AI Governance Institute
← News
Corporate Policy2026-10-25

GSA's Anti-Lock-In AI Clause Has an Enforcement Gap Resellers Cannot Close

What happened

The U.S. General Services Administration AI Strategies and Compliance Plan includes a procurement clause, now in effect, requiring AI contractors to support open export formats. It also bars terms that impair a buyer's ability to migrate to a different provider. A commentary published in Nextgov by Michael Garland of Garland LLC argues the clause has a structural enforcement problem. When agencies or enterprises buy AI through resellers or systems integrators rather than directly from the AI developer, the government has no direct contract with the developer. That means the portability obligations cannot reach the party who actually controls data formats, licensing policies, and migration tooling. The commentary cites Microsoft and SAP as examples of vendors whose global licensing terms are not subject to individual customer negotiation, illustrating how the flow-down mechanism fails in practice.

Why it matters

  • ·Procurement teams that rely solely on contract clauses to prevent vendor lock-in may have no enforceable rights against the AI developer who controls actual data formats and migration tooling. That developer is not a signatory to the contract.
  • ·Organizations buying AI through resellers or managed service providers should treat the underlying developer's license terms as a separate, uncontrolled risk. Global licensing policies from providers like Microsoft or SAP typically resist individual contract negotiation.
  • ·The U.S. General Services Administration AI Strategies and Compliance Plan is already in force. Federal contractors and enterprises benchmarking against federal procurement standards face this gap now, not at a future compliance date.

Governance controls affected

PRC-001AI Vendor Due DiligencePRC-002AI Contractual RequirementsPRC-005AI Procurement Risk AssessmentPRC-009AI Vendor Concentration Risk AssessmentDGC-005Cross-Border Data Transfer Controls for AI

What to do now

  • ☐Map every AI procurement to identify whether the contract is with the AI developer directly or with a reseller or integrator, and flag cases where the developer is not a party to the agreement.
  • ☐Request copies of the underlying AI developer's standard license terms for each reseller relationship, and assess whether those terms permit data export, format portability, and migration without penalty.
  • ☐Ask your legal and procurement teams whether any portability or anti-lock-in clause in your current AI contracts can actually be enforced against the developer who controls the data and the platform, not just the reseller.
  • ☐For high-dependency AI systems, evaluate whether a direct contract with the AI developer is feasible, or whether an escrow or data portability agreement with the developer should be added as a condition of the reseller arrangement.
  • ☐Add a vendor concentration risk review to your next AI procurement cycle that accounts for the reseller layer, not only the platform vendor named in the contract.

What to watch next

Federal procurement guidance on AI vendor relationships is likely to evolve as the enforcement gap identified in practitioner commentary draws attention from acquisition policy staff and oversight bodies. Compliance teams should monitor whether GSA or the Office of Management and Budget (OMB) issues supplemental guidance requiring direct privity with AI developers for high-value or high-dependency procurements. The HHS sole-source Anthropic award has already put AI vendor lock-in under federal scrutiny, and further oversight action in this area is plausible in the near term.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Related Coverage

Corporate Policy2026-10-21

HHS Sole-Source Anthropic Award Puts AI Vendor Lock-In Under Federal Scrutiny

The U.S. Department of Health and Human Services disclosed its intent to award Anthropic a sole-source contract for Claude AI services, citing its existing enterprise deployment as justification. A government procurement law expert challenged the notice as an admission of vendor lock-in rather than a legitimate sole-source basis. The case is now a named federal example of the concentration and dependency risks that enterprise AI procurement programs must actively manage.

Corporate Policy2026-10-21

Anthropic S-1 Warns AI Liability Could Exceed Insurance Coverage

A leaked S-1 filing from Anthropic, reported by TechCrunch, discloses that liability from harmful AI behavior could exceed the company's available insurance coverage. The filing also reveals an $80.7 billion net loss in the first half of the year. Two customers account for roughly one-fifth of revenue. Relationships with AWS, Google, and Microsoft are deteriorating. These disclosures carry direct implications for enterprises that rely on Anthropic as a primary AI vendor.

Corporate Policy2026-10-23

Massachusetts $4.3M OpenAI Deal Exposes Resident Data Without Consent Controls

Massachusetts has contracted with OpenAI for roughly $4.3 million per year to deploy an AI assistant across nearly 40,000 executive branch employees. The system processes sensitive resident data, including tax records, housing information, and benefits documentation. No opt-in or opt-out mechanism exists for residents whose data the system may handle.