GSA's AI Rule: What Small Business Must Know

GSA's proposed AI acquisition rule has been revised once, criticized thoroughly, and revised again — and it still can't tell you what an "AI system" means in a contract context. That's not an administrative hiccup. That's a structural problem that will shape how agencies write AI-related solicitations for the next several years.

Industry feedback from GSA's listening sessions has been consistent: the rule is too vague on definitions, too thin on evaluation criteria, and doesn't give contracting officers the specificity they need to write defensible award decisions. For large primes, that ambiguity is manageable — their legal and policy teams will negotiate interpretations. For small business contractors, it creates a different kind of problem: you can't position against a standard that doesn't exist yet.

Here's what the signal actually tells you.

The Vagueness Is the Feature (For Incumbents)

When a regulatory framework is ambiguous at the definitional level, it defaults to incumbency. Contracting officers writing AI-related solicitations will reach for vendors they already trust, evaluation language that mirrors past awards, and requirements that conveniently match what their current contractor already delivers.

That's not a conspiracy — it's how procurement works under uncertainty. When the rule doesn't tell a CO what "adequate AI transparency" looks like, they'll write requirements that describe what they've already seen work. Which means [Incumbent Vendor] wrote the template.

This is why the GSA listening session feedback matters as a BD signal, not just a policy development moment. The complaints about vagueness are coming from large AI companies whose lobbyists can push for clearer definitions. Small business doesn't have that seat at the table. But you can read the outcome and position accordingly.

What the Rule Actually Covers (So Far)

The proposed rule attempts to establish baseline requirements for federal acquisition of AI systems — covering things like transparency, testing, human oversight, and documentation. The problem, per industry stakeholders, is that none of those categories are defined with enough precision to be actionable.

What does "adequate human oversight" mean for a predictive analytics tool used in a grants management workflow versus an autonomous decision-support system for logistics? The rule doesn't distinguish. What constitutes an "AI system" as opposed to a software product with machine learning features? Still unclear.

The GSA regulatory docket is worth tracking directly — but as of now, what you're monitoring is a moving target.

For BD purposes, the practical effect is this: agencies that want to buy AI will write their own interpretations. Some will write performance-based SOWs with flexibility. Some will write hyper-specific requirements that describe exactly one product. Both patterns create different opportunity profiles, and you need to know which one you're looking at before you spend proposal dollars.

Where the Real Opportunity Lives for Small Business

Despite the regulatory fog, AI acquisition spending is moving — with or without a clean rule. The question is where small business can realistically compete.

Agency-specific AI vehicles are your near-term target. Several agencies are standing up their own AI acquisition vehicles, task order structures, or OTA agreements that sit partially outside the GSA framework. The Agile Defense OTA award to deliver a workforce AI tool to NORAD and USNORTHCOM is a current example of this pattern: agencies using OTA authority to move faster than the FAR-based rule can catch up.

OTA agreements are structurally friendlier to small business in some respects — the consortium model allows for subcontracting pathways that wouldn't exist in a traditional acquisition — but they also favor firms that already have relationships inside the acquisition office. Knowing which agencies are using OTAs for AI before the solicitation drops is worth more than any compliance framework.

Niche AI applications beat general-purpose claims. A small business saying "we do AI" will lose to every large prime every time. A small business that can say "we deliver AI-assisted document review for [specific agency workflow] with demonstrated accuracy metrics and an authority-to-operate pathway" is competing on a different field. The rule's vagueness actually helps here: if the standard is fuzzy, specialized demonstrated performance becomes the de facto evaluation criterion.

The compliance stack around AI is where small business can differentiate. Regardless of what the final rule says, agencies will need help with AI governance documentation, responsible AI frameworks, and ATO support for AI systems. That's a services layer that doesn't require being an AI developer — it requires understanding the emerging regulatory environment and having the past performance to back it up.

The VA's AI deployment for claims processing is under congressional scrutiny right now, which creates both a cautionary tale and a template. Agencies that are moving aggressively on AI will face oversight pressure, which means they'll need contractors who can document compliance — not just deliver capability. That's a gap small business can fill.

How to Read AI Solicitations While the Rule Is Still Vague

Until GSA finalizes language that actually tells contracting officers how to write AI requirements, you'll see solicitations using inconsistent, agency-specific terminology. Here's a triage framework:

Look for specificity in the evaluation criteria. If an RFP uses vague language like "AI-enabled solution" without defining what that means, and the evaluation criteria emphasize "prior federal AI experience" without scoping it — that's a wired solicitation pattern. Agencies that are genuinely competing AI work will define the technical requirements precisely enough to evaluate them.

Watch the incumbent's contract history. Before you bid any AI-adjacent task order, pull FPDS data on the agency's prior AI or analytics spend at usaspending.gov. If one contractor has delivered similar work for the past two years and the CO hasn't issued an RFI or sources sought, the probability that this is a competitive award is low.

Track the requirements for AI documentation separately from AI delivery. Some solicitations are asking for responsible AI documentation, testing records, or bias audits as deliverables — but those requirements often don't appear in the primary NAICS code. Solicitations in IT consulting or program management codes can carry AI governance requirements that you won't catch if you're only searching AI-specific codes.

This connects directly to bid strategy fundamentals — the question isn't whether you can deliver AI capability, it's whether the acquisition structure gives you a realistic path to award.

The Positioning Window (And How Long It Lasts)

Right now, there's a 12-to-18-month window where the regulatory definition of "AI acquisition" is still being written. Agencies are experimenting. COs are uncertain. That means the precedents being set by early awards will define what "acceptable AI delivery" looks like in federal solicitations for years.

Small businesses that build relationships with agency AI leads, contribute to capability demonstrations, and establish past performance on even modest AI-adjacent task orders now will be the firms whose proposal language mirrors the evaluation criteria when the rule solidifies.

That's not a long window. And it's the kind of positioning that only works if you're selecting targets with discipline — not chasing every AI-tagged solicitation that shows up in SAM.

For BD teams trying to allocate pursuit resources, the discipline question here is the same as it always is: which of these opportunities gives you a realistic path to award, and which ones are consuming proposal budget on structurally wired procurements? The GSA rule's ambiguity makes that harder to answer from solicitation text alone — which means your pre-solicitation intelligence has to work harder.

If you're evaluating AI-adjacent pursuits right now, the methodology in wired RFP detection applies directly. Vague requirements, missing specifications, and incumbent-shaped evaluation criteria look the same whether the procurement is for cloud infrastructure or an AI system.

The rule will get clearer. The positioning window will close. The contractors who used the ambiguity as a signal rather than waiting for clarity will have the past performance that matters when it does.

Plug your own numbers in — AI task order pursuits have highly variable PWin depending on your incumbent position, and the math often tells a story your BD instincts won't:

Frequently Asked Questions

Does the GSA AI acquisition rule apply to small business set-aside contracts?

The proposed rule would apply to federal AI acquisitions broadly, including set-aside contracts, but implementation will depend on how agencies interpret and incorporate the requirements into their individual solicitations. Until the rule is finalized, you'll see significant variation in how agencies handle AI requirements in set-aside work.

How should small businesses track changes to the GSA AI rule?

Monitor the Federal Register and the acquisition.gov regulatory docket directly. More practically, track agency-specific AI policy memos and statements from CIOs — agencies will often operationalize their interpretation of the rule before the final text is published, and those interim documents are more actionable than the rule itself.

Is AI past performance required to compete on AI task orders?

Not universally, but it's increasingly a competitive differentiator. Agencies writing AI solicitations under vague regulatory frameworks tend to lean on past performance as a proxy for evaluating capability they can't fully specify. Even modest AI-adjacent past performance — analytics support, AI governance documentation, ML model testing — is better than none.

Should small businesses wait for the final rule before pursuing AI opportunities?

No. The firms that wait for regulatory clarity will have no past performance when the rule solidifies. The positioning window for establishing AI credentials in federal contracting is open now, while the standards are still being written. The risk is chasing low-PWin opportunities — which is a targeting problem, not a timing problem.