Despite revisions, GSA’s proposed AI acquisition rule still falls short, stakeholders say

Concerns over artificial intelligence terminology and data privacy persist in the General Services Administration’s proposed AI acquisition regulation rule, stakeholders said at a Tuesday listening session.

Menaka Kalaskar, head of Palantir’s U.S. government legal and contracting team, said if the GSA proceeds with the rule as written, agencies wanting to use AI and large language models might have to look for non-GSA vehicles. 

The clause to set boundaries around how the GSA acquires AI was originally published in January, and changes were made to the scope, definitions and context after initial feedback. The current proposed rule was posted June 17 and public comment is open until Aug. 3.

“GSA seems to be taking a lot of risk with this initiative, and it’s not obvious why,” Kalaskar said. “If the major LLM developers will not accept GSA’s terms, then … government agencies will have to turn to non-GSA vehicles for the most advanced LLM-powered solutions.”

Kalaskar said the GSA’s contract terms in the rule are “not consistent with customary commercial practice,” making the AI clause “fundamentally incompatible” with the commercial mandates of the Federal Acquisition Streamlining Act.

In particular, the rule’s requirement to provide notice of “material changes” within seven or 30 days, depending on the change, is “unworkable” for Software-as-a-Service companies like Palantir.

“GSA is proposing an AI clause that’s not required by statute or any other rule that, in our view, defies customary commercial practice and that purports to rewrite commercial software license terms,” Kalaskar said. “If the clause is really needed, then it can be included in the [Federal Acquisition Regulation] overhaul rather than GSA going out and trying to force this initiative.”

Others raised concerns over the clause’s language calling for “unbiased AI principles” arguing that neutrality is subjective and ill-defined, as well as the rule’s ask for the government to own metadata instead of company proprietary property.

Experts like Jessica Tillipman, associate dean for Government Procurement Law Studies at George Washington University, where the session was held, said that while the GSA is on the right track in prohibiting AI vendors from training on government data, there are still loopholes.

“People hear that sentence and assume it protects all of their interactions with an AI system — it does not,” she said. “A contractor may also learn from an agency’s patterns of use: how the agency works, what are the struggles, what it values, and what it might need next. That is an informational advantage, and to GSA’s credit, the clause reaches that broad concern. But the effectiveness of these protections depends on whether the people applying the clause can tell where the boundaries are.”

Tillipman said protected data should be defined by answering three questions: Is it tied to government use, does it reveal how the government operates, and can that conclusion be drawn through aggregation or inference, even if no single record reveals it?

She also said the GSA should define when the later application of a generalized lesson AI vendors learned while working with the government would also be considered a prohibited use of its data.

Shane Shaneman, an AI strategist for Nvidia, said data handling should be shifted to a system integrator or operator — not the developer — to allow for open models to participate. 

“The future of AI isn’t one model; it’s many, especially as the government leverages AI agents for agentic orchestration,” he said. “That’s how agencies will leverage open models to empower the workforce to save time, save money, and save lives while keeping token costs manageable.”

Laura Stanton, GSA’s acting Federal Acquisition Service commissioner, said AI is offering the government “tremendous opportunities,” but it’s important to get it right to avoid “unintended consequences.”

“As we integrate AI into the government fabric and the government’s technology, we recognize that that comes with a sense of responsibility, and that’s what we’re really working to define here,” she said. “We must protect the people’s data, and we must ensure that agencies can adopt AI quickly and with confidence.”