A federal rule for buying artificial intelligence took effect on October 19, and it reaches the contracts that decide which AI models agencies can use and how easily they can leave. The General Services Administration’s clause GSAR 552.239-7001 governs how contractors handle government data inside large language model systems. It also sets portability and vendor notice rules that could change how these deals are written.
GSA issued the final clause on September 28, 2026, after months of drafts and industry pushback. According to Crowell’s client alert, the final version narrows which contracts are covered, expands contractor intellectual property protections and replaces the earlier “unbiased AI principles” test with a reasonable-efforts standard. It also adds a safe harbor tied to FedRAMP and CISA for incident reporting. The formal title is “Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems.”
A note on sourcing: this story relies on law firm and consultancy summaries rather than the clause text itself. Anyone bidding on federal work should read the GSA document directly before acting on the specifics below.
How the GSA AI clause applies to LLM contracts
The clause is triggered by data, not by vendor type. According to the Federal Register text, the contracting officer must insert the clause in solicitations and contracts, including those for commercial products and services, whenever government data will be processed by a large language model.
The clause also gives the government significant rights over government data and certain related custom developments. It limits contract restrictions that could impair migration to another system, according to Government Contracts Law. That combination matters most in lock-in disputes. If a vendor’s terms make leaving expensive, the clause pushes against those terms for covered work.
The reach extends past federal agencies. Vertosoft’s summary says the clause covers GSA procurements by entities authorized under 40 U.S.C. §§ 501 and 502, which include eligible state and local governments. A state or county buyer using a GSA schedule could find the clause in its paperwork.
Scope is not read the same way everywhere. One analysis from Winston Taylor says the clause applies to the delivery of AI models rather than to every agency or contractor use of AI. That distinction determines whether a contractor’s internal AI tools fall under the rule, and the summaries do not settle it.
When the clause starts appearing in contracts
Taking effect and appearing in an order are different events. Federal News Network reports that the effective date does not mean the clause is in contracts today. It must first appear in the next schedule refresh and then be implemented after a lag. Wiley’s alert says GSA plans to add the clause to MAS Refresh 34, scheduled for November 6, 2026, and will hold a webinar on that refresh on October 26.
Contracting officers have discretion to apply the clause before the effective date, according to Vertosoft and Winvale. The likely result is uneven adoption over the coming months, with some agencies moving early and others waiting for the refresh.
The drafting history is also disputed. The Federal Register cites a January 12, 2026 version and a June revision, while another analysis describes initial and revised drafts released in March and June 2026. The June revision narrowed applicability to contractors using LLMs to process government data, while making compliance obligations more detailed, according to Winvale. The effective date is not in dispute, but anyone trying to trace which version a contract cites will need to check the record carefully.
Notice deadlines and the 72-hour reporting clock
Winston Taylor’s compliance analysis describes three separate clocks.
| Trigger | Required response |
|---|---|
| Material change, such as adding or replacing an LLM | Prior written notice, 30 calendar days |
| Provider-driven deprecation | Notice within 5 business days |
| Material violation | Report within 72 hours of actual knowledge |
Because the 72-hour clock starts at actual knowledge rather than when a violation occurred, internal escalation paths will matter. Companies that route security and compliance reports slowly could find the window closing before they act.
Enforcement remains untested. None of the sources reviewed for this story describe an enforcement action or a public track record for these windows, so how strictly GSA will read these deadlines is still an open question.
What the clause means for vendors and contractors
Government Contracts Law tells contractors to check whether their orders carry the clause and to reconcile it with commercial terms. For a company selling an LLM product through a GSA schedule, the first job is an inventory. That means listing every federal order, pending bid and schedule contract where government data will flow through the model.
Vendors face a harder question. Portability and migration limits may reshape lock-in terms in commercial licenses, and the government’s expanded rights over its data give agencies more leverage in disputes. Vendors that counted on switching costs to hold federal customers will need to revisit that assumption for covered work.
The clause lands alongside a pricing shift. GSA replaced its $1 AI deal with a 27-month consumption-based arrangement running October 1, 2026 through December 31, 2028. It offers 50% off token-based pricing with no platform fee or minimum commitment. Spending will track usage rather than a fixed commitment, which makes the portability terms more consequential, since an agency that can move easily has more room to negotiate on price.
Where the clause fits in federal AI policy
There is no single comprehensive federal AI statute. Oversight is spread across existing agencies, and most binding obligations for companies currently come from state laws such as Colorado’s AI Act and California’s transparency rules, according to the AI Law Tracker. The GSA clause works within that patchwork as a contract term, not as a rule for the whole industry.
The White House has favored a light-touch approach. Its legislative blueprint was framed as a response to a growing patchwork of 50 state regulatory regimes. A procurement clause suits that posture, since it governs how the government buys rather than private conduct at large.
Congress is moving in parallel. Sen. Maria Cantwell released a framework on October 8 that would have NIST set standards for frontier models. A bipartisan Senate bill would require agencies to notify the public when they interact with AI, according to Federal News Network’s report on lawmakers.
The tension shows up in how procurement experts describe the rule. In an interview with Federal News Network, Emily Murphy, a senior fellow at George Mason University’s Baroni Center for Government Contracting, put the balance in one line: “we don’t want to regulate superintelligence.”
Agencies are also writing their own rules. The revision of DHS’s AI directive shows how internal governance is changing alongside outside procurement requirements. DHS revised its AI directive so its chief AI officer can waive bans and is a useful companion read.
What contractors should do before the October 26 webinar
- Identify current and pending orders that may carry the clause, starting with any solicitation where government data will be processed by an LLM.
- Map the notice deadlines of 30 calendar days, 5 business days and 72 hours against vendor product-change and model-deprecation cycles.
- Review commercial terms for portability, data ownership and IP language that could conflict with the clause.
- Attend the October 26 GSA webinar and read the MAS Refresh 34 text once it is published.
Readers outside federal procurement have no direct action to take. Taxpayers and agency staff will still feel indirect effects, because the rules shape how agencies can switch AI vendors and handle data. That is an inference from the portability terms, not a stated goal of GSA.
What to watch next
Three things will show how far this clause reaches. First, the MAS Refresh 34 text, slated for November 6, will show how GSA writes the clause into the schedule and will be the first concrete test of the rollout. Second, GSA may take the clause through formal rulemaking with public comment, a step one analysis says the memo contemplates. Third, the first application of the 72-hour rule will show how GSA reads “actual knowledge” and “material violation” in practice.
The clause’s real test will come after the refresh, when contracting officers begin writing it into orders and vendors work out how it fits their existing terms.
