The GSA LLM data clause takes effect on October 19, 2026, and for the first time writes a uniform contractual floor for how government data must be handled when the U.S. federal government buys large language model services. The U.S. General Services Administration (GSA) issued clause 552.239-7001, titled Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems, on September 28, 2026, as a regulation deviation ahead of formal rulemaking. It does not regulate model vendors in general; it governs the federal procurement line: anyone who wants to sell an LLM into a federal contract must follow these data rules.
First, work out which contracts are actually caught
The clause sets a two-part test, and both limbs must hold: the government must be procuring a product or service in which LLM functionality is a material feature, and government data must be submitted directly to, or produced by, the LLM. Two self-deleting situations are spelled out just as clearly: a contractor's purely internal back-office, operational or performance-support use that the government neither buys nor accesses is out, and so is LLM functionality that is merely incidental to the product being bought. Draft versions in March and June 2026 drew heavy industry pushback for their breadth, including a ban on AI components made or controlled by non-U.S. entities; the final clause drops that and narrows the scope to procurements that genuinely process government data. A minor AI add-on inside ordinary office software will not be caught for now; but if the government is buying for the model's capability and data will flow into the model, there is no grey area left.
What may and may not be done with government data
The prohibitions are firm: government data may be used only to perform the contract, for cybersecurity, fraud prevention and threat detection using de-identified aggregated telemetry, or for necessary technical support. Without the contracting officer's written consent, it may not be used to train, fine-tune or improve models for other customers, may not inform advertising, may not be sold to third parties, and may not be moved outside the agreed premises or FedRAMP-authorized services.
The duties form a full data-management set: disclose the LLMs used in performance; apply access controls, encryption in transit and audit logging; logically segregate government data from other customers' data and store or process it only as necessary; provide tools for the government to keep processing records; support human oversight, data portability and interoperability with other government systems; and, at completion, termination or expiry, securely and permanently delete government data from the LLM, including embeddings and fine-tuned weights, with a preference for maximizing U.S.-controlled models. The approach differs from the risk-tiered enforcement of the EU AI Act: the EU regulates systems placed on the market, while this clause has the U.S. government, as a buyer, fencing in its own data contractually first.
Model swaps, incidents and non-compliance all carry a stated price
Replacing, adding or materially changing an LLM or provider requires advance written notice to the contracting officer, and major swaps involve giving the government concurrent access to the successor model. Security incidents affecting an in-scope LLM that may affect the confidentiality, integrity or availability of government data must be notified under the clause; reports already made through FedRAMP, CISA or similar federal channels count, if they contain substantially the same information and are provided to the contracting officer at the same time. Flow-down follows the task categories of the NIST AI Risk Management Framework: subcontractors performing AI design, development, deployment or operation and monitoring tasks who handle government data must be covered accordingly.
The intellectual property lines are also drawn: the government keeps ownership of government data and custom developments, while the contractor keeps its pre-existing products, technology and background data; improvements derived from government data are assigned to the government, except general capability gains that do not reveal government data. The government may suspend use of the LLM at any time; uncured non-compliance can leave the contractor paying decommissioning costs capped at 25% of the affected order's value, excluding re-procurement and replacement-system costs. One notable relaxation is on objectivity: June's detailed unbiased-AI principles are compressed into a reasonable-efforts duty to prioritize accuracy, scientific inquiry and objectivity on factual prompts, and to acknowledge uncertainty.
Four things contractors should do before October 19
First, test each product against the two-part threshold, record which offerings are in scope and which can rely on a self-deleting condition. Second, close the gaps in model inventories, data flows, encryption and logging, and deletion procedures, especially the ability to delete embeddings and fine-tuning artefacts at closeout, which many vendors have not previously needed. Third, map the subcontractor chain and prepare flow-down terms for those who will touch government data. Fourth, write the notification workflow for model changes and security incidents into internal procedures, naming who notifies the contracting officer and when. For now the clause applies only to U.S. federal GSA procurements and to state and local purchases made under that authority; it does not directly bind commercial LLM services sold to ordinary businesses or consumers. But federal contract terms have a habit of becoming the reference point in wider negotiations, so vendors selling to public-sector customers elsewhere will find it hard to treat this as a purely American matter.
