Comment on GSA AI Clause Basic Safeguarding (GSAR 552.239-7001)

We commend GSA for taking a first-mover position on AI governance in federal procurement. The clause addresses real and urgent risks — data sovereignty, supply chain accountability, incident response, and the need for human oversight of agentic AI systems.

However, the clause as drafted creates significant implementation gaps. The core problem is structural: the clause imposes comprehensive compliance obligations on contractors and their service providers without establishing any mechanism for standardized, verifiable compliance demonstration. Compliance is asserted but not credentialed — leaving both contractors and the government without a reliable framework for distinguishing compliant AI systems from non-compliant ones.

The clause requires contractors to provide NIST AI RMF-consistent documentation on request and grants the government authority to independently evaluate AI systems using its own benchmarks — benchmarks the government has no obligation to disclose. This creates a compliance environment where contractors cannot proactively demonstrate compliance because the evaluation criteria are opaque.

We recommend that the clause explicitly recognize third-party AI credentialing bodies — analogous to the Third-Party Assessment Organizations (3PAOs) in the FedRAMP framework — as an accepted mechanism for demonstrating compliance. A contractor whose AI systems hold a recognized behavioral safety credential should be presumed compliant, subject to government audit rights. The FedRAMP model demonstrates this approach works for complex technical compliance.

Section (e)(2) prohibits "foreign AI systems" but does not define what constitutes domestic development for modern AI systems. Contemporary AI systems are built using globally sourced training data, open-source components maintained by international contributors, cloud infrastructure spanning multiple jurisdictions, and multinational development teams. A geographic origin test is functionally indeterminate for software-based AI systems.

We recommend that "American AI Systems" be defined through auditable compliance criteria — corporate domicile, location of training infrastructure, jurisdiction governing data handling, and whether the system has been modified to comply with any non-U.S. government's content or surveillance requirements.

Section (d)(2)(ii) states that AI systems "must not refuse to produce data outputs or conduct analyses based on the Contractor's or Service Provider's discretionary policies." Section (i)(1) simultaneously requires the system to be "truthful" and implement bias mitigation.

These two requirements are in tension. A truthful AI system must sometimes decline to produce outputs that would be inaccurate, harmful, or violate legal constraints. An AI system that cannot refuse any output request is not more truthful — it is less safe. The clause conflates behavioral safety guardrails (which protect accuracy and prevent harm) with ideological content moderation (which the clause seeks to prevent). Removing all refusal capability would eliminate the safety mechanisms the clause itself demands.

The clause makes the prime contractor responsible for all service provider compliance, but prime contractors — particularly small and mid-size integrators — have no contractual leverage over upstream AI platform providers who are not parties to the government contract. A small integrator building on a foundation model from a major AI provider cannot compel that provider to comply with the clause's requirements, yet bears full liability including potential False Claims Act exposure.

We recommend a credentialing-based safe harbor: if an upstream service provider holds a recognized behavioral safety credential, the prime contractor's flow-down obligation should be presumed satisfied. This solves the "David and Goliath" problem and creates market incentives for major AI platform providers to obtain credentialing.