GSA Issues AI Contract Rules With Data Safeguards and Broad Suspension Rights

The General Services Administration has given contracting officers AI purchasing terms they can use immediately, without waiting for formal rulemaking. The clause tightens protections for government data and preserves the government’s power to suspend model use. Issued as an exception to GSA’s acquisition regulations, it has a stated effective date of October 19, 2026, FedScoop reported.

The mechanism is a class deviation: a policy that remains in place until GSA rescinds it or turns it into a regulation through formal rulemaking. Contracting officers may also change existing contracts at their discretion. That gives the agency a route to apply the terms before the next public rulemaking process is complete.

Industry objections reshaped the terms

GSA previously proposed an AI acquisition rule and sought two rounds of public comment. More than 75 comments arrived over the summer, alongside critical industry feedback. One contested provision required adherence to “unbiased AI principles.” Industry groups warned there was no clear way to test compliance with that requirement, according to Nextgov/FCW.

That language has mostly disappeared, along with a ban on embedding “partisan or ideological judgments.” The replacement requires contractors to use reasonable efforts to design, train and configure large language models—the text-generating systems covered by the clause—to prioritize accuracy, scientific inquiry and objectivity. Models must acknowledge uncertainty when reliable information is incomplete or contradictory.

Government oversight remains broad. The clause permits automated assessments for bias, truthfulness, safety, unsolicited ideological content and other government-selected factors. Unlike the June draft, which described suspension until performance issues were satisfactorily addressed, the new wording allows suspension at any time.

The Government retains the right to suspend use of the LLM at any time

GSA AI acquisition clause, quoted by FedScoop

The boundary is what government buys and accesses

The clause now applies when government buys AI, expressly including AI-enabled document and productivity tools. Contractors’ internal AI use is excluded so long as the tools are not delivered to or accessed by government, unless a contracting officer identifies them otherwise. Requirements passed down to subcontractors now turn on whether they handle government data, rather than their roles alone.

The policy also distinguishes fully open models from open-weight models. Prime contractors need not pass foreign-control requirements to fully open models that publish architecture, weights, code and data, or to other open-source components. Models that publish only their weights—the learned settings that shape their outputs—do not receive that exception.

Data restrictions come with continuing duties

• Contractors cannot use government data to train models, inform advertising or sell to third parties.
• Data-handling procedures must include encrypted transmission and audit logging.
• Cloud hosting, technical support, security and maintenance providers may access government data only as necessary to perform the contract.
• Contractors must report material changes that materially increase output bias, weaken safety controls or degrade performance or truthfulness within seven calendar days.

Prime contractors remain responsible for implementing the clause and must use “best efforts” to vet AI subcontractors. GSA also capped contractor liability for decommissioning costs after a termination for cause at 25% of the affected task or delivery order.

Kevin Martin, a GSA program manager at Government Acquisitions Inc., described the remaining workload as substantial. In a LinkedIn post quoted by Nextgov/FCW, he cited a 120-day disclosure deadline, 72-hour incident reporting, deletion of embeddings and fine-tuned weights at contract closeout, and 30 days’ notice with concurrent access before a major model swap.

Formal rulemaking is still ahead

Quinn Anex-Ries, a senior policy analyst at the Center for Democracy and Technology, welcomed the terms as a significant improvement and a stronger foundation for protecting government data. The next procedural step remains unsettled: GSA says formal rulemaking will include public comment, but dates have not been announced. Feedback can still be submitted through its GSAR Overhaul website.