After months of drafts, comments, and pushback from industry on a new Artificial Intelligence (AI) clause, GSA has decided to move forward with it. General Services Administration Acquisition Regulation (GSAR) clause 552.239-7001, “Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems” is a class deviation that becomes effective on October 19, 2026, but Contracting Officers (COs) can theoretically start using it now. GSA has also listed the clause in its advance notice for Multiple Award Schedule (MAS) Solicitation Refresh #34, which is expected to be released in November 2026.
If you've been following our coverage, you'll remember that GSA first floated an AI clause alongside Solicitation Refresh #31 and then pulled it back for more feedback. The final version has taken some consideration from industry comments and has changed significantly from the first draft we saw. In this blog, we'll cover what the clause is, what changed based, and how it fits into Refresh #34.
What Is GSAR 552.239-7001?
GSAR 552.239-7001, or “Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems” governs how contractors handle government data inside LLM-based systems.
This clause was developed to address the growing use of LLMs across the federal government and the need for a standardized approach to data protection, intellectual property, and ethical AI development when LLM's are used to process government data.
Since it was issued as a class deviation, the clause functions as GSA policy until GSA rescinds it or codifies it through formal rulemaking, which the memo says will include a public comment period.
Can Contracting Officers Use the Clause Now?
Yes. Under the memo, COs have discretion to implement GSAR changes ahead of the effective date for new solicitations and contracts. For open solicitations and contracts that have already been awarded, the CO also has discretion on whether to implement the changes. In other words, you could see this clause in a solicitation or contract action before October 19 or before Refresh #34 is released, although it’s not entirely likely.
How the GSA AI Clause Evolved from Industry Comments
GSA made several notable changes between the original draft and the final clause. Here are the ones most likely to matter to Schedule holders:
A Narrower Scope to GSA’s AI Clause
While the original clause applied to how contractors used AI as a whole, even internally, the final clause applies only when the government is procuring an LLM, generative assistant, chatbot, agentic system, LLM-enabled document or productivity tool, where government data will be submitted directly to or produced by the LLM.
Unless the CO says otherwise, the clause is "self-deleting" and imposes no obligation when:
- LLM use is limited to your internal business, back-office, operational, or performance-support systems that are not delivered to or accessed by the government, even if they incidentally process government data.
- LLM functionality is incidental or ancillary to a commercial product or service whose primary purpose is not AI.
The definitions of "Data Inputs" and "Data Outputs" were also narrowed, and metadata and logs are now excluded from Data Outputs.
Flowdown Requirements Tied to Government Data
The flowdown in this clause now applies to subcontractors that perform AI Design, AI Development, AI Deployment, or Operation and Monitoring tasks, as described in NIST Artificial Intelligence (AI) Risk Management Framework (RMF). The prime is still responsible for implementing the clause, but they must use their best efforts to evet AI subcontractors where applicable.
"Unbiased AI Principles" Replaced
The controversial "Unbiased AI Principles" language has mostly been removed. Instead, contractors must use “reasonable efforts” to design, train, and configure the LLM to prioritize accuracy, scientific inquiry, and objectivity. However, the government still reserves the right to run automated assessments of the LLM for bias, truthfulness, safety, and other factors.
Incident Reporting and Liability
The incident reporting trigger was narrowed to incidents affecting an LLM used in contract performance that may affect government data. FedRAMP-authorized systems can use their existing FedRAMP or CISA reports to satisfy the requirement in certain cases. Additionally, contractor liability for decommissioning costs after a for-cause termination is capped at 25% of the affected task or delivery order.
How the AI Clause Fits into MAS Refresh #34
In early October 2026, GSA posted its draft for MAS Solicitation Refresh #34. Under the GSAR Overhaul updates, the Refresh adds new GSAR Part 539 language, "Creating a new AI-related clause for use in GSA contracts, including Schedules, to protect Government Data and to mitigate other risks presented by LLM systems," including the addition of GSAR clause 552.239-7001.
When GSA makes a change to the GSAR, they need to eventually implement it into the MAS Solicitation, so it’s formally wrapped into the MAS Program. This clause was added to protect government data in GSA Schedules and to mitigate other risks presented by LLM systems.
Need Help Preparing for the GSA AI Clause and Refresh #34?
The final AI clause is narrower than earlier drafts, but affected contractors are still going to have to pay close attention to it. Between the October 19 effective date and Refresh #34 coming out in November, now is the time to review how this regulation might impact your offerings.
If you have questions about how the AI clause affects your GSA Schedule, or need help reviewing and accepting Refresh #33 or #34 Mass Mod, Winvale's consultants are here to help.
