Can a member of the public FOIA an AI vendor directly?

No. Federal FOIA and state public-records acts reach government bodies, not private companies. The exposure is indirect and is the reason vendors underestimate it: the request goes to your customer agency, which searches the records in its possession, and those records include everything you sent them. Your contract, your responses to the solicitation, your model documentation, the emails your support team wrote, and any configuration the agency exported are all agency records once received. A handful of states extend their acts to private contractors performing a governmental function, which converts the indirect exposure into a direct one.

Are system prompts and model configurations protected as trade secrets?

Sometimes, and less reliably than vendors assume. The commercial-information exemption generally requires that the material be genuinely confidential, commercially valuable because it is not known, and subject to reasonable efforts to keep it secret. A prompt emailed to three agency staff without a confidentiality marking has a weaker claim than the same prompt delivered under a marked, contractually referenced disclosure process. The harder problem is that transparency and due-process arguments cut the other way when the system affects individual rights, and some state courts have been notably unsympathetic to secrecy claims over decision logic used on the public.

What is a reverse-FOIA action and when would a vendor bring one?

It is a suit by the submitter of information to stop an agency from releasing it, brought after the agency notifies the submitter of its intent to disclose. It is the last mechanism available and it runs on a short clock, often ten business days or less from the notice. Practically, the outcome is usually determined long before the suit: by whether the material was marked, whether the vendor identified specific competitive harm rather than asserting confidentiality generally, and whether the contract obliged the agency to give notice at all.

Does marking a document confidential prevent its release?

Marking does not control the outcome, but its absence usually does. Agencies apply the statutory exemptions, not the vendor's labels, and a blanket confidential stamp across an entire proposal tends to be discounted precisely because it is indiscriminate. Line-item marking with a short stated basis for each item is treated more seriously and is what an agency's records officer can actually work with when segregating a document. Pricing that has been published in an award notice cannot be un-published by a marking.

Do incident reports and evaluation results have to be disclosed?

If the agency holds them, they are agency records and start from a presumption of release. Bias evaluations, red-team findings, accuracy measurements by subgroup and post-incident write-ups are among the most frequently requested AI-related materials, and they are the materials with the weakest exemption claims, because their content is about the system's effect on the public rather than about how the product is built. Vendors who assume the sensitive material is the source code are usually surprised to find the requested material is the eval.

How should an AI vendor structure its government contract for records exposure?

Three clauses do most of the work. A notice-and-opportunity provision requiring the agency to tell you before releasing your submitted material and to allow a defined window to object. A defined confidential-materials process specifying how items are marked and what basis is asserted. And a data-segregation term keeping your proprietary configuration out of the deliverables the agency receives in exportable form, so the sensitive material is never in agency possession in the first place. The third is the only one that works without a lawyer.

Your Prompt Library Is a Public Record Now. FOIA Exposure for AI Vendors Selling to Government (2026)

The Mechanism Vendors Get Wrong

Public-records law is a duty imposed on government bodies. A private company cannot generally be compelled to produce anything under it, which is why vendors read the statute once, conclude it does not apply to them, and stop. The error is in the second step. The obligation attaches to records in the agency's possession, and possession is a factual question about where a document sits, not a legal question about who wrote it.

A minority of jurisdictions go further and extend their acts directly to private entities performing a governmental function or holding records on an agency's behalf. Those provisions are worth checking specifically before signing in an unfamiliar state, because they convert an indirect exposure — where at least a customer stands between you and the requester — into a direct one where the request names you.

What a Request Actually Does, in Sequence

Day 0

A request lands at the agency, not at you

It names a program, a vendor, or a decision. It does not need to be specific about formats or systems, and the requester does not have to explain why they want it. Nothing has been sent to you and, unless your contract says otherwise, nothing will be.

Days 1–5

The agency searches its own possession

Records custodians run searches across mail, contract files, shared drives and ticketing. Everything you ever sent — proposal, model card, DPIA, pricing sheet, the Slack-Connect export, the support thread where an engineer explained a hallucination — is inside that boundary.

Days 5–10

Segregation and exemption review

Someone decides, per page, what is exempt and whether the exempt parts can be redacted while releasing the rest. Statutes generally require release of every reasonably segregable non-exempt portion, so all-or-nothing arguments lose most of the document.

Day 10-ish

Submitter notice — if you negotiated for it

Where a notice provision or an executive-order-style submitter process applies, you are told what is about to go out and given a short window to object with specifics. Where it does not, this step does not exist and you learn about the release afterwards.

Day 20+

Release, appeal, or reverse-FOIA

The agency releases, the requester appeals a withholding, or you sue to stop disclosure. All three run against a record that was written months earlier by people who were not thinking about publication.

Two features of that sequence do most of the damage. The first is that the segregation step is per-portion: statutes generally require an agency to release every reasonably segregable non-exempt part of a document, so an argument that a proposal is confidential in its entirety typically produces a heavily redacted proposal rather than a withheld one. The second is that the notice step is conditional. If nobody negotiated for it, the first you hear of the release is when someone quotes it back to you.

Exemption Posture, Record by Record

System prompts and orchestration configurationContested

A credible trade-secret claim exists where the material is genuinely secret, marked, and commercially valuable for that reason. It weakens fast where the system makes decisions about individuals and a transparency or due-process interest is asserted against it.

Bias, accuracy and red-team evaluation resultsUsually released

The content describes the system's effect on the public rather than its construction, which is exactly what the exemptions are weakest against. This is also the single most requested AI-related record category.

Contract, SOW and awarded pricingReleased

Award terms and prices are ordinarily public. Unit-level cost build-ups occasionally survive; the total does not.

Incident reports and post-mortems shared with the agencyUsually released

Deliberative-process style exemptions protect the agency's own internal reasoning, not a vendor's factual account of what went wrong.

Model weights and source codeGenerally protected

The strongest exemption posture — and almost never what a requester actually wants. Requesters ask for decisions and effects, not tensors.

Training-data inventories and provenance documentationContested

Increasingly requested and rarely marked. The provenance question ties directly to procurement rules that some jurisdictions now impose, which raises the public-interest weighting.

Support tickets, emails and meeting notes with agency staffReleased

The category vendors forget entirely. Candid engineering explanations written to a customer read very differently once quoted in a story about the program.

Read that table in order of what a requester wants and it inverts the usual vendor anxiety. The material with the strongest protection — weights, code — is the material nobody asks for. The material with the weakest protection is the evaluation record, which is precisely what a journalist, an advocacy organisation or an opposing counsel in an individual case is after.

Why the Trade-Secret Claim Erodes Here Specifically

Commercial-information exemptions were built for bid pricing and manufacturing processes, where the competitive harm from disclosure is concrete and the public interest in the detail is thin. An AI system used to allocate benefits, screen applicants or prioritise inspections sits at the opposite end of both axes. The competitive harm from releasing a prompt is real but hard to quantify, and the public interest in how a government decision was made is the founding purpose of the statute.

That asymmetry is why confidentiality arguments over decision logic have gone badly in several well-publicised disputes, and why the practical mitigation is architectural rather than legal. If the sensitive configuration never leaves your infrastructure — if the agency receives outputs, documentation and an audited interface rather than an exportable copy of the system — then there is no agency record to request. Every contract clause below is a fallback for material you could not keep out of their hands.

The Four Clauses Worth Arguing For

Submitter notice with a defined window

The agency notifies you before releasing material you submitted and allows a stated number of business days to object. Without this clause, no other protection has a moment to operate.

Line-item confidentiality process

A named process for marking specific items with a stated basis, rather than a blanket stamp. Indiscriminate marking is routinely discounted; specific marking gives a records officer something to segregate around.

Deliverable segregation

Proprietary configuration is referenced, not transmitted. What the agency holds is documentation and results; what it does not hold, it cannot be asked to produce.

Cooperation and cost allocation

Who pays for review when a request implicates thousands of your pages, and an obligation on both sides to cooperate in defending a withholding rather than leaving one party to litigate alone.

Write for the Requester You Will Eventually Have

The cheapest control in this entire area costs nothing and is cultural. Every message your team sends to a public-sector customer should be written on the assumption that it may be published in full, attributed, next to a quote from someone harmed by the system. That is not a counsel of blandness — an accurate, careful explanation of a limitation reads perfectly well in public. It is a counsel against the specific genre of message where an engineer, trying to be helpful, characterises the model's failure modes in language they would not use on stage.

The same test applies to your marketing. Accuracy figures, bias claims and certification language on your website will be read against the evaluation record the agency releases, by someone who now holds both documents. Where they disagree, the disagreement is the story.

Check What Your Site Claims Before an Agency Does

Accuracy percentages, bias statements, certification badges and security claims on your marketing pages become exhibits the moment a released evaluation report says something different.

See every claim your site makes in one pass. Run a free scan and check each against what your documentation actually supports.

This article is general information and not legal advice. Federal FOIA and the fifty state public-records acts differ substantially in scope, exemptions, notice procedures and deadlines, and outcomes depend on specific facts and jurisdiction. Consult qualified counsel before relying on any conclusion here.