Much has been and will be written on responsibility determinations and compliance programs in federal contracting, particularly at the intersection of cybersecurity and recent developments. Although a federal contract is not strictly a “suicide pact” it may seem so at times if one is not attentive. Regarding these two discretionary matters having a broad application, consider the following.
The Federal Acquisition Regulation (FAR) contains a fundamental requirement that before a contract award, the contracting officer must make an affirmative responsibility determination. Without an affirmative determination of responsibility, no award may be made. A high degree of discretion is involved in responsibility determinations. The result of its exercise is not easily overturned, regardless of how “thin” the basis of that result may seem.
Agencies similarly have discretion regarding whether a company should be suspended from future awards under the Suspension and Debarment Rules (S&D). Under existing procedures, a federal contractor (and related individuals) may be unilaterally suspended from receiving future awards at the discretion of the government. The basis for a suspension is not subject to initial review, although proactive measures sometimes can avoid it. At some indefinite time following suspension, a contractor may have an opportunity for a hearing in which it may seek to overturn the initial suspension and avoid ultimate debarment. In the intervening period, a suspended contractor is ineligible for new awards, even an award as a subcontractor or supplier to a federal prime contractor. The delay process can be lengthy and expensive – two factors that can seriously and adversely affect a contractor.
The near-absolute discretion vested in the government is important, and more so now given the emerging, widespread availability of AI technology.
In the past, these areas have been fertile soil for a fair amount of litigation, legislation, and regulatory “tinkering” over the years. Even so, contractors seem to have accommodated themselves to these things and priced them into the cost of doing business. At the same time, new mandates requiring contractor compliance continue to proliferate. Contractor compliance affects these discretionary matters.
As compliance requirements increase, so does the government’s enforcement. Becoming subject to enforcement scrutiny, if not an enforcement action, bears on discretionary decisions as well. From its initial modest levels, enforcement has grown significantly over the years. Today, wherever any degree of federal payments are involved, the government’s common practice is to apply several civil and criminal statutes (especially the False Claims Act) as enforcement tools. Accompanying S&D actions inevitably are implicitly (or explicitly) involved.
Now, contractors must add Artificial Intelligence (AI) to their business calculus.
In Maryland, an apparently disgruntled employee of the Baltimore Schools created and released on social media a false, AI-generated, supposed “rant” by a school official who had initiated an investigation concerning misuse of school athletic funds. There were almost immediate demands for the removal of the official, and he was placed on “administrative leave” pending a review. Although the alleged rant was finally shown to be false, the process itself was a heavy punishment. Such an accusation against a contractor could cause immense consequential damage to its business, particularly in the two areas mentioned.
The Baltimore situation raises several questions (among others) for contractors such as: What risk does AI pose for contractor responsibility determinations or potential S&D proceedings? And how can a business protect itself from a disgruntled employee or unscrupulous competitor using AI to trigger adverse agency determinations? These are very real, and emerging challenges. Such risks require a level of sophistication and expense that likely is well beyond all but the largest contractors, and clearly beyond the reach of many small and medium contractors. Fortunately, contractors in the latter posture may manage their risks through a reliable third-party vendor. The outsourcing cost may seem unnecessary, but prudence requires it.
