The most exciting federal AI language of 2026 is buried in a scoping services contract, and it has nothing to do with buying AI.
The government contracting world has spent eighteen months covering the post-OMB M-25-22 wave of AI contract language as a burden.
- Gibson Dunn’s analysis of GSA’s draft AI clause is representative: new disclosure requirements, new use-rights obligations, new contractor exposure.
- PilieroMazza told contractors to brace for AI-specific solicitation provisions. The framing is defensive everywhere you look.
Then USTDA quietly published the counterexample. Its Indo-Pacific Digital Infrastructure Project Scoping Services solicitation, contains a fully built AI-use regime in Section D.1.8.3 of its performance work statement.
It is among the first complete specimens I have seen of a federal agency regulating how a contractor uses AI to produce professional knowledge work itself, rather than governing AI systems sold to the government.
Most of the AI procurement debate is about the second problem. The faster-spreading problem is the first: ordinary consulting, feasibility, due diligence, and assessment contracts where AI enters the work without ever being named as the deliverable.
USTDA’s answer is a permission slip, not a prohibition. Every agency writing an AI clause this year, and every donor who will copy one next year, should start from this template.
Sign Up Now for more AI procurement insights
It Builds a Permit Office, Not a Fence
The clause defines AI tools broadly, as “any software, platform, or application that uses machine learning, large language models, generative AI, or similar technologies to produce, summarize, analyze, translate, or otherwise process information.” Then it does something no responsible-AI framework I have read has done. It creates a working permitting system.
Incidental use, grammar and style checking, translation assistance, general research support, is allowed without approval, provided no confidential or proprietary information enters any tool, qualified personnel review and verify outputs, and the tools are “developed and produced in the United States.”
Substantive use, generating analytical content or recommendations that form material components of a deliverable, or processing documents from project sponsors, requires prior written approval from the contracting officer’s representative.
The request must name the tool, its developer, its country of origin, the tasks, the data types, and the human-review safeguards. Approvals get logged in the contract’s deliverables tracker. Substantive AI use gets disclosed in the deliverable itself, identifying the tools used and the nature of their use.
Here is the tell that this architecture expects approvals to be granted: the COR must respond to a substantive-use request within 10 business days, and approval may be granted, granted with conditions, or denied.
You do not write a service-level agreement and a conditional-approval pathway into a clause designed to discourage the thing it governs. Agencies do not bind their own staff to response deadlines for requests they intend to deny.
This is a clause built by an agency that needs its contractors to use AI and wants to know how they are using it. That combination, license plus visibility, is what every responsible-AI statement in our sector has gestured at and never operationalized.
USTDA turned it into contract administration:
- Was sensitive data entered into a tool?
- Where was the tool developed?
- Was the use incidental or substantive?
- Did the COR approve it?
- Was it disclosed?
- Did a qualified person verify the output?
The Tempo Proves the Model Is Honest
What makes this specimen credible rather than aspirational is the contract it sits inside.
The same performance work statement demands preliminary assessments in 14 calendar days, and full project reports, each containing:
- terms of reference,
- detailed activity budget,
- infrastructure risk screening,
- US export potential table by equipment category,
- financing due diligence requiring direct contact with the Asian Development Bank, World Bank Group, IFC, EXIM, and DFC,
Up to 15 project reports per awardee over 24 months, on a 100 percent small business set-aside under NAICS 541690. USTDA split the work into two awards explicitly to more effectively manage bandwidth given the high volume of proposals.
That is knowledge work at a tempo no boutique hits in 2026 without AI leverage on research synthesis, document analysis, and drafting.
An agency that banned AI on this contract would be writing fiction.
An agency that ignored AI would be inviting analysts to quietly paste sponsor documents into unapproved tools, which is the real nightmare scenario, and this solicitation already thinks in False Claims Act terms: its DEI clause, a FAR 52.222-90 deviation, expressly makes compliance “material to the Government’s payment decisions for purposes of 31 U.S.C. 3729(b)(4).”
A disclosure duty without a workable approval pathway manufactures exactly the hidden noncompliance FCA theories get built from. The permitting pathway is what makes honesty the cheaper option.
I cannot document that anyone at USTDA designed this deliberately. The evidence points to template drafting: the solicitation’s instructions still tell offerors to demonstrate “experience developing successful healthcare infrastructure sector projects,” a line pasted from some earlier healthcare RFP into a digital infrastructure contract.
The clause is defensive boilerplate flowing down from OMB policy. It happens to be good boilerplate, and the effect matters more than the intent: wherever this architecture lands, demonstrated AI governance becomes a de facto discriminator, because the evaluated work plan has to be feasible against the contract’s tempo, and feasibility now runs through AI fluency.
No agency has to score AI as an evaluation factor for that to be true.
What Agencies Copying It Should Fix
The template has one genuine defect, and it is instructive. The clause requires even incidental-use tools to be developed and produced in the United States, echoing M-25-22’s buy-American AI policy.
M-25-22 itself excludes common commercial products with embedded AI, the word processor and the map app, from its scope. The USTDA clause carries no such carve-out, which means its literal text sweeps in the spell-checker on every contractor laptop.
This is the waterfall pattern to watch as AI governance flows from OMB memo to agency template to contract clause: each layer adds conservatism, and at the bottom, the literal text becomes uncompliable with a 2026 software stack.
So the fix list for the next agency, and the next donor, is short.
- Keep the incidental-versus-substantive distinction, the named-tool approval request, the response-time SLA, the tracker, and the deliverable-level disclosure.
- Add M-25-22’s embedded-AI carve-out.
- Define what “developed and produced in the United States” means for a SaaS product with multinational infrastructure, because contractors cannot self-certify a phrase the government has not defined.
USTDA’s own clause anticipates iteration; its policy-updates provision lets the agency revise AI requirements mid-contract. Good. This is a v1 that deserves a v2, not a framework that deserves a shelf.
What Implementers Should Do Now
This architecture will not stay inside USTDA, and it will not stay inside contracts.
GSA’s draft GSAR deviation already requires contractors to disclose all AI systems used in contract performance, not just those sold to the government, and bars non-US AI systems in performance outright.
Cognition is becoming a country-of-origin question, the same dynamic I have been tracking in the sovereign AI series, now arriving in professional services task orders. Donors and foundations copy federal clause architecture within a funding cycle or two.
Grantees should expect incidental-versus-substantive distinctions, disclosure duties, and tool provenance requirements in grant agreements before the end of 2027.
Here is why that should excite you rather than worry you.
The capability these clauses reward is organizational discipline, something any competent organization can build in weeks. Not capital, not headcount, not incumbency.
- Stand up a tool registry: names, developers, countries of origin, data boundaries.
- Build human-review gates and provenance tracking into the drafting workflow, with independent verification of factual claims against primary sources, which is what the USTDA clause demands anyway and what good analysis demanded before AI existed.
- Template your disclosure language now, before a contract requires it.
This is the same shift I described when I argued that $250,000 NGO software procurements are dead: the technology is now the cheap part, and the judgment wrapped around it is the value.
- Organizations that treat AI governance as an operating capability will find that every clause like this one converts their discipline into a moat, because it eliminates competitors who treat governance as a legal review gate.
- Organizations that read these clauses defensively will price themselves out of the delivery tempo or drift into the quiet noncompliance the clauses exist to prevent.
Everyone in this sector has access to AI. The organizations still doing this work in three years will be the ones with permission to use it, in writing, logged in the tracker. The paperwork is the moat.
