How the GSA clause adds data rules to some AI contracts

Government data includes prompts and generated content created during contract work. The definition also reaches information that reveals, or supports material inferences about, government activities, workloads, priorities or methods. That means the terms can cover more than the direct exchange between a user and an AI system.

The clause also sets boundaries. It does not impose obligations when an LLM is used only in a contractor’s internal business or support systems that are not delivered to or accessed by the government. It describes conditions for excluding incidental or ancillary LLM functions, while allowing a contracting officer to identify otherwise.

GSA issued the terms as a deviation, which lets the agency put acquisition language into use before formal rulemaking is complete. That makes the clause an operative contract term, not a final rule adopted at the end of that process. The distinction matters: the clause can be used ahead of formal rulemaking, and its terms could still change through that process.

What must contractors and subcontractors do?

The clause restricts contractors from using government data to train LLMs, inform advertising or sell to third parties. It also requires protections for that data and sets requirements for documentation and certain changes to AI systems.

Some obligations extend to subcontractors, but the clause does not automatically apply to every firm in a contractor’s supply chain. Contractors must pass specified requirements to applicable subcontractors performing AI design, development, deployment, or operation and monitoring when those subcontractors handle government data.

That structure makes it important to identify which companies handle government data and what work they perform. A contractor may rely on a platform provider or a separate model developer; whether the flowdown requirements apply depends on the subcontractor’s role and data access, not simply its presence in the supply chain.

The government can request documentation under confidentiality protections. The material may address compliance, model characteristics, transparency and testing methods related to the bias principles. The clause’s examples exclude proprietary material such as source code and model weights, so the documentation provision should not be read as a demand for either.

These requirements put data handling and specified oversight duties into covered contracts. Whether they prevent data exposure or make government oversight more effective will depend on implementation; the available reporting does not establish outcomes from the clause’s use.

Why are stakeholders divided over the bias-related terms?

The final clause removed references to unbiased AI principles from most of the text, but it retains a requirement, on request, for documentation and testing methods related to those principles. It also gives the government a right to evaluate LLMs for unsolicited ideological content.

Quinn Anex-Ries, a senior policy analyst at the Center for Democracy & Technology, told FedScoop the revised terms were a substantial improvement and welcomed the stronger data safeguards. He also praised the government’s ability to suspend AI use, while cautioning that some language could still be interpreted politically. In his view, the revised version left less room for misuse than earlier drafts.

Jessica Tillipman, associate dean for Government Procurement Law Studies at George Washington University, welcomed removing most references to unbiased AI principles and said the revised definition of government usage context was clearer. She also supported using a deviation, arguing that the government had waited too long to establish protections and that industry had an opportunity to comment.

Corynne McSherry, legal director of the Electronic Frontier Foundation, said evaluating systems for bias is a legitimate aim, but raised concern about the remaining language. She told FedScoop that the phrase unsolicited ideological content is unclear and could give officials room to exclude vendors based on content judgments. That is a warning about a possible effect, not evidence that officials have used the clause to target a viewpoint.

The distinction is central to the debate. Supporters point to data safeguards and review authority as protections; critics question whether the language gives officials too much discretion. The clause’s stated terms establish that evaluations may occur, but the available reporting does not show how the government will define or conduct them.

What do vendors worry about, and what remains unknown?

Industry concerns focus on compliance work and who is responsible when a government service relies on models or other components provided by separate companies. Ross Nodurft, executive director of the Alliance for Digital Innovation, told FedScoop that the revised terms included improvements, but his group still saw provisions that could discourage technology companies from taking part in the public-sector market. That is a prediction about vendor behavior, not evidence that companies have left or that competition has fallen.

GSA said revisions followed stakeholder engagement and were intended to clarify definitions and contractor duties, reduce duplicative burdens and make the terms more workable for commercial providers. Those are the agency’s aims; the actual costs for different contractors and subcontractors remain to be measured in procurements.

The next test is how contracting officers apply the scope limits, exceptions and discretion in actual contracts. The practical meaning of unsolicited ideological content, the procedures for evaluations and the workload imposed on different vendors are still open questions. The date when formal rulemaking will conclude is also not established in the available reporting.