GSA’s draft AI Clause turns governance into a contractual mandate

That is why this draft matters far beyond government contractors. It is an early signal of where AI oversight is heading more broadly: away from voluntary commitments and toward enforceable controls, documentation, and accountability.

The proposed clause is notably aggressive. In a Holland & Knight Client Alert, it noted that it would grant the government expansive ownership rights over “Government Data” and “Custom Developments,” prohibit contractors from using government data to train or improve models for other customers or commercial purposes, impose a 72-hour incident reporting requirement, and hold prime contractors directly responsible for the compliance of downstream AI “Service Providers.”  It would also require the use of “American AI Systems,” mandate notice before material provider changes, and require open formats and APIs to support portability and interoperability.

Jessica Tillipman, writing in Lawfare, captures the core issue well. She argues that the GSA has identified a real governance problem in AI procurement but is trying to solve it through what she calls “governance by sledgehammer”. That phrase is memorable because it gets to the heart of the tension. The government is right to focus on data control, vendor lock-in, layered AI supply chains, and oversight of performance. Yet the draft attempts to address all those concerns at once, through a single clause that departs sharply from customary commercial practice.

For compliance professionals, the third-party risk dimension is perhaps the most important. The draft defines “Service Providers” broadly enough to include upstream commercial AI platforms and model vendors, even if they are not traditional subcontractors. Tillipman notes that the prime contractor may be responsible for ensuring compliance by upstream providers whose only link to the federal contract is a commercial API or platform agreement. That is not a minor drafting point. It means AI compliance may increasingly turn on whether a company has visibility into its full technology stack, workable flow-down obligations, and evidence that those obligations can actually be tested.

The data governance aspects are just as consequential. The proposed definition of “Government Data” extends beyond prompts and outputs to include metadata, logs, derivative data, and usage-linked information. Tillipman frames this as concern over the “informational advantage” vendors gain from government use, including the behavioral patterns embedded in system interactions. From a compliance standpoint, this is a major development. Regulators and procurement officials are no longer focused only on whether data is protected. They are focused on whether usage itself creates exploitable value that must be governed.

The portability provisions also deserve close attention. The draft requires open, standardized data formats and APIs and bars proprietary approaches that create dependency or require added licensing to exit a system. That is a federal procurement lesson with broad private-sector value. AI governance is not only about approving a tool on day one. It is also about preserving the organization’s ability to monitor changes, migrate data, and disengage from a vendor without operational chaos.

Of course, the draft raises serious concerns. The “American AI Systems” language appears difficult to apply in a market built on global development teams, open-source components, and layered supply chains. The “Unbiased AI Principles” introduce additional uncertainty by combining performance expectations with politically charged terminology and government evaluation rights that may rely on undisclosed methodologies.

The larger lesson is clear. AI governance is becoming a contracting issue, a sourcing issue, and a controls issue. Compliance officers should not wait for a final rule before acting. They should already be asking whether their organizations can map AI vendors, trace data flows, document model changes, manage incident response, and prove oversight with credible evidence. That is where this draft is headed, and where the market may soon follow.