On September 28, 2026, the General Services Administration (GSA) announced the final version of a new class deviation, titled “Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems,” that applies compliance requirements to contracts involving the use of large language models (LLMs). The new clause went into effect on October 19, 2026, and imposes binding data-protection obligations on GSA contractors whose LLM AI systems process Government Data (which generally includes information submitted to the LLM and the content it produces) under GSA contracts, governing how that data is owned, secured, handled, and used. This final version of the clause largely preserves the content of the earlier drafts released in March and in June.
This builds on our recent post on Multiple Award Schedule (MAS) Refresh 34 that reviewed the AI clause at a high level. In this post, we review the main provisions of the AI clause in more detail and provide takeaways for contractors.
Scope
The class deviation applies broadly to procurements involving an LLM, generative assistant, chatbot, agentic system, LLM-enabled document or productivity tool, or similar system where LLM functionality is a material feature and government data will be submitted directly to or produced by the LLM. This includes procurements for commercial products and services and therefore appears to apply to contracts that will leverage popular commercial AI models.
The deviation carves out application of the new clause in two scenarios. First, the requirements do not reach LLM uses “limited to the contractor’s internal business, back-office, operational, or performance-support systems” that are “not delivered to or accessed by the Government, even if they incidentally process Government Data.” Second, the requirements do not apply to LLM functionality that is “incidental or ancillary” to the “commercial products or services” being procured, “where the product’s primary purpose is not AI or LLM functionality,” and where the functionality is not required or accessed by the Government or used to process Government Data. How these exceptions are interpreted by GSA will be critical to the long-term impact of this rule.
Clause Requirements
The main requirements of the clause are summarized below.
- Cybersecurity. The clause imposes notable cybersecurity obligations on contractors. These include detailed requirements relating to data-handling, localization, logical-segregation, and documented deletion. These obligations extend beyond the model itself, because the clause defines an LLM to include information systems “in which the model is configured, deployed, operated, monitored or made available for the processing of Government Data.” The clause recognizes that logical segregation and cybersecurity incident reporting requirements can be satisfied with adherence to Federal Risk and Authorization Management Program (FedRAMP) requirements, which may already apply to many cloud-based LLM systems (and services that leverage those systems) that process Government information. The clause includes other notable requirements as well. For example, at the end of the contract, the clause requires the contractor to confirm deletion of Government Data to the contracting officer in writing, and prohibits the transmission, storage, or access of Government Data outside the agreed-upon premises or authorized services without express written consent.
- Domestic Origin and Foreign Control. The clause requires contractors to maximize the use of LLMs that are developed, managed, and operated in the United States and subject to U.S. law and jurisdiction. It also restricts the use of LLMs, and certain components of those systems, that are developed, managed, or operated by entities subject to the direction, influence, or control of adversary foreign governments. At the same time, the clause allows foreign-developed components or ancillary third-party products or services if they do not introduce material prohibited security risks or foreign control and if systems that store or process Government Data satisfy applicable federal security requirements.
- Notification Requirements. The clause imposes an obligation to notify the contracting officer within 72 hours of the contractor obtaining actual knowledge of a material violation of the clause. “Material violation” is defined as “a violation that has resulted in, or would reasonably be expected to result in, a significant adverse effect on contract performance, Government rights or interests, security, confidentiality, legal compliance, or the Government’s ability to administer or enforce the contract.” Because of the range of obligations imposed by the clause, standard incident response procedures may not satisfy these notification requirements, and contractors may either need to revisit those procedures or develop separate processes to satisfy these obligations.
- IP Rights. The clause also provides the Government with expansive IP rights, stating that “the Government retains full ownership of, and will own, all Government Data . . . and Custom Developments,” with Custom Developments being defined to include any work of designing or modifying an LLM or how an LLM is implemented and used, along with any related work product. The clause grants the contractor only a limited, revocable license to use that data for performance and cybersecurity purposes, and bars the contractor from using Government Data to train, fine-tune, or improve any LLM, to inform business decisions, or to sell or license it. The contractor retains the underlying LLM, base models, and background data.
- AI Principles. The deviation requires adherence to “Unbiased AI Principles,” meaning contractors must use reasonable efforts to train or configure LLMs to prioritize accuracy, scientific inquiry, and objectivity. The clause further reserves the Government’s right to run automated assessments of LLMs “at any time” using its own benchmarks. The Government generally would not be required to disclose the underlying data or methodologies that it uses for this assessment, except that the Government must disclose information used as the basis for any termination decision.
- Flow Down Requirements. Contractors must flow aspects of the requirements down to subcontractors that handle Government Data in performing “AI Design,” “AI Development,” “AI Deployment,” or “Operation and Monitoring” tasks. Moreover, the requirements indicate that the prime contractor must use best efforts to exercise diligence in selecting and overseeing entities performing those roles. Prime contractors can demonstrate compliance by flowing down applicable requirements or obtaining attestations. Subcontractor attestations must be supported where practicable by independently verifiable evidence and updated if the subcontractor’s compliance changes.
Considerations for Contractors
The deviation presents several practical considerations:
- Contractors will need to take note of the data-handling and 72-hour incident notification requirements and should assess whether new procedures are needed to address these obligations. Contractors may consider cataloging the AI systems used in performance of any existing GSA contracts and reviewing cybersecurity controls and vendor diligence processes that have been implemented in connection with those systems under other requirements, such as FedRAMP. In particular, contractors should consider who within the company should be responsible for compliance with the notification requirements, since existing incident response processes designed to address cybersecurity issues may not be appropriate for assessing and remediating non-compliance with these obligations.
- Contractors should also be aware of potential False Claims Act (FCA) risks as a result of the requirements. For example, the requirement to disclose LLMs used to process Government Data, together with the “Unbiased AI Principles,” could raise FCA considerations, particularly where a prime contractor relies on subcontractor attestations or other information concerning compliance by service providers it does not directly control.
- Beyond these immediate considerations, the deviation clause leaves certain questions unresolved, including what independently verifiable evidence may be needed to support subcontractor attestations. Additionally, several terms central to the scope remain undefined, including the meaning of “incidental or ancillary” to the commercial products or services, the precise scope of the Government’s license, and the breadth of “Custom Development.”
As GSA notes, the deviation clause will apply to all new task and delivery orders issued after October 19, 2026. The agency is anticipated to use the class deviation until the final rule is published in the Federal Register.