Overview
FAR Subpart 4.22 implements the "No TikTok on Government Devices Act" and OMB Memorandum M-23-13, which prohibit the use of ByteDance-covered applications on federal information technology. The subpart aims to mitigate national security risks by ensuring that TikTok and related services are removed from all devices used in the performance of government contracts.
Key Rules
- Definition of Covered Application: Specifically targets the social networking service TikTok, any successor applications, or any services developed or provided by ByteDance Limited (or entities owned by them).
- Broad Definition of IT: The prohibition applies to any equipment or software used in the acquisition, storage, or management of data by an agency, or used by a contractor to a "significant extent" in the performance of a service or product delivery.
- Employee-Owned Devices (BYOD): The ban extends to personal devices owned by contractor employees if those devices are used in the performance of the contract.
- The "Incidental" Exception: The prohibition does not apply to equipment acquired by a federal contractor that is strictly incidental to a contract (e.g., a contractor's internal accounting system that is not used to perform the government's specific work).
- Mandatory Clause: The clause 52.204-27 is required in all solicitations and contracts without exception, unless a specific waiver is granted under OMB guidance.
Responsibilities
- Contracting Officers (COs): Responsible for ensuring that FAR clause 52.204-27 is inserted into every solicitation and contract issued by the agency.
- Federal Contractors: Must ensure the covered application is not present or used on any IT equipment (company-owned or employee-owned) used during contract performance. They are responsible for flow-down compliance to subcontractors.
- Office of Management and Budget (OMB): Holds the authority to grant rare exceptions to the prohibition based on specific agency needs or national security requirements.
- Contractor Employees: Must comply with the prohibition if they use personal devices to perform work-related tasks under a federal contract.
Practical Implications
- Policy Updates: Contractors must immediately update their internal "Acceptable Use Policies" (AUP) and Employee Handbooks to explicitly forbid the use of TikTok on any device used for work.
- Device Management: To ensure compliance, contractors may need to implement Mobile Device Management (MDM) solutions to monitor and block prohibited applications on company-issued and "Bring Your Own Device" (BYOD) hardware.
- Compliance Risk: Because the clause is required in all contracts, it creates a uniform compliance baseline. Failure to remove the application could be viewed as a breach of contract, potentially leading to termination for default or negative past performance ratings.
- Gray Areas in "Incidental" Use: While the regulation excludes "incidental" equipment, the safest legal posture for most contractors is a company-wide ban to avoid the difficult task of proving a specific device was not used to a "significant extent" in contract performance.