Background

On September 28, 2026, the General Services Administration (GSA) issued a new clause for incorporation into government contracts of artificial intelligence systems, 552.239-7001, Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems, as a GSA Regulation Deviation (the Final Clause). The Final Clause will become effective on October 19, 2026.

GSA’s efforts to regulate contractor handling of government information processed by large language models (LLM) have moved through three phases. An initial draft released in March 2026 drew substantial industry criticism for its breadth, including an outright prohibition on AI components “manufactured, developed, or controlled by non-U.S. entities.” GSA responded with a revised version published for public comment on June 17, 2026 (the June Proposed Clause), which removed the non-U.S. component prohibition, introduced role-based supply-chain definitions, and restructured IP protections.

The Final Clause contains several notable changes over the June Proposed Clause, which are summarized below. Contractors should assess the impact of these provisions on their systems in anticipation of the incorporation of the clause into GSA LLM procurements. The clause is effective October 19; however, GSA contracting officers could exercise discretion to incorporate the clause in advance of that date.