AI Regulation Tracker / Procurement policy

OMB AI Terms Are Live. Big Contractor Clauses Proposed

OMB M-25-22 now requires agencies to put AI terms in solicitations, and those terms reach vendors through flowdown clauses. Separately, GSA and the FAR Council have PROPOSED major new AI clauses that are not yet final. If you sell, host, or integrate AI for the government, prepare now.

By Anthony Guerriero · Reviewed by The Leveraged Years Editorial Desk · Published July 4, 2026 · Last updated July 4, 2026

OMB AI Terms Are Live. Big Contractor Clauses Proposed regulation briefing

The Leveraged Years AI Regulation Tracker

Regulatory Briefing

Bindingness: Mixed status. FINAL and effective: OMB M-25-22 (binds agencies; reaches vendors via inserted clauses). PROPOSED, comments open: the GSA GSAR LLM clause and the FAR Part 39 overhaul. PENDING: NDAA FY2026 section 1513. No final government-wide FAR or DFARS AI clause exists yet.
Scope: Federal contractors and subcontractors that sell, operate, integrate, or host AI or LLM systems for the government, plus their upstream model and data suppliers via flowdown. Not triggered when AI is merely embedded in a common commercial product.
What Changed: OMB M-25-22 requires agencies to insert vendor-facing AI terms (no-train on agency data, evaluation access, impact-assessment inputs, anti-lock-in, new-feature notice). GSA has separately proposed a new LLM safeguarding clause with "eyes-off," American-AI, and supply-chain attestation duties.
Who This Affects: Civilian AI vendors (GSA Schedule, GWAC, OASIS+), DoD AI/ML vendors, and their subcontractors. Small vendors and resellers of foreign or open models face the heaviest lift.
Current Status: M-25-22 in force and applies to solicitations issued on or after roughly Sept 30, 2025. GSA GSAR clause proposed, comments open. FAR Part 39 overhaul proposed, comments open. NDAA FY2026 sec. 1513 pending.
Effective Date: M-25-22: solicitations on/after ~Sept 30, 2025. GSAR clause: pending (comments due Aug 3, 2026). FAR Part 39: pending (comments due July 23, 2026). NDAA sec. 1513: pending, no effective date.
Primary Source: OMB Memo M-25-22
Secondary Analysis: See the SOURCE FILE below for every primary citation and date.
Workflow Impact: Your next federal AI solicitation will likely carry no-train, data-rights, and evaluation-access terms that you must be able to satisfy and prove.
Operational Next Step: Build an AI bill-of-materials for every model you use on government work and map each one against these duties before you bid. The Enterprise Leverage System (/enterprise-leverage-system) walks teams through that inventory.
Last Verified: July 4, 2026

The honest read

There is no final, government-wide FAR or DFARS AI clause today, and anyone telling you otherwise is ahead of the record. What is real and binding right now is OMB Memo M-25-22, signed April 3, 2025, which binds agencies, not vendors directly. It reaches contractors only through clauses agencies are now required to insert. Layered on top are two proposed rules still open for comment and one pending statute, so the honest posture is: the direction is set, the exact contract language is still being written.

The rule in plain English

M-25-22 applies to agency solicitations issued on or after roughly September 30, 2025 (180 days after issuance), and excludes National Security Systems and AI merely embedded in common commercial products (OMB M-25-22). The memo itself creates no direct offeror obligation. Instead it directs agencies to place flowdowns on vendors: a permanent prohibition on using non-public agency input data and output results to further train publicly or commercially available AI without explicit agency consent; access and time for agencies to run independent evaluation; descriptive information for the M-25-21 AI Impact Assessment on high-impact uses; anti-lock-in terms covering knowledge transfer, data and model portability, rights to code and models produced in performance, and pricing transparency; and notice before integrating new AI features. Note one point people overstate: disclosure of AI use in performance is discretionary. Agencies "must determine whether" to add such a provision, so treat it as case-by-case, not a blanket mandate.

Separately, and still only PROPOSED, GSA published a rule on June 17, 2026 creating GSAR clause 552.239-7001, "Basic Safeguarding of Data within Large Language Model AI Systems" (91 FR 36559), with comments due August 3, 2026 and a listening session July 14, 2026 (Federal Register). Where government data is processed by LLMs, it would require that the government owns inputs and outputs; that vendors not train on, monetize, or transfer government data; "eyes-off" handling with automated ingestion, encryption, access controls, and audit logs; change and incident notice (30 days before material changes, 7 days for bias or safety-degrading changes, immediate for emergencies); written certification of secure deletion; an "American AI" certification that the LLM is developed and managed by a US-incorporated entity protected from foreign-government data compulsion; an unbiased-AI requirement; supply-chain flowdown with attestations and 72-hour non-adherence notice; and a limited government data-rights license with an explicit trade-secret carve-out that lets contractors keep base models, weights, and background data. It excludes embedded or incidental use.

A third, also PROPOSED, rule published June 23, 2026 would retitle FAR Part 39 to Information and Communication Technology, expressly including AI and machine learning, with comments due July 23, 2026 (Federal Register). Finally, PENDING and not yet effective, NDAA FY2026 section 1513 directs DoD to build an AI/ML security framework into DFARS and CMMC, with a DoD status report due June 16, 2026. Treat that statute as forthcoming; the exact DFARS and CMMC language is not final.

Who it hits

Federal contractors and subcontractors that sell, operate, integrate, or host AI or LLM systems for the government, plus their upstream model and data suppliers pulled in via flowdown. That includes consultants and executives bidding civilian AI work on GSA Schedule, GWAC, and OASIS+ vehicles, and DoD AI/ML vendors. It is not triggered when AI is merely embedded in a common commercial product. Small vendors and resellers of foreign or open models face the heaviest lift on the "eyes-off," American-AI, and flowdown-attestation duties, because those are the hardest to evidence for a model you did not build.

What to do this week

1. Build an AI bill-of-materials: list every model and LLM you use on government work, including subcontracted and open-source ones, with developer, hosting, and whether it touches government data. 2. Run the American-AI test now on each model (US-incorporated developer and manager, protected from foreign-government data compulsion) so you know which offerings survive the proposed GSAR clause. 3. Draft no-train and data-rights language aligned to your contract scope, matching the M-25-22 flowdowns on agency input data and output results. 4. Stand up "eyes-off" evidence: automated processing, encryption, access controls, audit logs, and a secure-deletion certification path. 5. Prepare testing and evaluation cooperation plus your M-25-21 AI Impact Assessment inputs for any high-impact use. 6. Fix subcontractor flowdown with written attestations and a defined non-adherence notification path (the proposed GSAR clause contemplates a 72-hour notice). 7. File comments while you can: the GSAR clause closes August 3, 2026 and the FAR Part 39 overhaul closes July 23, 2026.

Related tracker rows

[OMB AI memos M-25-21 and M-25-22, one year later](/ai-regulation-news/omb-ai-memos-m25-21-m25-22-one-year-later-2026)
[White House frontier AI model release standards](/ai-regulation-news/white-house-frontier-ai-model-release-standards)

Source File

Primary Source: OMB Memo M-25-22, "Driving Efficient Acquisition of Artificial Intelligence in Government," signed April 3, 2025. https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf
Primary Source: GSA Proposed Rule, GSAR clause 552.239-7001, "Basic Safeguarding of Data within Large Language Model AI Systems," 91 FR 36559, published June 17, 2026, comments due Aug 3, 2026, listening session July 14, 2026. https://www.federalregister.gov/documents/2026/06/17/2026-12205/general-services-acquisition-regulation-acquisition-of-information-and-communication-technology
Primary Source: FAR overhaul Proposed Rule retitling FAR Part 39 to Information and Communication Technology (including AI/ML), published June 23, 2026, comments due July 23, 2026. https://www.federalregister.gov/documents/2026/06/23/2026-12559/
Last Checked Against Primary Source: July 4, 2026
Methodology: Researched from primary sources, drafted with AI assistance, fact-checked and edited by the editorial desk. Informational only, not legal, tax, medical, or investment advice.

Frequently Asked Questions

Is there a final FAR or DFARS AI clause yet?

No. There is no final government-wide FAR or DFARS AI clause. OMB M-25-22 flowdowns are effective through agency-inserted clauses, while the GSA LLM clause and the FAR Part 39 overhaul are proposed rules still open for comment.

What is actually binding right now?

OMB M-25-22, effective for AI solicitations issued on or after about September 30, 2025. It binds agencies, and its terms reach vendors through the contract clauses agencies are now required to insert.

When are comments due on the proposed rules?

Comments on the proposed GSA LLM-safeguarding clause are due August 3, 2026, and comments on the FAR Part 39 overhaul are due July 23, 2026.