Sponsors (4)
The bill strengthens DoD data protections, interoperability, and transparency to bolster national security and competition, but does so at the cost of higher vendor compliance expenses, potential oversight gaps for smaller providers, and discretionary exemptions that could weaken protections in specific programs.
DoD contractors and federal systems gain stronger data protections because vendors must segregate government data and are prohibited from using Government‑furnished data to train commercial models.
Federal IT users (DoD staff, mission operators, and associated contractors) see improved interoperability, resilience, and portability as the DoD prioritizes multi‑cloud, modular open systems, and portability across providers.
Taxpayers and oversight bodies benefit from greater transparency and congressional oversight through required DoD reports on competition, market concentration, and exemptions, with public‑releasable versions available online.
Taxpayers and government contractors may face higher costs and increased contract prices because stricter data‑use prohibitions and penalties raise vendor compliance costs.
Government contractors and federal programs could see reduced data protections in specific programs due to national‑security exemptions that create discretionary carveouts to DFARS protections.
The $50M threshold for 'covered providers' could let influential smaller providers escape some requirements, concentrating oversight on large incumbents and undercutting intended competition gains for smaller firms.
Based on analysis of 2 sections of legislative text.
Directs DoD to adopt procurement and DFARS rules that require competitive, multi‑cloud/modular acquisitions and prohibit unauthorized use of government data (including for training AI), with penalties and reporting.
Official title: To provide for certain requirements relating to cloud, data infrastructure, and foundation model procurement.
Introduced May 15, 2025 by Pat Fallon · Last progress May 15, 2025
Requires the Department of Defense to adopt procurement and data‑protection rules for cloud computing, data infrastructure, and large AI models to promote competition, security, resilience, and interoperability. It defines covered providers and foundation models, mandates competitive awards and multi‑cloud/modular designs when feasible, protects government data from unauthorized use (including against being used to train commercial products), creates penalties for violations, allows narrow national‑security exemptions, and requires periodic public reporting to Congress on market competition and exemptions. The law directs the DoD Chief Digital and AI Office to update acquisition regulations (DFARS) to implement these protections, requires segregation and exclusive Government access to Government‑furnished data on vendor systems, and asks senior DoD officials to deliver annual reports (starting Jan 15, 2027) for four years on competition, market concentration, barriers to entry, and any granted exemptions, with releasable versions posted publicly.