The General Services Administration (GSA) issued a new AI acquisition clause on Monday, according to an October 1 FedScoop report. GSA is introducing the requirements to protect government data when agencies use AI systems that process it, including through contractors and subcontractors. 

The clause covers large language models (LLMs), generative assistants, chatbots, agentic systems and AI-enabled productivity tools, and sets requirements for how contractors and their subcontractors handle that data.

AI Contracts Extend Data Controls to Suppliers

FedScoop reported that the clause changes how requirements flow through the AI supply chain. 

Flow‑down requirements now apply to subcontractors only if they handle government data, while the prime contractor remains responsible for implementing the clause and must use “best efforts” to vet AI subcontractors.

The clause expands access to government data for cloud hosting, technical support, security, maintenance and similar service providers, but only “to the extent necessary” to perform the contract.

The clause also requires contractors to notify the government within seven calendar days of any “material change that materially increases” output bias, decreases safety guardrails or behavioral constraints, or degrades performance or truthfulness of outputs.

Data Governance Moves Into AI Procurement

For chief data officers (CDOs), the clause makes procurement part of the AI governance process. 

GSA’s AI acquisition policy says agencies should understand an AI tool’s data flows, storage and protection measures and determine what data can be shared. It also calls for coordination with the agency’s senior data official (such as the CDO) alongside other senior technology, security and privacy officials.