Procurement language

This page has contract language, questions for vendors, and a checklist for buying AI systems that can act. Copy them into solicitations, statements of work, and contracts, and fill in the bracketed values for your program.

These model clauses are not FAR or DFARS clauses. Review them with your contracting officer and counsel before using them.

How to use this page

Scope. Identify the actions the system will be able to take that change data, systems, funds, or equipment outside it, disclose information, have effects in the physical world, expand its own access, or call an outside service at material cost. Include statements that commit the organization, as clause C-1 does.

Require. Put the clauses below in the statement of work and the evaluation criteria, adjusting the bracketed values.

Evaluate. Ask the evaluation questions in oral presentations or written responses, and watch for the red flags.

Verify. Use the checklist at acceptance and at each option period, and run the verifier yourself.

Model clauses

Each clause names the property it enforces. You may copy the clauses without attribution.

C-1

Consequential action register

Before [production use | authorization to operate], the Contractor shall deliver a register of every action the AI system can take that changes state outside the AI system, including data, systems, funds, and equipment; discloses information; makes statements that commit the organization, such as prices, eligibility, refunds, or terms; produces effects in the physical world; expands the system’s own access; or invokes an external service at material cost. For each action class, the register shall identify the resources and data affected, whether the action is mediated by the external control layer, and the reason for any exclusion. The Contractor shall deliver an updated register within [10] business days of any change to the system’s tools, integrations, or credentials.

C-2

Complete mediation

Each action class designated in scope in the register shall take effect only through a control layer external to the AI system. The AI system shall not hold any credential, token, or network route that can reach an in-scope resource except through that layer.

C-3

Fail-closed behavior

If the control layer does not return an affirmative permit for an action, including on error, timeout, missing evidence, or loss of connectivity, the action shall not execute and the system shall enter the safe state defined in [the system security plan]. The Contractor shall demonstrate this behavior through fault-injection testing before acceptance and at least [annually] thereafter.

C-4

Independence

P2, P6

The control layer shall run outside the AI system’s process, identity, and credential boundary. No individual or service account shall hold administrative privilege over both the AI system and the control layer’s policies, signing keys, or records. [For high-impact use cases: The control layer’s signing keys shall be held by (the Government | a party independent of the AI system’s supplier).]

C-5

Human authority and stop

Action classes designated by the Government shall be held until a person with delegated authority permits or denies them. Authorized Government personnel shall be able to stop, revoke, or quarantine any agent, credential, or action class at the control layer, taking effect within [60 seconds], without the cooperation of the AI system or the Contractor.

C-6

Decision records

The control layer shall create a record of every decision, including denials and holds. Each record shall identify the proposing system and identity, the action and its parameters, the target resource, the policy version applied, the evidence considered, the decision and its reason, the authorizing person where applicable, and the time. Records shall be signed with keys the AI system cannot access; linked so that alteration, deletion, or reordering is detectable; retained for [at least six months | the period set by (records schedule)]; and delivered to the Government on request in a documented, machine-readable format.

C-7

Independent verification

P6, P7

The Contractor shall provide, at no additional cost, a verifier that the Government or its designee can run without network access to the Contractor. The verifier shall check record signatures and continuity and report any gap. The Contractor shall also provide test records, including altered, missing, and reordered records, that the verifier must reject.

C-8

Sequence monitoring

The control layer shall evaluate actions in sequence as well as individually, and shall deny or hold any sequence that together produces an outcome the policy would deny as a single action. The Contractor shall describe the method and demonstrate it with test cases before acceptance.

C-9

Conformance representations

Any representation that the system conforms to an AI control standard shall identify the standard and its version, the system boundary, the action classes covered and excluded, the conformance level where applicable, and the assessor. Unqualified representations such as “compliant” or “certified” do not satisfy this requirement.

C-10

Policy changes and incidents

Control-layer policies shall be versioned and made available to the Government in human-readable form. Changes to policies, action classes, or credentials shall follow [the program’s configuration management process] and shall themselves be recorded. The Contractor shall notify the Government within [72 hours] of discovering any action that took effect without a permit, any gap in the records, or any path that bypassed the control layer, and shall deliver the related records.

Evaluation questions

Ask for demonstrations, since an answer backed by a demonstration carries more weight than a description.

List all tools, credentials, and network routes your AI system has. Which of them can change something outside the system?

For each of those, does the action pass through a control layer the AI system cannot bypass? How is this verified?

What happens when the control layer is unavailable? Show us the test.

Who can change the policy? Can the same person or service account change the AI system?

Show us the record of a denied action. Can we verify it without your software or your servers?

Which actions with effects outside the system are not covered, and why?

How quickly can we stop one agent, one class of actions, or everything, and can we do it without you?

How would you detect a prohibited outcome split into smaller steps that are each allowed?

When you update or replace the model, what changes in what the control layer allows?

What do your conformance or compliance claims cover, and who assessed them?

Red flags

“The model is trained not to do that.”

“The agent is instructed to ask before acting.”

“We log everything,” with no decision made before the action.

The guardrail runs under the same service account as the agent.

Records exist only inside the vendor’s dashboard.

“Compliant” or “certified,” with no boundary, version, or assessor named.

Buyer’s checklist

Use the checklist at acceptance and at each option period. Your check marks are saved in this browser only.