U.S. Tightens AI Contract Rules After Pentagon Clash With Anthropic
The administration is preparing sweeping new rules for how AI companies work with the federal government. The General Services Administration (GSA) has drafted policy that would require contractors to grant agencies an irrevocable license to use their AI systems for "any lawful purpose."
The draft applies to civilian contracts and parallels measures the Department of Defense (DoD) is weighing for military use. It follows a high-profile dispute with Anthropic that elevated a quiet technical argument into procurement policy.
How we got here
The Pentagon labeled Anthropic a "supply-chain risk," which effectively blocks defense contractors from using the company's tools on military projects. The issue centers on safety guardrails that Anthropic embeds to constrain certain uses of its models.
Defense officials argued those limits could restrict intelligence analysis, cybersecurity operations, and battlefield decision-making. The fallout spread to civilian buying. According to Josh Gruenbaum, GSA ended Anthropic's participation in the OneGov program, cutting off a major contracting avenue.
"It would be irresponsible to the American people and dangerous to our nation for GSA to maintain a business relationship with Anthropic," Gruenbaum said. "As directed by the President, GSA has terminated Anthropic's OneGov deal - ending their availability to the Executive, Legislative, and Judicial branches through GSA's pre-negotiated contracts."
What the draft rules require
- Irrevocable license: Agencies gain broad, permanent rights to use purchased AI systems for any lawful purpose.
- Neutral outputs: Contractors must ensure systems do not intentionally embed partisan or ideological judgments.
- Disclosure of external influence: Vendors must state whether models were modified to meet non-U.S. federal requirements (e.g., foreign regulations or corporate policies).
- Scope: Civilian procurement now; DoD is considering similar measures for defense use.
Why this matters for government teams
AI is moving from pilots to daily operations across agencies. With that comes a question many avoided: who controls model behavior once the government buys it - the vendor, or the agency?
These rules put agencies firmly in the driver's seat. That control comes with new responsibilities in testing, oversight, and contract language.
Immediate actions for procurement and program offices
- Update solicitations and SOWs: Add the irrevocable license language and neutrality requirements. Specify testing and acceptance criteria for "neutral output."
- Plan for vendor variability: If a product imposes safety rails that block mission use, require configurable policy settings or administrative overrides with audit logs.
- Strengthen due diligence: Request model documentation (capabilities, limitations, failure modes), red-team results, and change logs for any safety or policy updates.
- Run pre-award evaluations: Test outputs for bias, content filtering, and mission performance across realistic scenarios. Document results for source selection.
- Protect data and rights: Clarify data use, fine-tuning rights, model weight access (if any), and where agency data is stored and processed.
- Line up alternatives: If a supplier is restricted (e.g., supply-chain risk), identify substitutes and map transition plans to avoid mission delays.
Key questions to ask vendors
- Can agencies adjust or disable safety guardrails under approved governance, with traceability?
- What controls ensure outputs avoid intentional partisan or ideological content?
- What external rules influenced your model (EU, state laws, corporate policies)? Provide a changelog.
- How do you handle audit logging, access control, and incident response for model misuse or drift?
- What's your approach to model updates that could affect mission performance or compliance?
- If your product is limited to API access, how are license terms enforced across tenants and enclaves?
Governance that balances safety and mission needs
- Policy tiers: Define mission-specific guardrail tiers (e.g., intelligence analysis vs. HR automation) and who can change them.
- Human-in-the-loop: Require human review for high-impact uses, with thresholds and escalation paths.
- Evaluation and red-teaming: Test for both bias and mission readiness; re-test after vendor updates.
- Records management: Keep model cards, evaluation results, data provenance, and decision logs for audits and oversight.
- Fallbacks: Maintain alternate models or modes if a guardrail blocks time-sensitive operations.
Legal and compliance considerations
- Licensing: Verify the irrevocable license aligns with IP, data rights, and third-party components in the vendor's stack.
- Privacy and data use: Confirm treatment of PII, CUI, and classified workflows. Nail down retention, deletion, and cross-border processing.
- FOIA and records: Decide how AI-generated content and logs are retained and disclosed.
- Accessibility and security: Ensure Section 508, FedRAMP/FISMA, and supply-chain (SBOM) requirements are addressed.
Strategic takeaway
This is a control question. Vendors built policy guardrails to reduce risk. Agencies need freedom to meet mission. The draft rules aim to reconcile the two by giving government clear usage rights, visibility into outside influence on models, and a standard for neutral outputs.
For government buyers, the message is simple: write it into the contract, test it before acceptance, monitor it in production, and keep options open.
Helpful resources
Build team capability
Your membership also unlocks:
