Artificial intelligence is becoming part of everyday work. Employees are using it to summarize documents, draft content, search information, analyze data, and complete administrative tasks more quickly.
For Tribal Nations and tribally-owned organizations that participate in federal contracting, however, AI use can introduce questions that go beyond productivity. For example:
- A staff member uses an AI tool with information connected to a federal contract.
- A vendor deploys an AI feature into a platform that already handles sensitive information.
- A subcontractor uses a model that processes Federal Contract Information (FCI), Controlled Unclassified Information (CUI), or other protected data.
In each case, AI use may intersect with requirements that already exist in a contract.
During a recent webinar presented by Arctic IT and BakerHostetler, the speakers emphasized that the language of your contract matters.
A federal contract is bigger than just an agreement to deliver services. Depending on the agency, award, and type of information involved, it may also require a Tribal Nation or organization to follow specific cybersecurity, data handling, audit, records retention, vendor, and reporting requirements.
For organizations beginning to establish AI governance, the contract is one of the most important places to start.
Start With the Obligations You Already Have
Federal contracting can create a range of compliance responsibilities.
Some contracts may require specific cybersecurity protections, while others may establish requirements for records retention, audits, agency investigations, cooperation, or the handling of certain types of information. Additional requirements may apply depending on whether an organization is working with the Department of Defense or another federal agency.
These responsibilities can also extend beyond the prime contractor. As Jon Knight, Counsel at BakerHostetler, explained when discussing cybersecurity requirements, obligations can flow “very, very far in the contract chain.” For organizations that work with subcontractors and technology vendors, this means the requirements contained in a federal contract may influence which systems, platforms, and AI tools can be used to perform the work.
Tribal sovereignty remains an important part of the discussion as well. Kimi Gordy, Partner at BakerHostetler, described sovereignty and contractual performance as two separate considerations. A Tribal Nation retains its sovereign status, but federal contracting can still create specific requirements related to how an award is performed.
As Gordy explained, “Tribal sovereignty doesn't necessarily allow a contractor to ignore your contractual obligations.” That makes contract review an important part of AI readiness.
Before an AI tool is approved for use in a federal contracting environment, organizations should understand what they have agreed to protect, what data is covered by those obligations, and what requirements may need to be passed to vendors or subcontractors.
Know the Data Sources Before Evaluating an AI Tool
Organizations often begin their AI conversations by asking whether employees can use Copilot, ChatGPT, Claude, or another platform.
A more useful starting point is understanding the information that will enter the tool. A Tribal Nation or tribally owned organization may manage many categories of information at the same time, including:
- Federal Contract Information (FCI)
- Controlled Unclassified Information (CUI)
- Financial information
- Employee information
- Tribal government records
- Member information
- Business information
- Cultural or community data
- Information developed independently from a federal contract
Federal contracts may define how certain data must be handled. Organizations should understand whether information was created under the contract, existed before the contract, or was developed using separate funding.
Gordy recommends reviewing how contracts define information. “It's good to understand how the contract is defining data,” she said. This will help determine which information is subject to federal contract obligations and which information remains outside those requirements.
For Tribal Nations, data governance can also support broader goals involving sovereignty and Tribal control. Organizations may choose to establish their own classifications for Tribal information, internal rules governing access, or policies defining how data may be used. These internal protections can operate alongside contractual requirements that apply to federal information.
Consider the Six Pillars of AI Compliance
The webinar introduced six areas that can form the foundation of an AI compliance program: Governance, Security, Transparency, Validation, Accountability, and Supply Chain.
Together, these pillars provide a useful structure for evaluating AI use in a federal contracting environment.
1. Governance
Governance establishes the rules for AI use.
This can include policies, ownership, approval processes, and escalation procedures. Organizations should define which tools are approved, which uses require review, and who has authority to make AI-related decisions. Knight described governance as grasping “how are you going to understand and manage the use of AI within your organization?”
A governance process may also include an intake procedure for employees who want to use a new AI tool.
2. Security
Security focuses on the data, systems, and access controls surrounding AI.
Written policies should be supported by technical controls that help enforce them. Organizations need to understand where sensitive information resides, who can access it, and whether AI tools meet the security requirements associated with that information.
In a federal contracting environment, those requirements may be determined by the contract and the classification of the data.
3. Transparency
Transparency means understanding how AI is being used across the organization.
This includes maintaining an inventory of tools, identifying use cases, and understanding what data is moving into and out of AI systems. Knight explained that organizations should be able to understand “what data is being put in from the outset, and where did we get it? What models are being used, and what is the output?”
That visibility becomes especially important when multiple departments or vendors are adopting AI at different times.
4. Validation
AI-generated information needs to be reviewed according to the risk of the use case.
A low-risk use, such as helping draft an internal communication, may require a basic review. A higher-risk use involving financial reporting, contract deliverables, or sensitive data may require more extensive testing and monitoring.
The level of validation should reflect the potential consequences of an inaccurate output.
5. Accountability
Human responsibility remains part of AI use.
Employees and organizations are still responsible for the information they submit, the decisions they make, and the work products they deliver.
Knight emphasized, “As the contractor, you are responsible for the end result of what you are delivering to the government, and you are responsible for what happens to the data.”
Organizations should establish clear ownership for AI-assisted work and define when human review is required. Phillip Jackson, CIO at Arctic IT, describes this approach as keeping a “human in the loop.”
6. Supply Chain
AI systems may involve more vendors than are immediately visible.
A platform may rely on a separate model provider, cloud environment, plugin, or subprocessor to operate. Those relationships can introduce additional compliance and data-handling considerations.
Organizations should know which models and vendors are involved and whether federal requirements need to flow down to them. As Gordy described it, “the full breadth of everybody that's going to be touching the life cycle of that data.”
Before approving a tool for contract-sensitive work, review questions such as:
- Can the vendor use customer information to train AI models?
- Can data be reused for other purposes?
- Which subprocessors can access the information?
- Where is the data stored or processed?
- What security requirements apply to downstream vendors?
- What happens if a vendor changes its AI provider?
- Do contractual requirements need to flow down to a subcontractor or technology provider?
- Are there arbitration, indemnity, data ownership, or waiver provisions that require legal review?
Understand How AI Is Already Being Used
Formal AI governance likely isn’t the beginning of AI use within an organization. A recent study by IBM revealed that “while 80% of American office workers use AI in their roles, only 22% rely exclusively on tools provided by their employers.” If your organization has not yet put an AI usage policy into practice, employees may already be using personal AI accounts, free tools, meeting assistants, writing applications, or AI features built into existing software.
Jackson described conversations with tribally-owned organizations where employees acknowledged using personal AI tools for work. He emphasized the importance of first understanding what is already happening. “Tell me what you're using right now, today,” he said, “so that we can start to have that map.”
Taking this type of inventory can help organizations identify:
- Which AI products are already being used
- Which departments are using them
- What information is being entered
- Which vendors have added AI capabilities
- Which uses may conflict with existing contract requirements
- Which tools may be candidates for formal approval
After gaining visibility into employee AI use, Jackson encourages organizations to give employees clear guidance about approved tools rather than relying only on prohibitions. “Tell people what they can do, not just what they can't do,” he said.
Providing an approved option can reduce the likelihood that employees will seek unapproved tools to complete their work.
In Summary, Build a Practical AI Readiness Pathway
AI readiness for organizations engaged in federal contracting can be approached in stages.
A practical starting point is to focus on six activities:
- Review contract obligations. Identify requirements related to cybersecurity, CUI, FCI, records retention, reporting, audits, investigations, vendors, and subcontractors.
- Inventory current AI use. Ask employees, departments, contractors, and vendors which AI tools and AI-enabled applications they are already using.
- Identify and classify data. Document where contract information, CUI, Tribal data, financial records, and other sensitive information are stored and how they are accessed.
- Establish an AI governance team. AI governance should include more than IT. Legal, cybersecurity, procurement, contracting, operations, leadership, and employees who work directly with the data can all provide important input. Gordy specifically recommended involving “the people who are doing the day-to-day jobs, because they actually may know more about the data you have than anybody else.”
- Develop and publish an AI policy. The policy should identify approved tools, prohibited uses, data restrictions, approval processes, and escalation procedures.
- Train employees and begin with controlled use cases. Training should explain both the compliance requirements and the practical use of AI. Organizations can then begin with lower-risk pilots before moving to more automated or complex uses.
AI decisions ultimately involve organizational risk, data control, investment, and policy. For this reason, Tribal Council and executive leadership should have enough information to understand how proposed AI systems work and what information they will access.
Leadership does not need to become expert in every technical detail of an AI model. However, it does need enough information to evaluate whether the proposed use supports the Tribe's goals, protects its information, and satisfies applicable contractual requirements.
AI Readiness Begins with Understanding the Contract
AI offers significant opportunities for Tribal Nations and tribally owned organizations participating in federal contracting. Those opportunities can be pursued within a structure that supports compliance and keeps the organization in control of its information.
The starting point is understanding existing responsibilities.
Before approving an AI platform, review the contract. Identify the data that will be involved. Understand the applicable cybersecurity requirements. Review the vendor and its supply chain. Establish governance, security, transparency, validation, accountability, and supply-chain processes around AI use.
From there, Tribal Nations can establish an AI readiness pathway that supports responsible adoption while protecting both federal contract information and Tribal data.
If you’re currently engaged in federal contracting or considering doing business with the federal government, let’s have a conversation before AI becomes a contract or compliance issue. Between BakerHostetler and Arctic IT, we have a variety of legal, consultative, and project services available to help you on your AI journey. Connect with us today to get the conversation started.
By Phillip Jackson, Chief Information Officer at Arctic IT
