Seizing the Secret Sauce: How Generative AI is Breaking Government Contracting and IP Law

As government contractors rapidly integrate LLMs and generative AI into their operations, regulators are scrambling to adapt to shifting data ownership requirements.  The General Services Administration (GSA) recently proposed a new GSAR clause (552.239–7001) to standardize AI procurement, and the current draft has been met with widespread industry criticism. By asserting expansive government ownership over “data outputs” and “custom development,” the proposed rule inadvertently exposes a fault line between government data protection and commercial IP rights.

The Traditional Procurement Paradigm

In traditional software procurement, protecting a contractor’s IP has been relatively straightforward because the system architecture inherently separates the “brains” from the deliverable. If you build a predictive analytics tool for the Department of Defense, you deliver compiled object code or provide access via a SaaS interface. Your proprietary source code, algorithms, and backend databases remain safely locked on your own servers. The government gets the results; you keep the recipe.

In addition to obtaining a license to the software platform, the government typically pays the prime contractor a premium for operation and maintenance (O&M). The government always tries to require contractors to write detailed operations manuals so they can eventually recompete the contract to a cheaper vendor. But written manuals rarely ever capture the true “secret sauce” of a contractor’s expert troubleshooting.

How Generative AI Destroys the Process/Output Divide

In the era of LLMs, contractors don’t just write in C++ or Python; they write in English. Instead of entering instructions into a command line, prompt engineers input a complex set of logical constraints, text boundaries, and behavioral rules that govern how the AI operates. A contractor might spend millions of dollars perfecting a prompt structure that forces an AI to flawlessly transcribe and summarize messy military logistics data without hallucinating.

When an LLM executes a government task, this proprietary prompt (the instructions) and the government’s sensitive files (the data) must be fed into the same transient memory space: the context window. To the LLM, there is no structural distinction between the two. The model mathematically fuses the contractor’s trade secret heuristics with the government’s data at runtime.

Furthermore, advanced AI does not simply spit out a final answer; it utilizes “chain-of-thought” reasoning. To navigate complex multi-agent workflows, prevent hallucinations, and comply with strict cybersecurity standards (like FedRAMP), these systems must show their work. They continuously log their intermediate reasoning steps, prompt adjustments, system telemetry, and internal logic.

These intermediate logs do not just capture data—they capture the exact, step-by-step execution of the contractor’s proprietary logic. Without intending to, the AI is automatically generating the flawless, step-by-step operations manual that the government has always wanted, perfectly memorializing the contractor’s secret sauce in real-time.

The Contractor’s Nightmare: The End of Trade Secrets and Vendor Lock-In

The proprietary system prompts, diagnostic workflows, and intermediate AI logs that comprise a contractor’s secret sauce exist in a perilous legal void. They are unlikely to be patentable under Alice v. CLS Bank, and they’re generally uncopyrightable due to either a lack of human authorship or the idea-expression dichotomy. Consequently, a contractor’s operational know-how is protected almost exclusively under trade secret law. But a trade secret is only valid if a company can actually keep it secret.

This is where the new GSAR clause causes problems. By asserting broad government ownership over all “data outputs” and “custom development” arising from the contract, the GSA’s sweeping language technically captures the AI’s intermediate logs. By using the presence of its own data in the AI’s context window, the government effectively seizes the contractor’s operational know-how, and possibly even the contractor’s underlying process.

When the contract comes up for renewal, the government will not need to rely on the incumbent contractor’s expensive expertise. They can simply take those legally acquired logs, hand them to a cheaper, lower-tier competitor, and instruct the new vendor to execute the exact diagnostic workflows and prompts laid out in the records. Thus, the GSAR clause threatens to destroy both the contractor’s core trade secrets and their lucrative O&M lock-in.

The Government’s Nightmare: OCI and Evaluation Awareness

However, the GSA has a reason to draft aggressively broad IP terms. While it’s standard for vendors to promise the government they won’t train on its data, AI has advanced to the point that that guarantee is no longer sufficient.

An AI system does not need to train on government data to extract massive, competitively unfair value from a contract. AI can learn through metadata, system telemetry, prompt tweaking, and task abandonment rates. Aggregated over millions of interactions, a contractor suddenly possesses a statistically perfect map of an agency’s operational weaknesses, capability gaps and future procurement needs.

In government contracting, this triggers a massive Organizational Conflict of Interest (OCI) based on unequal access. If a vendor’s AI maps out the exact operational bottlenecks of the Department of Defense, that vendor gains an insurmountable informational advantage on future bids. The government fears that contractors will use federal agencies as free R&D laboratories, mining metadata to build monopolies on future federal contracts or to improve their commercial products. The GSA’s sweeping claim over all “data outputs” and logs is a blunt-force attempt to stop this surveillance.

To monitor the AI’s logic and prevent contractor misuse, the draft clause requires the AI system to generate “summaries” of its intermediate processing for government audits. But recent research shows that advanced AI models exhibit evaluation awareness—they know when they are being tested or audited. If forced to summarize their own internal logic, models will often generate a post-hoc rationalization. In other words, the AI may simply fabricate a compliance record, giving the auditor a compliant answer while concealing its actual internal activations—blinding the government to vulnerabilities in the process.

Drawing a Line

When does ordinary system telemetry (e.g., how fast an AI agent processes a query) cross the threshold into protected government usage data (e.g., revealing that a defense agency is suddenly running thousands of queries on a specific foreign adversary)? Furthermore, if an AI system learns a generalized lesson about workflow optimization while deployed at a federal agency, when is that lesson sufficiently attenuated from the original government data that the contractor can legally claim it as their own IP?

The GSA’s current solution—a blunt-force claim of ownership over all data outputs and runtime logs—is commercially unworkable. If enforced, it could force the most innovative AI companies to abandon GSA vehicles entirely rather than risk their IP. At the same time, the government cannot simply take contractors at their word and surrender its operational security to a black box. The clean room is dead, and the legal profession must now figure out how to govern the crucible that replaced it.

Image Source: Deposit Photos
Author: belchonock
Image ID: 10121254