GSA AI procurement rule draws praise, faces key questions

The General Services Administration has received cautious approval for revisions to its proposed regulations governing artificial intelligence systems in federal contracts, though significant implementation questions remain unresolved as the comment period continues through August 3.

Why it matters

This regulatory framework will establish baseline requirements for every federal AI contract managed through GSA vehicles, creating compliance obligations that will shape how government agencies can procure and deploy large language models for the next decade. Companies unprepared for these requirements risk exclusion from a substantial federal market.

Improvements from the initial draft

GSA reissued its draft regulations on June 17, three months after releasing an initial version that drew industry concerns. The updated proposal addresses several pain points identified during early feedback.

The revised rule eliminates blanket flow-down requirements, replacing them with four distinct clauses tailored to different LLM roles. GSA also introduced an attestation provision to reduce compliance burdens on prime contractors and removed controversial "lawful use" and mandatory Made in America provisions from the original draft.

"The government got the data governance piece right in this proposal," said Jose Arrieta, founder of Imagineer and former CIO at the Department of Health and Human Services. The regulations establish that government data cannot be used to train commercial models, a core protection for federal information.

Jessica Tillipman, associate dean for government procurement law studies at George Washington University, noted that GSA "addressed many of the problems with the initial draft," particularly around tightening definitions and clarifying the specific application of requirements to LLMs.

Outstanding concerns

Despite improvements, vendors and experts have flagged areas requiring additional clarity before final implementation.

The foreign ownership prohibition for LLMs presents practical challenges. Arrieta warned that requiring only U.S. corporate entities to develop LLMs "literally narrows the compliant vendor pool and narrows the options down to hyper scalers only." Given the globally distributed nature of AI development and reliance on open-source components, mid-tier companies may struggle to certify full development lineage or meet foreign ownership requirements.

The regulation's treatment of "ideological neutrality" also needs refinement. Tillipman questioned what compliance means in practice: "It's a very mushy term." The proposal references undisclosed benchmarks for testing, which she described as "tough" to implement consistently.

One industry executive, speaking anonymously to preserve their GSA relationship, raised questions about how the expanded scope—now covering all GSA-run contracts—will apply to Defense Department use of these vehicles and how attestation processes will work in practice.

Limited public comment so far

Only six official comments had been submitted three weeks after the updated proposal's release, though interest remains high. GSA held a listening session on July 14 in Washington, with registration closing July 3. Industry observers expect comment volume to increase following that session.

Laura Stanton, acting commissioner of GSA's Federal Acquisition Service, indicated in May that the agency received substantial initial feedback before releasing the updated regulations and better understood stakeholder concerns.

Arrieta characterized the rule as "the most consequential regulation" since GSA implemented FedRAMP cloud security requirements, noting that "companies that don't take this seriously will be left behind."

These details were first reported by Federal News Network.