FedRAMP 20x picks up steam with first full ‘Class C’ certification to AI company

Artificial intelligence company Perplexity is the first to earn a FedRAMP “Class C” certification fully compliant with new rules and the sped-up “20x” process that vets cloud service providers for government use, several announcements over the past week said.

“Class C” is most aligned with FedRAMP’s old “moderate” classification and is the most common type in the marketplace. Perplexity’s certification is the first that is compliant with the FedRAMP Consolidated Rules for 2026, which were released over the summer along with the 20x pipeline opening.

“Everything up until now has been development, piloting, training, preparing,” a FedRAMP blog said. “These milestones, the first FedRAMP 20x Certifications, especially the first FedRAMP 20x Class C Certification, marks the actual beginning of the race to expand the marketplace to enable federal agencies to work with many thousands of different cloud-based services that accelerate key agency operations to reduce the footprint of the information technology infrastructure that they directly manage.”

The blog said it has taken a long time to get to a place where products’ security capabilities are measured by outcome metrics through “Key Security Indicators” instead of just a narrative paragraph about their capabilities. 

“To many stakeholders, especially those in government, the progress of FedRAMP’s 20x initiative has at times felt overwhelmingly fast,” it said, but it took more than two years after the Office of Management and Budget memo requiring FedRAMP to speed up its processes and “over 17 months from the announcement of the FedRAMP 20x initiative for the first FedRAMP 20x Class A Certification to happen.”

There are now seven “Class A” certifications, a new type of entry-level certification which began rolling out in August. There are 12 “Class B” 20x certifications in the pilot phase, comparable to the old “low” level, including Google Gemini for Government and Flock Safety. OpenAI’s ChatGPT and Filevine have 20x pilot “Class C” certifications, along with a dozen others.

“Products with Limited Pilot FedRAMP 20x Certification earned before the release of the Consolidated Rules for 2026 have already seen wide-scale usage across government, although FedRAMP unfortunately lacks the necessary data at this time to properly demonstrate this in the FedRAMP Marketplace,” the blog said.

But more is coming for FedRAMP 20x, as nearly 100 products have begun the certification process, including some by Anthropic and Cisco.

“Agencies are using FedRAMP 20x Certified products because they increase the efficiency of procurement and assessment while opening up access to previously impossible-to-use capabilities,” the blog said. “FedRAMP 20x will need to be expanded and improved continuously to open access to more technology companies in different industries.”

Perplexity’s new 20x certification allows the General Services Administration and the Department of Agriculture to use the Perplexity Enterprise and API Platform, “bringing live web search and source-cited answers within its certified environment,” a company blog post said.

“As an American company, we’re committed to putting accurate SI in the hands of the people and organizations who serve our country,” the release said. “This certification is another step in that commitment.”

While there are no “Class B” or the old “high” level “Class D” 20x certifications yet, FedRAMP has set its sights on vetting thousands of cloud products, it said.

“Every FedRAMP Certification, every agency [authorization to operate], one at a time, FedRAMP will run with them until we are running with thousands,” the blog said. “And then the real fun begins.”