AI Governance Institute
← News
Corporate Policy2026-10-25

GSA's Anti-Lock-In AI Clause Has an Enforcement Gap Resellers Cannot Close

What happened

The U.S. General Services Administration AI Strategies and Compliance Plan includes a procurement clause, now in effect, requiring AI contractors to support open export formats. It also bars terms that impair a buyer's ability to migrate to a different provider. A commentary published in Nextgov by Michael Garland of Garland LLC argues the clause has a structural enforcement problem. When agencies or enterprises buy AI through resellers or systems integrators rather than directly from the AI developer, the government has no direct contract with the developer. That means the portability obligations cannot reach the party who actually controls data formats, licensing policies, and migration tooling. The commentary cites Microsoft and SAP as examples of vendors whose global licensing terms are not subject to individual customer negotiation, illustrating how the flow-down mechanism fails in practice.

Why it matters

  • ·Procurement teams that rely solely on contract clauses to prevent vendor lock-in may have no enforceable rights against the AI developer who controls actual data formats and migration tooling. That developer is not a signatory to the contract.
  • ·Organizations buying AI through resellers or managed service providers should treat the underlying developer's license terms as a separate, uncontrolled risk. Global licensing policies from providers like Microsoft or SAP typically resist individual contract negotiation.
  • ·The U.S. General Services Administration AI Strategies and Compliance Plan is already in force. Federal contractors and enterprises benchmarking against federal procurement standards face this gap now, not at a future compliance date.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

PRC-001AI Vendor Due DiligencePRC-002AI Contractual RequirementsPRC-005AI Procurement Risk AssessmentPRC-009AI Vendor Concentration Risk AssessmentDGC-005Cross-Border Data Transfer Controls for AI

What to do now

  • ☐Map every AI procurement to identify whether the contract is with the AI developer directly or with a reseller or integrator, and flag cases where the developer is not a party to the agreement.
  • ☐Request copies of the underlying AI developer's standard license terms for each reseller relationship, and assess whether those terms permit data export, format portability, and migration without penalty.
  • ☐Ask your legal and procurement teams whether any portability or anti-lock-in clause in your current AI contracts can actually be enforced against the developer who controls the data and the platform, not just the reseller.
  • ☐For high-dependency AI systems, evaluate whether a direct contract with the AI developer is feasible, or whether an escrow or data portability agreement with the developer should be added as a condition of the reseller arrangement.
  • ☐Add a vendor concentration risk review to your next AI procurement cycle that accounts for the reseller layer, not only the platform vendor named in the contract.

What to watch next

Federal procurement guidance on AI vendor relationships is likely to evolve as the enforcement gap identified in practitioner commentary draws attention from acquisition policy staff and oversight bodies. Compliance teams should monitor whether GSA or the Office of Management and Budget (OMB) issues supplemental guidance requiring direct privity with AI developers for high-value or high-dependency procurements. The HHS sole-source Anthropic award has already put AI vendor lock-in under federal scrutiny, and further oversight action in this area is plausible in the near term.

Related Coverage

Corporate Policy2026-11-09

OpenAI's Transparency Blueprint Puts AI Infrastructure Risk on the Compliance Agenda

After the 2026 midterm elections, ballot measures restricted data center construction across the US. OpenAI responded by publishing a compute campus policy blueprint. It commits to ending non-disclosure agreements with local officials and disclosing environmental impacts. Compliance teams need to add vendor infrastructure exposure to procurement and vendor risk programs.

Enforcement2026-11-07

SpaceXAI Faces $6M in Fines for Unpermitted Mississippi Data Center Construction

Mississippi state regulators issued notices of violation to SpaceXAI subsidiary MZX Tech LLC in July 2026. The violations concern construction on roughly 30 acres of its Southaven data center campus without required stormwater permits. Potential fines reach $6.1 million at $25,000 per day. A federal court separately ruled that state regulators had improperly allowed 69 natural gas turbines to operate without air permits, a finding central to an ongoing NAACP lawsuit.

Corporate Policy2026-11-04

Google's AI Bundling Threat to Schools Exposes Coercive Adoption Risk

Google told K-12 schools they would lose Google Search access unless they opted in to AI features. This bundled essential service access with Gemini adoption. The plan drew antitrust criticism from lawmakers and former Federal Trade Commission Chair Lina Khan, who cited existing court findings of Google's monopoly liability. Following swift backlash, Google revised the plan so that Gemini, Gemini Notebook, and Search would each be off by default and independently switchable.