AS-2602_Privacy IP and Government Data Use Requirements_SIGNED_4-23-26.pdf

PRESCRIPTION: USE THIS CLAUSE IN ALL SOLICITATIONS AND CONTRACTS

ABOVE THE MICROPURCHASE THRESHOLD.

AS- 2602 Privacy, IP, and Government Data Use Requirements

The Contractor shall comply with the Privacy Act of 1974, as amended (Privacy Act)(5 U.S.C.

552a), the Federal Records Act (the Federal Records Act)(44 U.S.C. chapters 21, 29, 31, and

33), and all applicable laws and policies consistent with The E-Government Act 2002 (44 U.S.C.

3601 et seq), OMB Circular A-130, OMB Memo 17-12, HUD Privacy Policy, HUD Privacy

Program Plan, HUD Privacy Handbook Rev. 1.0 and HUD Privacy Compliance Plan when handling Federal information containing Privacy Act protected information. This includes any

Artificial Intelligence (AI) System(s) and AI Service(s) (collectively, AI Systems) provided by the Contractor that creates, collects, uses, processes, stores, maintains, disseminates, discloses, or disposes of such Privacy Act protected information, and AI Systems used by the Contractor when performing work under the contract.

A list of AI Definitions can be found on the AI@HUD page on hud.gov.

1. Protection of Intellectual Property Rights and Use of Government Data:

Consistent with applicable law and Government-wide policy, the Contractor shall adhere to the following requirements for ownership and use of Government data and intellectual property (IP) developed or used in performance of the contract:

a. Ownership and Licensing Terms:

The Government retains ownership of all Government data, queries, prompts, searches, and outputs generated by the AI System. The Government retains rights to any modifications, manipulations, and/or improvements to Government data, including the design, development, testing, and operation of AI Systems. All IP licensing terms must be appropriately scoped to the intended use of the AI System to avoid vendor lock-in in accordance with AS-2604, Vendor Lock-In Protections, and ensure the Government’s future access, operability, and oversight of the AI

System.

b. Use of Government Data:

The Contractor shall only collect, access, and retain Government data when reasonably necessary to fulfill the contract’s intended purpose. The Contractor is strictly prohibited from using all non-public Government data, queries, prompts, and outputs to train, fine-tune, or otherwise enhance the Contractor’s publicly or commercially available AI algorithm(s), and/or AI System(s), without the

Government's explicit, prior written consent. The Contractor is also strictly https://www.hud.gov/ai prohibited from using non-HUD approved AI to process HUD Controlled

Unclassified Information (CUI), Personally Identifiable Information (PII), Federal

Tax Information (FTI), or classified data.

c. Access Rights:

The Contractor shall ensure that all components required to operate, monitor, or evaluate the AI System, including AI models, algorithms, documentation, and data, remain available to the Government during the entire of the contract to fulfill mission and oversight needs. Primary government operations and quality assurance team members will have the highest level of access rights.

d. Data Handling:

i. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (i.e., with a sub-contractor) on any work related to the disclosure of information, documentary material and/or records generated under, or relating to, the contract. The Contractor (and any sub-contractor) is required to abide by

Government and HUD guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

ii. The Contractor shall comply with all applicable records management laws and regulations, and National Archives and Records Administration

(NARA) records policies, including the Federal Records Act NARA regulations at 36 CFR chapter XII, subchapter B, including 36 CFR part

1236, and those policies associated with the safeguarding of Federal records covered by the Privacy Act o. These laws, regulations, and policies include the appropriate preservation of all Federal records, regardless of form or characteristics, mode of transmission, or state of completion. For this clause, the term data includes inputs, queries, prompts, and outputs of an AI System.

iii. In accordance with 36 CFR 1222.32, all data created for U.S. Government use and delivered to, or falling under the legal control of, the U.S.

Government are Federal records subject to the provisions of 44 U.S.C.

chapters 21, 29, 31, and 33, the Freedom of Information Act, as amended

(FOIA) (5 U.S.C. 552), and the Privacy Act, and must be managed and scheduled for disposition only as permitted by Federal statute or regulation.

iv. In accordance with 36 CFR 1222.32, the Contractor shall maintain and manage all Federal records created for U.S. Government use, created during performance of this contract, and/or delivered to, or under the legal control of, the U.S. Government in accordance with Federal law.

Electronic Federal records and associated metadata specified for delivery under this contract must be accompanied by sufficient technical documentation to facilitate their understanding and use.

v. The Contractor shall, upon request of the Government, provide clear documentation and controls for data handling, including how Government data is collected, processed, stored, accessed, and disposed of according to the NARA approved Records Schedule. These practices must align with

Federal data governance and privacy protection standards. The Contractor shall implement privacy by design principles and provide clear documentation and controls for data handling, including how Government data is collected, used, processed, stored, maintained, disseminated, disclosed, and disposed of. The U.S. Government reserves the right to inspect, at any time, Contractor and subcontractor policies, procedures, and strategies for ensuring that Federal records are appropriately maintained.

vi. The Contractor is responsible for preventing the alienation or unauthorized destruction of Federal records under this contract, including all forms of mutilation. Federal records may not be removed from the legal custody of

HUD or destroyed except in accordance with the provisions of this contract and the Federal Records Act. Willful and unlawful destruction, damage, or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. The Contractor shall report any unlawful or accidental removal, defacing, alteration, or destruction of

Federal records to the Contracting Officer within one business day.

vii. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of all Federal records in accordance with this contract and applicable law.

viii. The Contractor shall not remove data from U.S. Government facilities or systems, or facilities or systems operated or maintained on the U.S.

Government's behalf, without the express prior written authorization of the

Contracting Officer.

ix. The Contractor shall not create or maintain any Federal records containing any non-public Government information not specified or authorized by this contract.

x. During the term of this contract, the Contractor shall not (i) disclose any

Federal record, or any copy thereof, that contains information covered by

32 CFR part 2002 or FOIA (with the exception, for the purposes of FOIA, of information that exclusively implicates the exemption 4 interests of the

Contractor); or (ii) sell any Federal record, or any copy thereof.

xi. After expiration or termination of this contract, the Contractor shall not retain or have access to any Federal record, or any copy thereof, that contains information covered by 32 CFR part 2002 or that is generally protected from public disclosure by an exemption under FOIA with the exception, for the purposes of FOIA, of information that exclusively implicates the exemption 4 interests of the Contractor.

xii. Under no circumstances shall the Contractor destroy Federal records except in accordance with the provisions of this contract and the Federal

Records Act.

xiii. All Contractor employees assigned to this contract who create, work with, or otherwise handle Federal records are required to complete HUD-provided records management training. The Contractor is responsible for confirming training has been completed according to HUD policies, including initial training and any annual or refresher training.

xiv. The Contractor is required to notify the Contracting Officer of any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or

Federal records generated under, or relating to, contracts. The Contractor

(and any sub-contractor) is required to abide by U.S. Government and

HUD’s guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

xv. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts requiring the disclosure to a subcontractor of information, documentary material, and/or

Federal records generated under, or relating to, the performance of this contract, and require written subcontractor acknowledgement of the same.

xvi. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

xvii. The Contractor must notify the government of any unauthorized data use or access.

e. Transfer of Data:

i. All data transfers are to be accomplished utilizing a Secured File Transfer

Protocol process as appropriate for the application and interface types, in a format either prescribed by HUD or as agreed between the parties.

ii. Data is to be transferred to HUD in the following ways as agreed between the parties:

a. On demand

b. Via scheduled interfaces

c. Via daily backups

2. Subcontractor Compliance:

The Contractor shall flow down all Privacy, IP, and Government Data Use requirements to its subcontractors that are providing AI components and/or AI Systems under this contract and/or utilizing AI components and/or AI Systems in performance under this contract.

The Contractor shall provide an estimate of the cost to bring the AI System or AI Service into compliance with applicable Government requirements. Based on this information, the

Government will determine whether to continue, modify, or discontinue use of the AI System and/or AI Service.

The Contractor’s failure to adhere to the requirements of this Agency Specific clause could result in the Government exercising any rights available under the terms of the contract, including assessment of disincentives, liquidated damages, and/or actual damages, as appropriate. The

Government reserves the right to stop work on this contract pursuant to this clause until the

Contractor demonstrates compliance with this requirement.

End Clause

X Francine L. Hemphill

Chief Procurement Officer