The US General Services Administration (GSA) has established new contractual requirements governing how federal contractors use and handle government data in large language model (LLM) systems, according to a November 9 report by Govly.

The requirements give federal agencies greater control over data ownership and AI processing, addressing how government information is handled when contractors use external AI systems. The development reflects growing scrutiny of the relationship between government data, commercial AI platforms and federal procurement.

Data Governance Becomes Part of AI Procurement

GSA’s action highlights the growing importance of defining data rights and responsibilities before contractors deploy AI systems. CDOs need to work with procurement, legal, cybersecurity and technology teams to ensure that agreements address data ownership, authorized use, access controls, retention and auditability.

For chief data officers (CDOs), the move raises fundamental questions about data ownership, permitted use, security and vendor accountability. As agencies adopt third-party AI platforms, they need clear contractual boundaries governing how information can be accessed, processed and used.

One particularly important distinction is between allowing an AI system to retrieve data to answer an authorized request and allowing a contractor to use that information to train or improve a commercial model. 

These activities carry different implications for data ownership and control.

The issue also connects to the broader challenge of preparing data for AI applications. As organizations expand their use of AI and data-driven services, CDOs must ensure that data access, permissions and accountability are addressed before automated systems are deployed.