Who oversees AI purchases, and what rules, certifications and laws do and do not check.