Procurement is regulating AI first

The most binding artificial intelligence rules in the United States are not in a statute. They are in purchase orders, and they take effect the moment a vendor signs one.

The General Services Administration has drafted contract terms that would apply to AI capabilities sold to the federal government. Lawyers tracking the proposal describe a new clause, GSAR 552.239-7001 on basic safeguarding of AI systems, that would carry disclosure obligations and government data rights into solicitations for AI capability.

That mechanism moves faster than legislation because it skips the part legislation cannot skip. A clause added to the Multiple Award Schedule reaches every vendor on that schedule through a mass modification, and no floor vote is involved at any point.

Agencies are also being told what to ask for. An Office of Management and Budget memorandum issued at the end of last year directs agencies to carry specific contractual requirements into solicitations for large language models and to update their procurement policies on a fixed schedule.

Vendors respond to this differently than they respond to a proposed rule. A rule invites comment and a compliance date somewhere in the future. A contract term invites a bid or a decision not to bid, and the engineering work has to be finished before the response is due.

The practical requirements are unglamorous and specific. Disclosure of what a model was trained on, clarity about who owns the outputs and the fine-tuning data, logging that can survive an audit, and a defined answer to what happens when the vendor changes the model underneath a deployed system.

Those terms then leak outward. A vendor that has built model-change notification and output-logging for a federal contract does not maintain a second product without them, and enterprise buyers in regulated industries have started asking for the federal terms by name.

Government auditors are less impressed than the memoranda suggest. The Government Accountability Office examined AI acquisitions across several agencies and recommended that departments systematically collect and share lessons learned, on the finding that the same mistakes were being repeated across procurements that never compared notes.

That gap between the terms on paper and the capability to evaluate them is the real constraint. Writing a clause requiring explainability is straightforward. Staffing a contracting office with people who can tell whether a vendor's answer to it is adequate is not.

The result is a regulatory regime with sharp teeth and uneven bite. Where a contracting officer understands the technology, the clause functions as a genuine standard. Where one does not, it functions as a form to be completed, and the vendors best at completing forms win.

None of this looks like AI regulation in the way the debate has been framed, which is why it has attracted so little attention. The government is not legislating what AI may do. It is deciding what it will buy, and for a large share of the industry that turns out to be the same instruction.