Summary: AI usage on government contracts introduces a new layer of cost that must be estimated, tracked, and defended under existing compliance frameworks. FAR, DFARS, and CAS do not change for AI, but how contractors apply them must. Tokens are no different from other cost elements: they must be classified, supported in estimating, captured in the accounting system, and reflected in pricing data to withstand audit scrutiny.
The prior article in this series argued that you should sell artificial intelligence (AI) to the government in concepts it already understands: labor categories, fixed prices, and outcome-based, not raw token math. While that framing wins proposals, it may lack the full accountability needed to satisfy an auditor. Once the AI agent or AI tool is on contract, every token consumed becomes a cost item that needs to be supported by an estimating history, an accounting trail, and a pricing position that the Defense Contract Audit Agency (DCAA), Defense Contract Management Agency (DCMA), and Contracting Officer (CO) can understand. Contractors that treat tokens as an IT detail and just another other direct cost (ODC) drive risk to their proposals, their estimating systems, and next incurred cost submission (ICS).
The compliance question is not whether to use AI; you should. It is whether your estimating system, accounting system, indirect rate structure, and Cost Accounting Standards (CAS) Disclosure Statement can withstand a focused look at how tokens were forecasted, captured, allocated, and recovered.
The sections below walk through six compliance areas where organizations should pay careful attention to as they start to understand how to use and price tokens more efficiently and where AI token costs create the most exposure: direct/indirect classification, estimating systems, accounting systems, truthful cost or pricing data, indirect rate structures, and CAS disclosure obligations.
Direct or indirect: pick once, then defend it
Most contractors are charging AI token consumption inconsistently; direct on one contract, indirect on another, with no documented rationale. That is a CAS 402 violation waiting, and likely a CAS 401 concern if the estimating treatment does not match.
FAR 31.202 defines a direct cost as one identified specifically with a particular final cost objective. FAR 31.203 defines an indirect cost as one not directly identifiable but allocable to two or more cost objectives. CAS 402 (48 CFR 9904.402) requires that costs incurred for the same purpose, in like circumstances, be treated only as direct or only as indirect, not both.
Tokens consumed by an agent doing contract-specific code generation under a CLIN are direct. Tokens consumed by a shared internal copilot that for example drafts proposals, writes marketing copy, and answers HR questions are indirect. Consistent treatment needs to be determined and documented.
What is the risk if this remains unresolved?
Questioned costs on incurred cost submissions, CAS noncompliance findings under FAR 30.605, and CAS DS-1 risks during the next audit cycle.
The estimating system must see the agent
DFARS 252.215-7002 requires an adequate estimating system. If your basis of estimate references an AI productivity factor without traceable assumptions on token volume, model selection, usage, retry behavior, and unit cost, the system is not adequate.
The DFARS estimating system criteria require historical cost data, documented procedures, and consistent application. A BOE that bakes AI savings into labor hours without backup will fail the sufficiency of estimating data test in DFARS 252.215-7002(d)(4). When the CO asks how you arrived at a 350% productivity increase, artifacts need to be available with supportable token consumption logs from comparable past work, the model and context window you assumed, the failure and retry rate, the unit price from your vendor contract, and the human review hours required to accept AI output.
Recommended Action:
Build a token estimating module. Treat it like a cost estimating relationship or service center. Maintain it under configuration control. Reconcile estimated to actual consumption every quarter and feed variance back into the next proposal.
What is the risk if this remains unresolved?
Estimating system disapproval, withheld payments under DFARS 252.242-7005 (up to 10%), and loss of forward pricing rate agreements.
The accounting system needs new account strings
Most contractors’ charts of accounts have nowhere clean to record tokens. Invoices from model vendors hit a single G&A or overhead line, which destroys allocability and could lead to CAS 402 and CAS 418 issues.
DFARS 252.242-7006 requires that the accounting system provide for proper segregation of direct from indirect costs, identification and accumulation of direct costs by contract, and a logical and consistent method for allocating indirect costs. Token consumption that arrives as a single monthly invoice then gets dumped into a software subscription account fails the segregation test the moment that token spend serves both direct contract work and indirect activities.
Recommended Action:
Stand up token-level cost capture. Tag appropriately with a contract or cost objective identifier and not only at month-end through a spreadsheet allocation. Build out a token cost subsidiary ledger that ties to vendor invoices in total but is allocated by usage at the call level. If you cannot tag at the call, you cannot defend the allocation.
What is the risk if this remains unresolved?
Accounting system disapproval under DFARS 252.242-7006(c), payment withheld, and disallowed costs on flexibly priced contracts.
Truthful cost or pricing data: the TINA trap
AI token pricing changes monthly. If you certify cost or pricing data under FAR 15.406-2 based on a model vendor price that is continuously changing, and your own organization is working out volume, efficiency, and accounting, this could lead to a defective pricing exposure under FAR 15.407-1.
The Truthful Cost or Pricing Data statute (formerly known as TINA) requires certification that the data submitted is accurate, complete, and current as of the date of agreement on price. Model vendors change prices frequently. Additionally, newer, cheaper models replace older iterations mid-procurement, and companies are evaluating which level class of employee by role, function, and activity have access to which model based on complexity of the task. That shift to usage-based pricing has forced enterprise customers to reckon with their consumption.
Of note, for contracts entered into after June 30, 2026, the certified cost or pricing data threshold rises from $2 million to $10 million. While this narrows the population of contracts requiring certification, it does not eliminate the obligation to provide accurate pricing data when requested, nor does it diminish the risk of defective pricing on contracts that remain above threshold.
Recommended Action:
Build a sweep procedure. Before pricing, refresh every token unit price, model selection, and vendor quote. Document the sweep in the proposal file. If a price drops after certification but before award, disclose it. The cost of a voluntary disclosure is always lower than a defective pricing claim with interest and penalties under FAR 15.407-1(b)(7).
What is the risk if this remains unresolved?
Defective pricing recovery (price reduction plus interest), False Claims Act exposure, and suspension of payments.
Indirect rates: where token burn quietly compounds
Indirect token consumption (e.g., internal copilots, shared knowledge bases, AI-assisted bid and proposal work) is sometimes defaulted into overhead and G&A pools without anyone noticing, inflating indirect rates against the government.
FAR 31.203(c) requires that an indirect cost pool contains only costs that have a beneficial or causal relationship to the cost objectives in the base. CAS 410 governs the allocation of business unit G&A; CAS 418 governs the allocation of direct and indirect costs and requires homogeneous pools with allocation bases that reflect causal or beneficial relationships. When a shared AI tool serves B&P work or other indirect functions, and supports contract performance simultaneously, you must split that spend or remove the cost from the allocation base before it hits an indirect rate.
Recommended Action:
Instrument the tool. Capture which user, activity, and cost objective drove each token. Map activity codes to allowability categories. Scrub unallowable costs monthly, not at year-end. Consider treating the cost as a service center. Update your indirect rate structure to recognize an AI cost pool if material; do not bury it in a catch-all overhead account.
What is the risk if this remains unresolved?
Indirect rate disapproval, retroactive rate adjustment, and unallowable cost penalties under FAR 42.709, which can double the disallowed amount.
CAS disclosure and cost accounting practice changes
Introducing an AI agent that can materially change how you accumulate and allocate labor or non-labor cost and can be considered a cost accounting practice change under the FAR. If you are CAS-covered and have not amended your Disclosure Statement, you are out of compliance the day the agent goes live.
CAS-covered contractors above the disclosure threshold must describe their cost accounting practices in a Disclosure Statement (CASB DS-1). A change in the method of charging the agent or token as part of labor cost or non-labor, impact on the basis of estimate, the composition of a cost pool, or the allocation base is a change in cost accounting practice. FAR 30.603-2 requires advance notification and a cost impact proposal. Voluntary changes must be either desirable or cost-neutral to the government.
Recommended Action:
Before AI deployment crosses materiality, draft the Disclosure Statement amendment ahead of time. Identify if the change is a direct or indirect change, how the cost will be recorded and estimated. Quantify the cost impact on existing contracts. Negotiate the change with the cognizant federal agency official under FAR 30.606.
What is the risk if this remains unresolved?
CAS noncompliance determination, contract price adjustment to recover increased costs to the government plus interest, and equitable adjustment exposure on flexibly priced contracts.
Allowability: the FAR Part 31 lens
A handful of allowability traps deserve specific attention:
- FAR 31.205-18 (IR&D and B&P): Token spend on model fine tuning that benefits future bids is B&P or IR&D, capped by the negotiated ceiling, not direct contract cost.
- FAR 31.205-33 (Professional and Consultant Services): If a third party provides AI-augmented services, the work product and supporting documentation must support reasonableness.
- FAR 31.201-3 (Reasonableness): A prudent person test applies. Burning $1,000,000 in tokens to generate a $5,000 deliverable is not reasonable.
Where to start?
- Issue a written policy that classifies token consumption as direct or indirect by use case.
- Add token cost capture to project accounting at the call level, not at the invoice level. Tag every call to a contract, CLIN, or indirect pool.
- Rewrite your standard BOE template to include an AI assumptions section: model, volume, retry rate, unit price, human review hours.
- Add a TINA sweep to your proposal closeout checklist: refresh token pricing and model selection within five business days of price agreement.
- If you are CAS-covered, open a Disclosure Statement amendment file now; do not wait for the auditor to ask.
Final Thoughts
The first wave of AI on government contracts will be priced loosely and audited tightly. Contractors that build the compliance gates before scaling will negotiate from a position of strength. Contractors that do not will discover the cheapest part of an AI agent was the tokens.
Treat tokens like any other regulated cost element: classify them, capture them, allocate them, and disclose them. The FAR, DFARS, and CAS were written before anyone had heard of a large language model (LLM), but the framework still works. It just needs you to apply it before the first audit letter arrives.
