GSA’s New AI Clause Signals Increased Compliance Expectations for Federal Contractors

Article by: Nicholas Perry, Senior Associate

The General Services Administration (“GSA”) recently released final language for its new AI clause, GSA Acquisition Regulation (“GSAR”) 552.239-7001, Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems. The clause applies only in limited circumstances, generally where the Government is procuring an LLM, chatbot, agentic system, or similar product in which LLM functionality is a material feature and Government Data will be submitted to or produced by the LLM. The clause expressly does not apply where AI use is limited to a contractor’s internal operations or where LLM functionality is merely incidental to the product or service being acquired.

For small and emerging government contractors, the most immediate impact is the creation of a new compliance framework governing Government Data within covered AI systems. Among other things, contractors must implement safeguards to protect Government Data, notify the contracting officer of certain material violations and security incidents within 72 hours, exercise due diligence in selecting and overseeing covered subcontractors, and flow specified requirements down to subcontractors performing AI design, development, deployment, or operational functions. These requirements underscore GSA’s emphasis on data protection, subcontractor oversight, and accountability throughout the AI supply chain.

Small businesses developing AI-enabled products should also pay close attention to the clause’s treatment of intellectual property and Government Data. The clause preserves contractor ownership of underlying models, background data, and pre-existing intellectual property, while imposing significant restrictions on the use of Government Data. Most notably, the clause generally prohibits contractors from using Government Data to train, fine-tune, or otherwise improve LLMs absent specific authorization. For small and emerging AI companies that rely on customer data to improve model performance, this provision may require careful consideration of model-development, deployment, and data-management practices.

Although the clause currently applies only to a subset of GSA acquisitions involving covered LLM systems, it offers an important glimpse into the federal government’s evolving approach to AI procurement. Small businesses pursuing AI opportunities should begin evaluating their existing processes for Government Data protection, subcontractor oversight, incident reporting, AI documentation, and model governance. Contractors that establish these controls early will be better positioned to compete as agencies continue developing AI-specific procurement requirements across the federal marketplace.