Artificial intelligence is rapidly transforming how government contractors develop proposals, manage contracts, write software, analyze data, and perform countless other functions. Tools such as ChatGPT, Claude, Microsoft Copilot, and Google Gemini promise significant gains in efficiency and productivity, but they also raise complex legal, contractual, and cybersecurity questions. As federal agencies continue to develop agency-specific AI policies and procurement requirements, contractors are increasingly asking whether they can use AI at all, whether generative AI tools are permitted under federal contracts, and what compliance obligations accompany their use.

So, can government contractors use AI? The short answer is yes. Government contractors generally may use AI, including generative AI, unless a contract, solicitation, agency policy, or applicable law prohibits or limits its use. However, the legal analysis rarely ends there. Contractors must carefully evaluate contract and solicitation requirements, protect government information, comply with cybersecurity obligations, and understand when AI use may need to be disclosed to the government.

How Government Contractors Can Use AI

In most circumstances, government contractors are permitted to use AI in performing federal contracts. Neither the Federal Acquisition Regulation (FAR) nor most agency supplements impose a blanket prohibition on AI technologies. That said, categorical restrictions tied to specific AI systems are beginning to appear in individual acquisition programs. For example, Section 1532 of the Fiscal Year 2026 National Defense Authorization Act (NDAA) bars DoD contractors from using certain “covered artificial intelligence” — including AI systems developed by China-based DeepSeek — when performing on DoD contracts, showing that agency- or program-specific prohibitions can arise even without a government-wide ban.

Instead, AI should be viewed like any other business technology. Whether its use is appropriate depends on the terms of the contract, the nature of the work being performed, the type of information involved, and any agency-specific policies governing contractor performance.

Many contractors already use AI to draft proposal content, summarize large volumes of technical documents, analyze procurement data, generate software code, review contracts, assist with research, create reports, and automate administrative tasks. These applications often present relatively low legal risk when implemented with appropriate safeguards.

Using AI to fulfill core contract requirements, however, requires considerably more scrutiny. If AI assists with engineering, software development, cybersecurity operations, technical analysis, medical services, financial decisions, or other mission-critical functions, contractors should ensure that the technology satisfies contractual quality requirements and that qualified personnel continue to provide appropriate oversight. Ultimately, contractors — not AI providers — remain responsible for contract performance.

What AI Tools Are Allowed Under Federal Contracts?

There is no government-wide list of approved or prohibited AI tools for federal contractors.

Whether a contractor may use a particular platform depends on several factors, including agency guidance, contractual restrictions, information security requirements, licensing terms, and the sensitivity of the information being processed (see, e.g., The Government’s Attempted Anthropic Ban: What Government Contractors Should Be Doing Now).

Many contractors use commercially available AI platforms, including ChatGPT, Claude, Microsoft Copilot, Google Gemini, and enterprise AI solutions that operate within secure environments. Increasingly, organizations are also deploying internally hosted large language models that never transmit sensitive information to public AI services.

The appropriate tool often depends on the data involved. Public AI platforms may be appropriate for drafting marketing materials or brainstorming internal documents, while contracts involving Controlled Unclassified Information (CUI), classified information, export-controlled data, proprietary government information, or personally identifiable information typically require significantly greater safeguards — or may prohibit the use of certain external AI services altogether.

GSA has proposed what would be the first stand-alone, AI-specific safeguarding clause in the federal acquisition system — GSAR 552.239-7001, most recently revised in June 2026 as Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems — which would flow down data-handling, disclosure, and use-rights obligations for GSA Multiple Award Schedule contracts whenever a large language model processes government data. Public comment on the current draft closed August 3, 2026, and contractors should expect similar clauses to migrate to other acquisition vehicles regardless of the rulemaking’s ultimate outcome.

Contractors should also recognize that agency requirements continue to evolve. Some agencies have issued internal guidance governing employee and contractor use of generative AI, while others are developing procurement clauses addressing AI risk management, transparency, cybersecurity, and responsible AI deployment. For a deeper look at how these dynamics are unfolding on defense contracts specifically, see this BuildSmart post from May 2026, “Artificial Intelligence in Defense Contracting: What Contractors Need to Know Now.”

Can Contractors Use ChatGPT?

One of the most frequently asked questions is whether government contractors may use ChatGPT in connection with federal contracts. The answer is generally yes, but only if doing so complies with the contractor’s contractual obligations and internal governance policies.

ChatGPT can provide efficiencies in drafting documents. At the same time, contractors must understand that information entered into an AI platform may be subject to the provider’s terms of service and data handling practices.

Before using ChatGPT or any similar generative AI tool, contractors should determine whether government information, proprietary data, export-controlled information, CUI, or personally identifiable information will be processed. If so, additional contractual, cybersecurity, and legal restrictions may apply.

Human review also remains essential. AI-generated content can contain factual inaccuracies, fabricated legal authorities, incorrect citations, outdated information, or incomplete analyses. Contractors remain responsible for ensuring that all deliverables submitted to the government are accurate, complete, and compliant with contractual requirements.

What Are the Risks of Generative AI for Government Contractors?

Although generative AI offers significant opportunities, it also creates legal and contractual risks that government contractors should not underestimate. Perhaps the most immediate concern involves the protection of sensitive information. Contractors frequently possess confidential government information, source selection information, proprietary contractor data, CUI, and export-controlled technical data. Uploading such information into an unauthorized AI platform could create cybersecurity, contractual, and regulatory concerns.

Accuracy presents another significant challenge. Generative AI systems sometimes produce convincing but incorrect answers, commonly referred to as “hallucinations.” If contractors rely on AI-generated analyses without appropriate review, they risk submitting inaccurate proposals, defective deliverables, or erroneous technical recommendations.

Intellectual property issues also continue to evolve. Questions regarding ownership of AI-generated work product, copyright protection, training data, licensing rights, and potential infringement remain the subject of ongoing litigation and regulatory attention. Contractors should ensure that AI-generated deliverables do not inadvertently incorporate protected third-party content or violate licensing restrictions.

Generative AI also creates compliance risks under existing procurement rules. Contractors remain responsible for maintaining adequate internal controls, safeguarding government information, complying with applicable cybersecurity requirements, and ensuring that AI-assisted work satisfies contract specifications. AI cannot shift those legal responsibilities to a technology provider. On the defense side, Section 1513 of the FY2026 NDAA directs the Department of Defense to develop a dedicated cybersecurity and physical security framework for AI and machine learning systems and to incorporate that framework into the DFARS and the Cybersecurity Maturity Model Certification (CMMC) program, meaning contractors that develop, deploy, store, or host AI/ML for DoD should expect new flow-down security requirements in the near term.

Finally, contractors should recognize the reputational risks associated with AI misuse. Agencies increasingly expect transparency, accountability, and responsible deployment of emerging technologies, particularly where AI influences decision-making or contract performance.

Does the Government Regulate AI in Federal Procurement?

Federal regulation of AI is expanding rapidly, although it remains fragmented across statutes, executive actions, agency guidance, procurement policies, and contract clauses. Rather than creating a single comprehensive AI regulation, the federal government has largely incorporated AI governance into existing procurement, cybersecurity, privacy, ethics, and risk management frameworks.

That framework now includes Executive Order 14179 and OMB Memoranda M-25-21 and M-25-22 (governing agencies’ own AI use and acquisition), the Department of Defense’s January 9, 2026 AI Strategy and companion innovation memorandum, and Sections 1512, 1513, 1532, and 1533 of the FY2026 NDAA (addressing AI/ML cybersecurity policy, a forthcoming AI/ML security framework, prohibited AI systems, and ethical-use frameworks, respectively).

Federal agencies continue developing AI-specific acquisition policies addressing responsible AI development, cybersecurity, transparency, testing, validation, bias mitigation, and human oversight. At the same time, procurement officials are increasingly evaluating how contractors incorporate AI into contract performance.

Contractors should expect additional solicitation provisions and contract clauses addressing AI over the coming years. Agencies are likely to require greater transparency regarding AI-enabled products and services, particularly where AI performs mission-critical functions or supports decision-making affecting government operations. Accordingly, contractors should closely monitor procurement developments and evaluate how evolving AI requirements may affect future competitions. GSA’s proposed GSAR clause 552.239-7001, discussed above, is a leading indicator of this trend: If finalized, it would be the first stand-alone AI safeguarding clause in the federal acquisition system and a likely template for similar requirements at other agencies.

How Should Government Contractors Disclose AI Use?

Whether contractors must disclose AI use depends largely on the solicitation, contract requirements, and the manner in which AI is being used. In many cases, no affirmative disclosure obligation exists merely because a contractor uses AI as an internal productivity tool. For example, using AI to assist with internal drafting, research, or administrative functions may not require any notification to the contracting agency if contract performance remains fully compliant.

The analysis changes, however, when AI materially affects contract performance, forms part of the contractor’s proposed technical solution, processes sensitive government information, or is specifically addressed in the solicitation or contract. In those circumstances, contractors should carefully evaluate whether disclosure is required and how AI use should be accurately described. OMB Memorandum M-25-22 already requires agencies themselves to test proposed AI solutions and assess associated risks before award, which in practice means contractors proposing AI-enabled solutions should expect closer government scrutiny of those capabilities during evaluation even where no separate disclosure clause applies.

Where disclosure is not expressly required, transparency often reduces risk. Contractors should avoid making misleading statements regarding the extent of human involvement, the capabilities of AI systems, or the manner in which deliverables are produced. Any representations made during the procurement process should accurately reflect how AI will be used throughout contract performance.

Equally important, contractors should maintain internal documentation describing approved AI tools, governance procedures, employee training, human review requirements, data protection controls, and approval processes. Such documentation can help demonstrate responsible AI governance if questions arise during performance, audits, or investigations.

Practical Steps Government Contractors Should Take Now

Artificial intelligence is quickly becoming an ordinary part of federal contracting, but its legal implications continue to evolve. Federal contractors should not assume that AI is either prohibited or unrestricted. Instead, they should establish governance frameworks that evaluate AI use through the lens of existing procurement law, cybersecurity obligations, intellectual property protections, and contractual requirements.

Government contractors should inventory where AI is currently being used across proposal development, contract performance, software engineering, legal review, human resources, and administrative operations. They should review existing contracts for restrictions on data handling, confidentiality, cybersecurity, and technology use. Internal AI policies should address approved platforms, employee training, data classification, human oversight, quality assurance, and documentation requirements. Contractors should also monitor new FAR provisions, agency guidance, and solicitation language that may impose additional AI-related obligations. In particular, contractors should track the status of GSA’s proposed GSAR clause 552.239-7001 and the implementing DFARS and CMMC changes required by Section 1513 of the FY2026 NDAA, both of which are likely to translate into binding contract requirements within the next year.

As AI regulation continues to develop, contractors that proactively implement responsible governance will be better positioned to leverage the technology’s efficiencies while reducing legal, contractual, and compliance risk.

Conclusion

AI has become an increasingly valuable tool for government contractors, but it is not a compliance-free technology. Federal contractors generally may use AI, including ChatGPT and other generative AI platforms, unless prohibited by contract, a solicitation, or agency policy. Nevertheless, every use case should be evaluated carefully to ensure compliance with procurement requirements, applicable laws and regulations, cybersecurity obligations, data protection rules, and contractual commitments.

The most successful contractors will be those that view AI not simply as a productivity tool, but as a technology requiring thoughtful governance, clear policies, appropriate human oversight, and ongoing legal review. As federal procurement continues to evolve, companies that establish strong AI compliance programs today will be better prepared to compete for and successfully perform the government contracts of tomorrow.