GSA Guidance on Generative AI Use in Federal Agencies

OMB says what agencies must do before deploying AI. GSA decides whether there is anything they can lawfully buy. The second question is the one that stops most federal generative AI projects, and it is answered by an authorisation package and a set of contract terms rather than by policy.

What GSA actually controls

The General Services Administration is not a regulator. It is the government’s acquisition and shared-services agency, and it reaches federal AI adoption through four distinct levers that are frequently run together.

• Contract vehicles. The Multiple Award Schedule and governmentwide acquisition contracts are how most agencies buy software. A product that is not on a vehicle can still be bought, but the contracting officer has more work to do, and in practice that work decides timelines.
• FedRAMP. GSA administers the Federal Risk and Authorization Management Program, which is the security authorisation path for cloud services used by agencies.
• Shared platforms and evaluation. GSA has stood up government-wide capability for agencies to try generative AI models under common terms rather than each negotiating separately, alongside its AI Center of Excellence and its published guidance for agencies adopting AI.
• Acquisition guidance. GSA publishes resource guides for buying AI — what to put in a statement of work, which evaluation criteria to use, which terms to look for — which are advisory to contracting officers rather than binding.

FedRAMP is the gate

For a cloud-delivered generative AI service, FedRAMP authorisation is usually the binding constraint, and it is the one commercial vendors consistently underestimate. Authorisation is granted at an impact level — Low, Moderate or High — derived from FIPS 199 categorisation of the data the system handles, with the control baselines drawn from NIST SP 800-53. Most agency workloads of interest need Moderate.

Three features of the programme matter specifically for AI services.

• Authorisation has a boundary. The package covers a defined system boundary, and an external model endpoint outside that boundary is not covered by it. A vendor authorised for its application, calling a model API that is not itself in the boundary or separately authorised, has a gap that will be found during assessment rather than after.
• Significant changes require review. The continuous monitoring regime requires notification and assessment of significant changes to the authorised system. Model providers ship changes continuously, and reconciling that cadence with a change-control process designed for quarterly releases is an unsolved operational problem rather than a paperwork one.
• Authorisation is not a policy decision. An authorisation to operate is a risk acceptance by an agency official. It says the residual risk is acceptable for that agency’s use, not that the service is safe in general, and a second agency makes its own decision.

A commercial SOC 2 report is useful supporting evidence and is not a substitute at any impact level.

Vehicles, and the 2025 OneGov agreements

During 2025 GSA added frontier model providers to its schedule programme through governmentwide arrangements marketed as OneGov agreements, announced with nominal introductory pricing for an initial term — in several cases a token annual figure per agency — and alongside a government-wide platform for agencies to evaluate models under common terms.

The important part is not the price. Two consequences follow from buying this way, and both should be planned for. First, an introductory term ends, and an agency that has built a programme of record on a nominal price faces a renegotiation with switching costs it did not price in — which is precisely the vendor lock-in that the 2025 OMB acquisition memorandum tells agencies to avoid. Second, adding a provider to a vehicle answers the acquisition question and not the authorisation question or the risk-management question; a contracting path to a model is not permission to put agency data into it.

Terms an agency has to negotiate

Standard commercial terms of service are close to unusable in a federal contract. They contain indemnities the government generally cannot give, choice-of-law provisions inconsistent with the Contract Disputes Act, unilateral amendment rights, and automatic renewal — all of which conflict with federal law before anyone reaches the AI-specific issues. The FAR’s commercial-item clauses address some of it, and the rest is negotiated.

The AI-specific terms an agency should be securing are narrower and more concrete:

Data rights
  - Government data, prompts, outputs and derived artefacts (embeddings,
    indices, fine-tuned weights) are not used to train, tune or evaluate
    any model made available to any other customer.
  - No human review of government content except as required to deliver
    the service, by personnel meeting stated citizenship and screening
    requirements.
  - Retention limited to a stated period; deletion on termination covers
    logs, caches, indices and derived artefacts, with certification.

Model change management
  - Named model identifiers, with versioned endpoints available for a
    stated minimum period after a successor ships.
  - Advance written notice of deprecation and of material changes to a
    named model's behaviour.
  - Notice of subprocessor additions, with a right to object.

Transparency and evaluation
  - Documentation sufficient for an AI impact assessment: intended use,
    known limitations, evaluation results, training-data provenance to
    the extent disclosed.
  - Right for the agency to evaluate the service on its own tasks and to
    publish the results of that evaluation.

Operational
  - Processing confined to named regions and, where required, to systems
    operated on US soil by screened personnel.
  - Accessibility conformance under Section 508.
  - Supply-chain representations, including Section 889 and any
    applicable exclusion orders.

The line most often struck out is the right to publish evaluation results, and it is the one an agency should defend hardest: an agency that cannot publish what it measured cannot satisfy the public-notice and documentation expectations described in the OMB memoranda page, nor answer a congressional or FOIA request about how the system performs. The general form of these provisions, outside the federal context, is in the AI contract clauses page.

Acceptable use inside the agency

Buying the service is upstream of the harder problem, which is what employees may do with it. Federal acceptable-use policies for generative AI converge on a small set of rules that follow from existing law rather than from AI policy.

• Classification and controlled unclassified information. Entering data into a system not authorised for that level is a spillage, with an incident-response process attached. This is the failure that produces the most actual incidents, and it is a user behaviour problem that no contract term prevents.
• Records. A generative exchange conducted in the course of agency business may be a federal record. If the tool retains nothing, the agency may have failed to capture a record; if it retains everything, the agency has created a large FOIA-responsive corpus. Both directions are wrong by default and the policy has to choose deliberately.
• Attribution of output. Model output that becomes part of an agency decision, a public communication or a document filed anywhere carries the agency’s authority. Review duties exist independently of AI policy, and the tooling should make it obvious which text is unreviewed.
• Procurement integrity and personnel decisions. Using a model to evaluate proposals or to screen applicants moves the use into a category with its own statutory constraints and, under the OMB framework, into high-impact territory with pre-deployment requirements attached.

For a vendor, the useful reading of all of this is that the sale is decided by the authorisation package and the negotiated terms, and the renewal is decided by whether the agency’s own compliance artefacts were producible. Building the evidence the buyer needs is a product feature in this market in a way it is not in most others.