GSA Sets New Rules for Contractor Use of Government Data in LLMs

The General Services Administration (GSA) has established new rules for how contractors handle government data in large language model (LLM) artificial intelligence systems. Titled “Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems,” the rule sets out actions contractors may and may not perform when processing government data through LLMs. The policy reflects agencies’ efforts to exercise greater control and ownership over information they provide or generate, making data governance a more prominent consideration for companies supporting federal customers.

The new requirements have practical implications for contractors that use LLMs in federal work, including how they process, retain, and otherwise handle government data. The source describes a list of permitted and prohibited activities, but does not enumerate those activities in detail. Contractors should therefore review the rule itself rather than assume that existing commercial AI practices or internal policies are sufficient for federal workloads. Companies should also be prepared to explain how their systems handle government information if customers scrutinize their LLMs.

The rule is relevant to both technology providers and the broader federal industrial base. Mark “Whit” Whittington, vice president of government sales at Seekr’s federal business, discussed the rule’s implications in a Washington Technology WT 360 episode with senior staff reporter Ross Wilkers. Whittington addressed how contractors can use data before government customers take a closer look at their LLMs, as well as markers to watch as federal AI acquisition develops. For procurement and delivery teams, that points to a need to connect AI tool selection and deployment decisions with contract requirements, data-handling practices, and customer expectations.

For businesses pursuing or performing federal AI work, the rule is an acquisition signal as well as a compliance consideration. Data ownership and AI processing practices may become more important in customer reviews, solution design, and discussions about acceptable use. Contractors can use the requirements to inform planning before a procurement or customer review begins: inventory LLM use involving government data, identify where data flows through systems, and confirm that proposed practices align with the rule’s permitted and prohibited activities. The source does not specify penalties, implementation dates, or particular contract vehicles, so firms should consult the rule and applicable contract direction for those details.

• GSA issued “Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems.”
• The rule defines permitted and prohibited contractor activities involving government data in LLM systems.
• The policy signals stronger agency interest in control and ownership of government data.
• Contractors should review the rule and assess how their LLMs process and handle government information.
• AI, security, compliance, and procurement teams should coordinate on federal data-use practices.
• Companies should be ready to explain their LLM data handling when government customers examine their systems.
• Seekr’s federal business vice president Mark “Whit” Whittington discussed the rule’s implications with Washington Technology reporter Ross Wilkers.
• Contractors can use the rule to inform planning for federal AI work as acquisition practices develop.