. As AI expands the attack surface, Shive noted, it can combine individually low-risk weaknesses into more serious vulnerabilities.
“Anytime there’s a disruption, there are things you suspect are going to happen, and then there are the unknown unknowns,” Shive said. “People knew that there would be cybersecurity impacts with AI … [but] I suspect we’re not done finding out what those unknown unknowns are.”
Shive’s team is acutely focused on risk management.
Instead of applying an identical security, privacy, safety, and evaluation posture everywhere, GSA is matching controls to the business need and risk profile of each system.
Because Login.gov, the Federal Risk and Authorization Management Program (FedRAMP), and internal financial systems do not carry the same mission, users, or consequences, we shouldn’t apply a uniform standard, Shive explained.
“It’s complex, it takes more time, but you generate better 21st-century business outcomes,” he said.
Simplifying before rebuilding
For Shive, some of the hardest federal technology problems boil down to regulations.
As regulations accumulate over time, agencies translate those rules into business processes, then build systems that mirror the resulting complexity. “That has created this kind of like spaghetti web of regulation,” he said.
Modernizing only the system can leave the underlying problem untouched.
“The easy thing is to say, well, let’s refactor the systems so they run better,” Shive said. “That’s not the right thing. The right thing is to say, let’s deregulate, simplify regulation, because then modifying the business layer on top of that is actually pretty easy.”
Shive pointed to the Revolutionary Federal Acquisition Regulation (FAR) Overhaul as an example of starting at the source. The governmentwide effort is removing outdated requirements and rewriting the FAR in plainer language. Once the regulatory layer is simpler, he said, agencies can revise the business processes and systems built on top of it in weeks or months rather than years.
He sees similar opportunities in financial management, human capital, and other highly regulated functions. Simplification could make federal systems less bespoke and easier to align with lean commercial practices – without asking technology to compensate for every layer of accumulated policy.
Staying long enough to deliver
The thread connecting GSA’s effectiveness is continuity. Shive joined the agency’s Office of the CIO in 2012 and has had time to see strategies through multiple technology and policy cycles.
“We can trace a lot of GSA’s success to … being able to develop a coherent strategy, operationalize that strategy, and then iterate on that strategy when things change,” he said.
Shive pointed to GSA’s long-term performance on MeriTalk’s Federal Information Technology Acquisition Reform Act (FITARA) Scorecard as one result. The record, he argued, reflects more than one CIO. Technologists, executives, managers, and supervisors have stayed long enough to understand the work, carry out a strategy, and revise it as business priorities and enabling technologies change.
By contrast, Shive said the typical 18- to 20- month tenure of federal CIO roles can be “highly destructive to running good government.” Leaders arrive, establish direction, and often leave before the institution can fully operationalize or refine it.
His appeal to the next generation is straightforward: Come to government and stay long enough to make the work count.
“This would be the most rewarding part of your career,” Shive said. “The ability to have an impact on the people in your community, however you define community, is unparalleled.”
That staying power matters even more in a period full of unknown unknowns. While Shive sees uncertainty ahead, especially as AI reveals new capabilities and risks, he also sees a rare opening.
“There’s so much opportunity to move things forward at super-high velocity and super-high quality,” he said. “As a community, let’s not let that opportunity pass us by.”