US GSA clause on protecting government data in AI language-model contracts takes effect 19 October

The US General Services Administration (GSA) has added a new contract clause, GSAR 552.239-7001, "Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems", to its acquisition regulation as a class deviation. GSA's deviation memo lists 19 October 2026 as the effective date for the part of the regulation that holds its contract clauses (Part 552), and says contracting officers may apply the changes earlier. As reported by law firm Crowell & Moring, GSA issued the final clause on 28 September after drafts released in March and June 2026 drew industry criticism. The clause applies when GSA buys an LLM, generative assistant, chatbot, agentic system or similar product where LLM functionality is a material feature and government data is submitted to or produced by the model; it does not apply to a contractor's internal back-office use or where LLM features are incidental to the product being bought. Where it applies, contractors may not use government data to train or improve models, to inform their advertising or business decisions, or sell it; must disclose the LLMs used to process government data (within 120 days of starting work if the contract sets no date); must give the government reasonable means of human oversight, including a summary of the steps the model records; and must report incidents that may affect government data within 72 hours. Requirements flow down to subcontractors doing AI design, development, deployment or monitoring work. GSA says formal rulemaking, with a full notice and comment period, will follow.

What it means for business: AI vendors selling LLM-based products to US federal agencies through GSA should check whether their contracts now carry this clause and whether their data-use, disclosure and incident-reporting processes meet it.