FedRAMP has granted its first "Class C" certification to Perplexity, marking a pivotal moment for cloud service providers aiming to comply with FedRAMP 20x's new rules for moderate impact. If your team sells cloud-delivered services to federal programs or develops tools that handle federal data, this signals that 20x has moved from pilot to production.
Understanding the New Certification Structure
FedRAMP launched its 20x revamp in March 2025, releasing consolidated rules in June 2026. These rules introduced a new certification structure: Class A, Class B, Class C, and Class D.
Class C aligns with the legacy FedRAMP Moderate Baseline. Class B corresponds to the old Low Baseline. Class A is a new entry level designed to speed access to the marketplace. Class D has no certifications yet.
Perplexity's certification is the first at the Class C level. FedRAMP described it as "the actual beginning of the race" to expand the marketplace, indicating that everything before it was preparatory.
Key Insights
1. Uneven Distribution in the Marketplace The FedRAMP Marketplace lists seven Class A certifications and 12 Class B certifications, with Class B still in the 20x pilot phase. Class C has only one entry, while Class D has none. This distribution highlights where the program stands: entry-level and low-impact pathways are gaining traction, while moderate-impact certification under the new rules is just beginning.
Action: Don't assume the Class C pathway is well-established. You'll be among the first, with limited precedent for how assessors and reviewers will handle edge cases.
2. Class C Is Not Just a Rename of Moderate While Class C is equivalent to the legacy FedRAMP Moderate Baseline, the 20x rules have changed the authorization process. Treating Class C as merely a relabeled Moderate package could lead to overlooking process changes in the consolidated rules. Review the June 2026 rules directly instead of relying on legacy Moderate playbooks.
Action: Rebuild your authorization plan from the consolidated 20x rules, then align it with your existing NIST SP 800-53 Rev 5 control implementation evidence.
3. AI Platforms Achieving Moderate Impact Certification Perplexity's Enterprise platform allows agency users to access AI models like OpenAI GPT and Google Gemini. Federal users can search the web for cited answers, summarize documents, and draft notes within the certified environment. This demonstrates that AI services aggregating third-party models can achieve moderate-level certification, setting new expectations for AI vendors.
Action: If you use or resell third-party models, clearly document the boundary. Be prepared to explain which components are within the authorized environment and how data flows across them.
4. Procurement Access and Pricing Agencies can obtain Enterprise Pro for Government through the General Services Administration's OneGov offer at $0.25 per agency through March 31, 2027. This low pricing removes cost as a barrier and accelerates agency opinions on AI tools.
Action: Anticipate agency customers arriving at contract discussions with a certified, nearly free AI reference point. Competing offerings will be measured against it.
Implications for Your Team
For DIB contractors, the first implication is about your own tools. If your staff or agency customers start using certified AI services, you need to know what Controlled Unclassified Information (CUI) may enter those tools. A FedRAMP certification at the moderate level doesn't make an AI platform an approved destination for all CUI categories or export-controlled data. Your obligations under DFARS 252.204-7012 and, where applicable, ITAR remain unchanged. Cloud services processing, storing, or transmitting covered defense information under 252.204-7012 must still meet the FedRAMP Moderate Baseline equivalency requirement, and you retain responsibility for the Shared Responsibility Model analysis and your Customer Responsibility Matrix.
The second implication is competitive. If you provide cloud-based services to federal customers, the existence of a Class C certification raises the bar for what counts as a credible offering. The tiered structure also provides a staged path: Class A and B entry points can establish presence while you build toward Class C.
The third is timing. With the consolidated rules out and the first moderate certification granted, the "wait and see" period is ending. Early movers will shape how Class C is interpreted in practice.
Action Items by Priority
Immediate (this quarter)
- Read the consolidated FedRAMP 20x rules released in June 2026 and map each certification class to your current or planned offering.
- Inventory any AI tools already in use across your program, sanctioned or not, and classify what data types touch them.
- Update your acceptable-use policy to state which AI services may receive CUI Basic or other CUI categories, and which may not.
Near term (next two quarters) 4. If you're a cloud service provider, decide whether Class A, B, or C is your entry target, and check the FedRAMP Marketplace for how comparable offerings are listed. 5. Refresh your Customer Responsibility Matrix so it reflects AI-related data flows, including third-party model dependencies. 6. Confirm your encryption posture uses validated modules, consistent with FIPS 140-2 where your contracts require it.
Ongoing 7. Track Class C and Class D additions to the Marketplace; each new listing sets precedent. 8. Watch the OneGov pricing window through March 31, 2027, and plan for how your agency customers' AI usage may change before and after it closes.
