GSA's LLM contract clause, effective 19 October 2026, makes vendors report model regressions within 7 days and bars them from training on government data.
The General Services Administration has issued a standard clause for buying large language models, and it takes effect on 19 October 2026. GSAR 552.239-7001, "Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems," ships as part of class deviation RGO-2026-01. It applies to any GSA procurement where the government is buying an LLM, chatbot, agentic system or LLM-enabled productivity tool and agency data will pass through it. Commercial products and services are covered, and the clause overrides the vendor's own terms of service where they conflict.
What changed for vendors
Notice of model changes. A contractor must tell the contracting officer within seven calendar days of identifying a material change that materially increases output bias, lowers safety guardrails or behavioural constraints, or degrades performance or truthfulness. The notice must describe the change, its purpose, how it was evaluated and any new limitations. Separate rules sit alongside it. Thirty days' written notice is due before adding or replacing a model or its developers, operators or service providers, or changing FedRAMP status. Contractors must also give reasonable concurrent access to a successor model for 30 days (major versions) or 15 days (minor), and where a third-party provider forces a deprecation they must pass the news on within five business days.
No training, no monetisation. The government owns its inputs, outputs and any custom development. The contractor gets a limited licence to use them for the contract, for de-identified aggregated security telemetry, for support, and for uses the contracting officer authorises in writing. Prohibited uses include training, fine-tuning or improving any LLM, including third-party models and models for other customers, using the data to inform advertising, marketing, sales, monetisation or strategy, and selling or licensing it. Any IP a contractor acquires in government data is assigned to the government, though general capability gains that do not incorporate or reveal that data are excluded. At the end of the contract, data and custom artefacts such as fine-tuned weights, embeddings, indexes and caches must be deleted and the deletion documented.
Suspension and capped exit costs. The government can suspend use of the LLM at any time. If it terminates for cause after the contractor fails to remediate following specific written notice, the contractor owes reasonable decommissioning costs. Those exclude re-procurement and replacement-system costs and are capped at 25% of the value of the affected task or delivery order. The government must share enough information, under confidentiality protections, for the contractor to understand the finding.
Notice and access windows in GSAR 552.239-7001, in days. Source: GSA class deviation RGO-2026-01.
Other obligations
- Incidents: 72 hours to report incidents affecting government data, with daily updates, 90-day log preservation and a CISA incident form. A 72-hour clock also applies to material violations of the clause itself. FedRAMP reporting can satisfy overlapping duties.
- Data location: government data stays on agreed premises or FedRAMP-authorised services, logically segregated from other customers.
- Provenance: contractors must disclose the LLMs used (by default within 120 days of starting work), maximise use of US-controlled models, and avoid core components controlled by adversary governments. They must disclose modifications made for non-US governments within 30 days.
- Traceability: a summary of recorded processing steps, model routing, retrieval sources and human-reviewer access must be available through the interface or an API. GSA states this is a summary of recorded steps, not an explanation of the model's reasoning.
- Evaluation: the government may run its own automated benchmarks for bias, truthfulness, safety and "unsolicited ideological content," and vendors must make best efforts to provide tooling for it.
- Portability: export in open machine-readable formats, with no proprietary-format barriers.
- Open models: a Fully Open Model (architecture, weights, code and datasets all public) escapes the foreign-control flowdown. An open-weight model does not; it gets lighter best-effort diligence.
Scope and flowdown
The clause applies only when LLM functionality is a material feature of what the government buys and government data goes into or out of it. It deletes itself where the contractor uses AI only for internal back-office work that is not delivered to or accessed by the government, or where an LLM feature is incidental to a non-AI product. Flowdown reaches subcontractors that design, develop, deploy or operate the model and handle government data. Primes must use best efforts on due diligence and can lean on attestations, model and system cards, FedRAMP packages, SOC 2 reports and ISO 27001 certificates rather than new paperwork. FedScoop reports that the final text dropped most of the June draft's "unbiased AI principles" language, loosened the suspension standard and narrowed flowdown. The final text, however, still references unbiased AI principles in its documentation and performance paragraphs.
What to do
Vendors: map which contracts and offerings fall under the applicability test; build a change-management path that can detect a bias, safety or truthfulness regression and file within seven days; confirm that no government data reaches training, evaluation or product analytics pipelines, including those of subprocessors; line up model cards, FedRAMP and SOC 2 evidence; and plan for a 25% exposure on each affected order. Buyers: contracting officers may apply the clause ahead of the effective date and, per FedScoop, change existing contracts at their discretion; define the notice recipients and escalation path, and decide what benchmarks you will run. As a class deviation it remains policy until GSA rescinds it or codifies it through rulemaking with public comment.