Share with your CISO
The GSA is rewriting the rules for every AI vendor selling to the federal government, and the proposed AI procurement clause is far more aggressive than most contractors anticipated. Published March 6 as part of Schedule Refresh 31, the draft demands “American AI Systems” only, bans foreign AI components, strips vendors of their standard commercial license terms, grants the government ownership of AI enhancements and feedback, and requires incident reporting within one to 72 hours. The comment deadline was extended to April 3, 2026, after industry pushed back hard.
What this means for your business
If your organization sells to federal agencies or uses AI tools in the performance of any GSA Schedule contract, this clause lands squarely on your desk. The exposure isn’t limited to pure AI vendors. The definition of a covered AI system is broad enough to sweep in any contractor that has woven a machine learning tool into its delivery workflow, which at this point describes most of the industry. The compliance surface here is not a narrow technical requirement; it is a structural demand on how you build, source, and document your AI stack.
The intellectual property provisions deserve particular scrutiny, and Wiley Rein’s framing as a government contracts law firm means their alert naturally emphasizes contractual risk over the policy rationale, which is a useful angle even if it undersells the government’s legitimate interest in not subsidizing model improvements for commercial competitors. The clause gives the government ownership of “Custom Developments” and all “feedback” generated during contract performance, while simultaneously excluding vendors’ standard commercial license agreements entirely. That combination is not an oversight. It is a deliberate departure from how the FAR has historically treated commercial software, and it signals that the government views AI systems as categorically different from the commercial products it has bought for decades.
The “American AI Systems” requirement is the clause’s most operationally disruptive provision, and it is also the least defined. No definition of “American AI System” exists in the clause itself, and OMB Memo M-25-22 offers only a policy aspiration, not a legal test. For any vendor whose AI stack includes components from non-U.S. model providers, infrastructure layers, or open-source projects with international contributors, that ambiguity is not a loophole to exploit but a compliance liability waiting to materialize. The vendor that treats April 3 as a deadline to file a comment rather than to audit its supply chain is misreading the moment.
The comment window is the rare instance where a regulatory process gives vendors actual leverage before the terms harden. The final clause will be implemented under GSAR 552.239-7001 in a later Refresh, meaning whatever gets finalized after April 3 becomes the contractual baseline for years. If the “American AI Systems” prohibition lands without a workable definition, or if the IP ownership clause ships without carve-outs for pre-existing commercial licenses, the cost of compliance will fall entirely on the vendor side, and renegotiating after the fact is structurally much harder than shaping the rule before it solidifies.
Concept deep-dive: “Eyes Off” Data Handling
“Eyes off” data handling means the AI vendor’s employees cannot read, review, or access the government’s data inputs and outputs except when strictly necessary to perform the contracted work. Think of it as the equivalent of a sealed courier bag: the carrier moves the package but cannot open it. For AI systems, this restricts the human review pipelines that vendors typically use for quality assurance and model improvement, which is precisely why the clause also prohibits using government data to train or fine-tune the AI system.
Based on reporting from GSA Delays Rollout of AI Procurement Terms and Conditions, Extends Comment Period to April 3: Wiley, originally published 2026-03-24 03:00:00.
