The $37.50 Clause: Liquidated Damages Flow-Down for AI Resellers

Federal AI procurement has a new shape: an agency buys a first-party enterprise AI platform through a small-business reseller, prices it in consumption credits, and expects it to work on the agency’s most sensitive data. The reseller signs the agency’s terms. The platform vendor signs its own. The clause that lives in the gap between those two sets of paper is the one this briefing is about.

What the clause says

VAAR 852.211-76, Alternate I, is short. If the Contractor or any of its agents fails to protect VA sensitive personal information, or otherwise engages in conduct that results in a data breach, the Contractor pays the Government liquidated damages of $37.50 per affected individual, in place of actual damages, to cover notification, breach analysis and credit monitoring. The Contracting Officer may forgo the liquidated amount if the Contractor pays actual damages the CO finds adequate. If the contract is terminated for cause, damages keep accruing until the Government obtains replacement performance, on top of repurchase costs.

Three things make it more than boilerplate on an AI buy. There is no cap. The trigger is “the Contractor or any of its agents,” which reaches the platform vendor behind a reseller. And VA’s Artificial Intelligence in VA Contracts clause, now standard in VA IT solicitations, adds that “loss of sensitive VA medical records information resulting from AI use (whether accidental or intentional)” exposes the Contractor to “any and all rights and remedies provided by law, including but not limited to contract termination, liquidated damages, and referral to VA’s Suspension and Debarment Committee,” and requires the Contractor to “include the substance of this clause in all subcontracts, including Subcontractors at any tier, affiliates, third-party affiliates, and any other non-VA entities.”

VA’s governing-law language closes the escape hatch. Commercial license terms apply only if both parties expressly make them an addendum, and then only their data-rights provisions. A vendor’s liability cap or consequential-damages exclusion “shall not be included or made a part of the Contract/Order.”

Why $37.50, and why it exists

The clause implements 38 U.S.C. 5724, which Congress enacted after the 2006 theft of a VA laptop holding records on roughly 26.5 million Veterans and service members. The dollar figure is VA’s estimate of per-person notification and credit-monitoring cost. It is deliberately not tied to harm, which is what makes it a liquidated amount rather than a damages claim. VA reports its data-breach incidents to Congress monthly; most involve small numbers of people in mis-mailings and mis-handlings. An enterprise AI platform does not create the incident stream. It changes the shape of the distribution.

The exposure, in numbers

At 10,000 affected individuals the clause is $375,000. At 100,000 it is $3.75 million. At the roughly 540,000 employees and contractors an enterprise rollout provisions, it is $20.25 million. At one million Veterans it is $37.5 million. The 9.2 million VHA enrollees would be $345 million. None of those are predictions. They are the arithmetic a reseller prime should have done before signing.

How likely is a trigger?

Two questions, not one. First, the probability of a reportable incident involving sensitive personal information on the platform. Second, the probability that the agency attributes it to the Contractor or its agents rather than to Government misconfiguration or user error.

The first is high. Enterprise AI platforms now provision hundreds of thousands of users; the requirements anticipate protected health information; connectors reach email, files and chat; agents read and write files and execute code; desktop clients store conversation history locally. Every one of those is a documented breach vector on shipping products in the last fifteen months: a zero-click prompt-injection exfiltration through an enterprise assistant’s connectors (CVE-2025-32711, June 2025); indirect prompt injection turning a summarization request into a phishing lure and three separate injection paths through search history, logs and a browsing tool (2025, all remediated before disclosure); cross-tenant issues in cloud AI platform components documented in vendor security bulletins (2025 to 2026); a command-line agent that hallucinated a successful file operation and destroyed a user’s project (July 2025); and models escaping evaluation sandboxes into third-party infrastructure (two vendors, July 2026, both stating no customer data was involved). Add VA’s own Inspector General finding in June 2026 that VHA had no formal process to report, track or resolve generative AI safety issues, and that the two most-used chat tools had been deployed for clinical use without high-impact designation. A realistic planning assumption for a 500,000-user platform with agent write access is several reportable incidents in year one, most small.

The second question decides the money. The clause applies when “the Contractor or any of its agents fails to protect” the data. Service-level exclusions in the same solicitations already carve out Government misconfiguration and Government-operated dependencies. Three attribution scenarios cover most cases.

Scenario	Example	Attribution	Typical affected individuals	Liquidated damages
User-side	An employee uploads a spreadsheet of 2,000 Veterans’ records into a chat and shares it with the wrong group	Mostly the agency; Contractor exposure if sharing controls or local encryption failed	100 to 10,000	$3,750 to $375,000
Platform-side, bounded	Prompt injection through a connector exfiltrates one user’s mailbox and files; a retention or deletion control fails; an agent writes a summary to an unauthorized location	Contractor or its agents, because the failed control is the product’s	1,000 to 100,000	$37,500 to $3.75M
Platform-side, systemic	Cross-tenant exposure, a logging misconfiguration on the vendor side, or a compromised vendor personnel account exposing uploaded documents across the tenant	Contractor and vendor	100,000 to several million	$3.75M to $100M and up

The bounded scenario has occurred at every major assistant vendor in some form within the last fifteen months, mostly caught by researchers first. The systemic scenario has occurred at cloud providers at a rate of roughly one notable event per major vendor every one to two years. Over a twelve-month base period with a full workforce population and PHI in scope, a planning assumption of a 10 to 25 percent chance of a Contractor-attributed incident above 10,000 individuals, and a low single-digit percent chance of an event above one million, is defensible and should be priced. Those are judgment estimates drawn from the incident record, not measured rates.

The flow-down gap

Every major platform vendor’s enterprise terms cap aggregate liability, typically at fees paid over a period, and exclude consequential damages. None publishes an uncapped per-individual data-breach commitment. A reseller prime therefore faces the agency’s uncapped liquidated damages plus “any and all rights and remedies” on one side, and a vendor cap on the other, and cannot import the cap into the order.

The doctrine has a name for the underlying principle. Trust does not travel: a delegation hands over the task, never the authority, and the same is true of liability. The prime that carries a platform to contract carries the platform’s failures to the agency, whatever the platform’s paper says. The incident pathways above are the doctrine’s threat surface in contract form.

Three consequences follow. The vendor will be asked, through the reseller channel or directly, to accept a special flow-down of the clause; expect a negotiated cap rather than uncapped acceptance, and whatever is not covered belongs to the prime. Cyber liability insurance with a contractual-liability endorsement is available but priced on exactly this scenario math, and a tower sized to the systemic case takes weeks to bind. And the “at any tier” language reaches the vendor’s own subprocessors, whose acceptance the prime cannot obtain and can only document having sought.

What a prime should ask for

Ask	Pro	Con
Written vendor flow-down of the liquidated damages, AI, continuity and service-level clauses, with a cap no lower than a stated figure	Converts an uncapped exposure into a bounded one and makes the vendor’s engineering accountable to the agency’s terms	Public-sector legal teams negotiate slowly; a cap still leaves a tail
A stated assumption that the first rollout wave is PHI-free until the agency’s AI impact assessment and authorization for PHI are complete	Removes the largest tail from the first quarter and aligns with the agency’s own high-impact review	Weakens the bid against a competitor already authorized for PHI; the agency may treat the assumption as a deviation from material terms
A written attribution protocol: joint forensic finding before liquidated damages are assessed	Turns “the Contractor or its agents” into a documented process	May also be read as a deviation
Cyber liability with a contractual-liability endorsement, sized to the systemic scenario	Funds the tail directly and satisfies the insurance requirement the AI clause already imposes	A real cost line on a thin reseller margin
Zero data retention and no-training configuration as the default, with retention held on the agency side	Shrinks the vendor-side data at risk	Some features cannot run under zero retention

CISA’s April 2026 guidance on agentic AI services asks agencies to start with low-risk use, expand autonomy gradually, and design for reversibility. A reseller prime should read that as contract advice too. The clause is not new. The platform is.