Federal AI Procurement: FAR/DFARS Requirements for Governed AI Agents

What FAR and DFARS actually require for AI systems

Neither FAR nor DFARS currently establishes a dedicated clause set that uniquely defines technical controls solely for autonomous AI agents. Relevant obligations come from existing rules that already apply when contractor systems process Federal Contract Information (FCI), Controlled Unclassified Information (CUI), or Covered Defense Information (CDI), and when AI is acquired as information technology or IT services.

FAR 52.204-21 requires basic safeguarding on covered contractor information systems that process, store, or transmit FCI. DFARS 252.204-7012 requires adequate security on systems that process, store, or transmit CDI and mandates cyber incident reporting. DFARS CMMC-related clauses, including 252.204-7021, require contractors to implement the Cybersecurity Maturity Model Certification level specified in the contract for protection of FCI/CUI as applicable. NIST SP 800-171 remains the common baseline flowed down for protecting CUI in nonfederal systems. FAR Part 39 can apply when AI is acquired as IT or IT services.

OMB Memorandum M-24-10 directs agencies to advance AI governance, inventory, risk assessment, and minimum practices for safety- and rights-impacting AI. Agencies remain responsible for AI risk management even when AI is procured from or operated by vendors, and should require contractual terms for performance, risk mitigation, and oversight. M-24-10 is not itself a FAR clause; contractual effect depends on how agencies implement terms in solicitations. NIST AI RMF 1.0 is a voluntary framework often referenced for maturity, not a substitute for mandatory safeguarding clauses. FedRAMP frequently applies when AI capabilities are delivered via cloud products and services used by federal agencies.

Why AI agents change the compliance boundary

AI agents that call tools, APIs, or external systems expand the contractor information-system boundary and create additional access paths to FCI, CUI, or CDI. Vendor-hosted model endpoints and retrieval or RAG pipelines may process federal data and therefore inherit safeguarding, continuous monitoring, and incident-reporting expectations.

In this architecture, policy statements, model cards, and pre-deployment assessments are insufficient on their own. Access-control and least-function expectations in federal cyber baselines map to runtime enforcement of identity, authentication, authorization, and least-privilege permissions for agent identities. System-and-communications protection and data-handling requirements map to tool-call mediation, allow/deny policy, and data-egress controls. Auditability, incident response, and records obligations map to tamper-evident logging of prompts, tool invocations, policy decisions, and outputs.

Compliance leaders should treat the agent as a non-person principal that can act at machine speed across multiple systems. That framing drives the need to separate human-user identity from agent or service identity, bind each action to an accountable principal and role, and isolate environments and data planes for high-impact or CUI/CDI workloads.

Translate clauses into testable AI-agent controls

Procurement language only holds up when it maps to runtime behavior. The following control themes turn common FAR/DFARS and agency AI expectations into acceptance criteria you can exercise before award and during performance.

• Agent identity lifecycle: Provision, authenticate, authorize, and revoke non-person identities separately from human users.
• Least-privilege tool access: Bind scopes to each tool call and prove deny paths for out-of-scope tools and destinations.
• Policy mediation at runtime: Enforce allow/deny decisions on tool use and data egress under controlled tests, not only in policy documents.
• Data-handling boundaries: Constrain where FCI, CUI, CDI, and privacy data may move across models, retrieval pipelines, and external APIs.
• Immutable operational evidence: Retain logs of agent identity, policy version, tool invocations, decisions, and data sources for audit and incident response.
• Supplier and subcontractor oversight: Maintain continuous monitoring, incident-reporting hooks, and flow-down proof beyond pre-award questionnaires.

Runtime evidence buyers should demand

• Proof of how agent non-person identities are provisioned, authenticated, authorized, and revoked
• Least-privilege scopes bound to each tool call, with successful deny tests for out-of-scope tools and destinations
• Runtime policy enforcement results showing blocked unauthorized tool use or data egress under controlled tests
• Immutable, retained logs covering agent identity, policy version, tool invocations, decisions, and data sources for audit and incident response
• Continuous monitoring, incident-reporting hooks, and subcontractor oversight evidence beyond pre-award questionnaires
• Traceability from solicitation clauses and data types to configuration baselines and acceptance test results

Procurement evaluation criteria that hold up

• Clause and data mapping first: Score proposals on explicit mapping of FCI/CUI/CDI handling to FAR 52.204-21, DFARS 252.204-7012, CMMC applicability, and any agency AI terms, not on framework name-dropping alone.
• Runtime over documentation: Prefer demonstrated identity binding, policy mediation, and log completeness over model documentation or voluntary RMF self-descriptions without operational proof.
• Testable acceptance criteria: Include identity proofing, denied-tool tests, exfiltration or block tests, and log completeness checks in technical evaluation and award performance standards.
• Supplier oversight design: Require right-to-audit or continuous-assurance mechanisms for agent behavior, configuration baselines, and incident hooks, including flow-down to AI subcontractors.
• Authorization boundary clarity: For cloud-hosted agents and retrieval pipelines, require clear statement of FedRAMP or equivalent authorization boundary and residual risks for federal data in scope.
• Verify current rule status: Confirm the latest FAC/DFARS publications, class deviations, CMMC level, and agency AI solicitation language at award time, because applicability is use-case dependent and rulemaking continues to evolve.

Governance roles for agencies and contractors

Agencies should use procurement to obtain the artifacts needed for AI inventories, risk assessments, and oversight required under OMB AI governance expectations. Contract language should separate mandatory runtime controls and evidence from voluntary frameworks used for maturity improvement. Defense acquisitions handling CUI or CDI should explicitly tie AI-agent hosting and tooling to DFARS cyber and CMMC applicability rather than generic AI principles.

Contractors and AI vendors should expect safeguarding, incident reporting, and evidence-delivery obligations to flow down. They should design supplier interfaces so agencies can obtain continuous evidence such as logs, configuration baselines, and incident hooks without relying solely on static assessments or SOC reports. Practitioners should not overstate that FAR or DFARS creates one AI-specific control catalog. The durable approach is disciplined mapping from data category and clause set to agent identity, permissions, policy enforcement, logging, and supplier assurance that can be exercised in operations.