GSA LLM Data Clause 552.239-7001: Scope and Effective Date

What is the new GSA clause, and when does it start?

GSAR 552.239-7001, "Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems," effective Oct. 19, 2026, is on page 129 of GSA Memorandum RGO-2026-01, signed by Senior Procurement Executive Jeffrey Koses. The memo was first issued in January and updated Sept. 28. The clause followed drafts released in March and June.

GSA issued the clause through a class deviation, not a final regulation. A class deviation lets an agency depart from its published regulation for a whole category of contracts, so GSA can use the new clause now, before formal rulemaking. That means the clause is policy until GSA rescinds it or completes formal rulemaking, which the memo says would include public comment. Under GSAR 501.107(d), changes apply to solicitations issued on or after the effective date, and contracting officers may add them to existing contracts. The clause took effect Oct. 19, 2026, and GSA has said it applies to new task and delivery orders issued after that date. For Multiple Award Schedule (MAS) contracts, GSA plans to add the clause through MAS Refresh 34, planned for Nov. 6, 2026, so schedule holders will receive it as a mass modification that covers orders issued after it takes effect. Contractors have up to 90 days to accept the modification. The Refresh 34 plan is still in draft and could change before GSA issues it.

What does the clause require?

The clause bars contractors and subcontractors from using government data in certain ways and requires specific safeguards as shown in the table below.

Prohibited	Required
Training, fine-tuning or improving any LLM, including a third party's	Access only by personnel the contracting officer authorizes
Using the data to inform advertising or business decisions	Encrypted transmission and processing
Selling or licensing it	Audit logs of processing activity that do not capture the data itself
Keeping or using it beyond the contract's scope and duration	FedRAMP-authorized or agreed hosting, logical segregation, and deletion at closeout

AI vendors should first look at training. Many commercial AI terms reserve a right to use customer inputs to improve models, and GSA customers will need that right switched off.

Government data means inputs submitted by or for the Government, such as prompts and documents, and outputs such as responses and analyses. System data such as performance metrics and token counts is excluded. The clause also requires contractors to maximize their use of LLMs developed, managed and operated in the United States, and it restricts LLMs and components controlled by adversary foreign governments. Anyone reselling a non-U.S. model should check the provider’s ownership and control.

Which products are in scope, and which are not?

The clause applies when the Government is buying an LLM, assistant, chatbot, agentic system or LLM-enabled productivity tool where LLM functionality is a material feature and government data goes directly into or comes out of the model. It does not apply in two cases, unless the contracting officer identifies otherwise: • Internal use. The LLM sits in the contractor's own back-office tools, which are not delivered to or accessed by the Government, even if they incidentally process government data. • Incidental use. The product's main purpose is not AI, and the LLM feature is not required, not accessed by the Government and not used on government data.

Scenario	Likely Result
LLM used internally to draft proposals	Likely outside, unless the contracting officer says otherwise
SaaS product with an LLM summarizer the agency neither requires nor uses	Likely outside
Same product, but the agency turns on the summarizer and feeds it records	Likely in scope
An AI assistant is the product	In scope

These are general illustrations. The middle rows show why scope can change after award. A feature that starts out as incidental could come within the clause's scope if the agency begins to use it.

What changed from the draft?

GSA’s earlier language drew intense pushback, even after a round of modifications, but industry ultimately got much of what it asked for, according to Washington Technology. Compared with the June draft, FedScoop reports:

“Unbiased AI” language mostly gone. Contractors must instead use reasonable efforts to have the LLM answer factual questions accurately and objectively. The Government can still run automated assessments for bias, truthfulness and safety. The clause still lets the Government request documentation and testing methods tied to unbiased AI principles, though the list of principles was cut, and it reserves a right to evaluate LLMs for “unsolicited ideological content.”
Narrower reach. A material-feature trigger, the internal and incidental exceptions, and tighter data definitions.
Flow-down tied to data handling. See below.
Suspension and cost cap. The Government may suspend use at any time, and decommissioning-cost liability after a for-cause termination is capped at 25% of the affected order.

Reaction since the clause was issued has been mixed but mostly favorable, according to FedScoop. The Center for Democracy & Technology called the final terms a significant improvement, and the Alliance for Digital Innovation sees many improvements but says some areas could still hamper technology companies selling to the public sector. The Electronic Frontier Foundation questioned the undefined “unsolicited ideological content” standard, and CDT said the reasonable-efforts standard could still be read broadly.

What other obligations apply to products in scope?

LLM disclosure (120 days). Disclose the LLMs used on government data by the date the contract sets, or within 120 days of starting work. Existing model cards, FedRAMP packages and SOC reports can be used to make the disclosure.
Incident reporting (72 hours). Report incidents affecting an LLM that may affect government data within 72 hours of discovery, with daily updates and 90-day log preservation. Separately, notify the contracting officer within 72 hours of obtaining actual knowledge of a material violation of the clause.
Closeout deletion. Delete government data and custom developments, including fine-tuned weights, embeddings, indexes and caches, and document it. No numeric deadline applies.
Model-change notice. Give 30 days' written notice before adding, replacing or materially changing an LLM or its providers, or provide concurrent access to the successor model for 30 days (major versions) or 15 days (minor). If a third-party provider forces a deprecation, notify the contracting officer within five business days.
Degradation notice (seven days). Report any change that materially increases bias, weakens safety guardrails or degrades performance or truthfulness within seven calendar days.
Government testing. The Government may run automated assessments with its own benchmarks, and you must make best efforts to provide tools for them.

The Government owns government data and custom developments, and you keep the underlying LLM and base models.

As a prime, does this reach your subcontractors and your model provider?

Yes, a prime must flow the clause down to a subcontractor that designs, develops, deploys, operates or monitors AI, as the NIST AI Risk Management Framework describes those tasks, to the extent it handles government data. Foreign-control paragraphs need not flow to open-LLM components or fully open models. The prime stays responsible and must use best efforts at due diligence, which it can show through flow-down, attestations, or existing artifacts such as FedRAMP packages, SOC 2 reports and ISO 27001 certifications. A third-party provider that runs the model your product calls likely falls within the flow-down.

The bigger challenge may be your model provider's contract terms. The clause takes precedence over commercial supplier agreements, license agreements, terms of service and click-wrap terms, so a conflict with your provider's terms is yours to close. The clause does not, however, replace or modify the standard commercial terms in FAR 52.212-4 or GSAR 552.212-4. You cannot promise GSA that data will not train a model if your provider's terms allow training on inputs, long retention or sharing with affiliates.

What should you do now?

Contractors that sell to GSA and use LLMs, in their products or internally, should run these four checks:

Upstream model-provider terms. Pull the terms for every model your product calls. Look for training on inputs, retention, human review, subprocessors, deletion rights and model-change notice. Close gaps with a government addendum or a different provider.
Subcontract flow-downs. Identify every subcontractor that handles government data or runs a model behind your offering. Confirm that your subcontracts include the clause and require those subcontractors to deliver incident reports and deletion confirmations in time for the 72-hour and closeout duties.
Logging and encryption. Confirm end-to-end encryption. Build audit logs that record processing without capturing the data, can be produced on request, and support 90-day incident preservation.
Incidental-use analysis. Document why each product and internal tool is in or out of scope, and revisit it when an agency enables an LLM feature or a contracting officer identifies an internal use as covered.

We review AI product terms, subcontracts and incidental-use positions for technology companies selling to the government, from small businesses on a first schedule offer to primes on large indefinite-delivery, indefinite-quantity (IDIQ) vehicles. Not sure whether your product is in scope? Contact General Legal's Defense Tech and Government Contracts team to discuss.

Sources

GSA Office of Governmentwide Policy, Memorandum RGO-2026-01, GSAR Class Deviations in Response to Executive Order 14275, GSAR 539.71 and 552.239-7001
K. Sophie Will, GSA issued an AI acquisition policy for new contracts, FedScoop, Oct. 1, 2026
Christian Robles, GSA memo to set AI-specific acquisition rules, Washington Technology, Oct. 2, 2026
GSA, MAS Refresh 34 Significant Changes Attachment
K. Sophie Will, ‘Hallelujah’: Stakeholders react with praise and concern to GSA AI acquisitions clause, FedScoop, Oct. 6, 2026
Ryan Burnette et al., GSAR Class Deviation on Safeguarding Government Data in Large Language Models Takes Effect, Inside Government Contracts (Covington), Oct. 21, 2026
Scott A. Freling et al., GSA Previews Significant Changes Planned for Upcoming Multiple Award Schedule Refresh, Inside Government Contracts (Covington), Oct. 15, 2026
GSA, Advanced Notice for MAS Solicitation Refresh 34 and Upcoming Mass Modification, Oct. 5, 2026

This post reflects a general legal framework drawn from a government memo and news reports. It is not legal advice for any specific company's situation.

Key takeaways

GSA's new LLM data clause (GSAR 552.239-7001) took effect October 19, 2026, and applies only when the government buys AI products where LLM functionality is a material feature, not when AI is merely incidental.
The clause prohibits using government data to train models or inform business decisions, and requires encryption, audit logs, authorized access, and deletion at contract closeout.
Contractors must flow the clause down to subcontractors and model providers that handle government data, but upstream provider terms that conflict with GSA requirements create compliance gaps contractors must close.
The final clause is significantly narrower than earlier drafts, dropping most "unbiased AI" language and adding exceptions for internal and incidental use after industry pushback.
Contractors selling to GSA should immediately review model provider agreements, confirm subcontract flow-downs, implement required logging and encryption, and document which products fall inside or outside the clause's scope.

TL;DR

Effective date and mechanism	GSAR 552.239-7001 took effect Oct. 19, 2026 via class deviation; applies to new solicitations and can be added to existing contracts through modifications like MAS Refresh 34.
Core prohibitions	Bars using government data to train, fine-tune or improve any LLM, inform advertising or business decisions, or sell/license it beyond the contract's scope and duration.
Required safeguards	Mandates authorized-only access, encrypted transmission and processing, audit logs that don't capture data, FedRAMP or agreed hosting, logical segregation, and deletion at closeout.
Scope trigger	Applies when LLM functionality is a material feature of the delivered product; excludes internal back-office tools and incidental features the government doesn't require or use.
Key obligations	Contractors must disclose LLMs within 120 days, report incidents within 72 hours, give 30 days' notice before model changes, delete data at closeout, and flow the clause to subcontractors handling government data.
Changes from draft	Final version drops most "unbiased AI" language, narrows reach with material-feature test and exceptions, ties subcontractor flow-down to data handling, and caps decommissioning liability at 25%.
Model provider challenge	The clause overrides commercial provider terms, so contractors must secure government addenda or switch providers if upstream agreements allow training on inputs or conflict with GSA requirements.
Immediate action items	Review upstream model terms for training and retention rights, confirm subcontract flow-downs, implement logging and encryption, and document incidental-use determinations for each product.

FAQs

Does the GSA LLM clause apply if my product has an AI feature but it's not the main purpose?

It depends on whether the LLM feature is material and whether the government requires, accesses or uses it on government data. If the feature is incidental—not required, not accessed by the agency, and not used on government data—the clause likely does not apply unless the contracting officer says otherwise.

What counts as "government data" under the clause?

Government data includes inputs submitted by or for the government, such as prompts and documents, and outputs such as responses and analyses. System data like performance metrics and token counts is explicitly excluded from the definition.

Do I need to flow the clause down to my third-party model provider?

Yes, you must flow the clause to any subcontractor that handles government data and performs AI-related tasks such as designing, developing, deploying, operating or monitoring the AI. A third-party provider that runs the model your product calls likely falls within this flow-down requirement.

What happens if my model provider's standard terms allow them to train on customer inputs?

The GSA clause takes precedence over commercial terms of service and license agreements, so any conflict is yours to resolve. You must either negotiate a government addendum with your provider that prohibits training on government data or switch to a different provider whose terms comply.

How much time do I have to report an incident affecting government data?

You must report incidents affecting an LLM that may impact government data within 72 hours of discovery, provide daily updates thereafter, and preserve logs for 90 days. You must also notify the contracting officer within 72 hours of learning of any material violation of the clause.

When does the clause apply to existing GSA Multiple Award Schedule contracts?

GSA plans to add the clause to MAS contracts through MAS Refresh 34, scheduled for November 6, 2026, as a mass modification. Schedule holders have up to 90 days to accept the modification, and it will cover orders issued after the modification takes effect.

Does GSA's New LLM Data Clause Reach Your Product?