GSA Implements Immediate AI Acquisition Rules for Contractors

The General Services Administration (GSA) has taken a significant step forward in regulating the acquisition of artificial intelligence (AI) technologies by issuing a new class-deviation clause, 552.239-7001, which will be available for immediate utilization by contracting officers. This clause, effective October 19, 2026, introduces specific protocols for federal acquisitions that incorporate large language model (LLM) functionality, particularly concerning the handling and protection of Government Data submitted to or generated by these AI models.

As AI technologies increasingly permeate government functions, the importance of robust safeguards around government data has become critical. This newly instituted clause requires contractors and related subcontractors to develop stringent measures for protecting Government Data. Key stipulations include a prohibition on using governmental data for training LLMs, advertising, or resale to third parties. Furthermore, contractors are now mandated to implement defined security protocols that encompass data handling, disclosure requirements, incident reporting measures, model-change policies, and methodologies for closure post-contract.

The applicability of this clause extends beyond new acquisitions, as contracting officers are granted discretionary authority to apply these rules to existing contracts. Consequently, contractors must not only prepare for upcoming bids but also evaluate their current agreement portfolios to assess compliance risks and possible data handling adjustments. Notably, internal uses of LLMs that remain solely within a contractor's back-office systems are exempt from coverage under this clause when those tools do not interact with government data.

GSA's decision to amend its AI acquisition regulations follows extensive stakeholder engagement, including a public comment period where industry feedback led to several modifications. For example, the original language that enforced compliance with unbiased AI principles has been largely removed, much to the relief of industry representatives who deemed the criteria problematic and difficult to enforce. As Kevin Martin, a GSA Program Manager, remarked, the adjustments significantly improve the usability of the clause while still addressing concerns pertinent to data safeguarding.

Other noteworthy provisions in the new stipulations include mandated adherence to standards outlined in the NIST AI Risk Management Framework, rights for the government to test and suspend LLM applications, and enhanced intellectual property protections for contractors. Additionally, decommissioning liability for contractors has been capped at 25% of the affected task or delivery order costs. The clause strategically focuses on protecting government information while allowing for a level of operational flexibility for contractors, particularly regarding the development and deployment of AI solutions.

With only 16 days remaining until the formal implementation of these regulations, contractors are strongly advised to promptly identify affected AI systems and their associated subcontractors. Moreover, organizations should assess data flows, review existing compliance controls, and prepare for the requisite reporting and disclosure processes outlined in the new guidelines. Contractors may also wish to engage in discussions with legal and compliance professionals to ensure that all operational facets align with the forthcoming rules, thus avoiding potential penalties or conflicts with compliance requirements.

Ultimately, these new rules represent a watershed moment in federal AI procurement practices, positioning the government to better protect sensitive data while fostering an environment conducive to innovation in artificial intelligence. By establishing clear standards and requirements, the GSA is attempting to bolster industry confidence while ensuring that contractors understand their obligations in safeguarding government data.

• GSA’s new AI procurement clause focuses on data protection for large language models.
• Effective date for the new regulations is October 19, 2026, with current contracts potentially impacted.
• Contractors must develop stringent requirements to safeguard government data; prohibited uses include training or selling it.
• The clause addresses risks through NIST AI Risk Management Framework requirements and contractor rights.
• Discretionary applicability allows contracting officers to enforce the clause on existing contracts at their judgment.
• Heavy penalties like capped liability of 25% for decommissioning costs impact contractor assessments.
• The removal of the previously controversial mandates on unbiased AI represents a significant industry win.
• Speed of compliance preparation recommendations includes assessing covered AI systems and updating data flows in advance.