Wire
GSA drafts safeguards to protect federal data in AI contracts
GSA is asking vendors, contractors and integrators how to protect government data inside large language models before it writes a procurement clause. Comments are due Aug. 3, with a listening session set for July 14.
Federal agencies buying AI tools are being told to look more closely at what happens to their data once it enters a large language model, or LLM. The General Services Administration is seeking public comment on a draft General Services Acquisition Regulation clause covering basic safeguarding of data within LLM systems.
Comment deadline: August 3, 2026 Submit comments: https://www.regulations.gov Effective date: Tuesday, July 14, 2026
The notice is aimed at contractors, vendors and integrators that build or handle AI systems for the government. GSA is also planning a public listening session on July 14, 2026, and written comments are due August 3, 2026.
Where the draft draws its lines
The proposal is written around government data processed by an LLM. It does not reach every product with AI built into it. GSA says the draft would not apply when the model is tucked inside a common commercial product, such as a word processor or map app, or when the AI function is only incidental to the main purchase.
The notice also sketches out who would sit in the supply chain: LLM developer, system operator, system integrator and service provider. Some of those obligations would flow down to subcontractors or service providers in those roles, which means the draft is aimed at more than the prime contractor signing the federal deal.
Why GSA is asking first
GSA says the issue is complex enough that it wants feedback before it takes any future action, including a possible deviation or formal rulemaking. That makes this an early look at where federal procurement rules may be headed, not a finished compliance regime.
For companies selling AI to the government, the shape of the rule could matter as much as the rule itself. If GSA sets a baseline for safeguarding data in LLM systems, other agencies may use it as the standard they expect from vendors and subcontractors.
Agency: General Services Administration Docket ID: 2026-0331 CFR parts: 539, 552 Comment deadline: August 3, 2026 Effective date: Tuesday, July 14, 2026 Submit comments: https://www.regulations.gov Contact: Ms. Johnie McDowell • 202-718-6112 • gsarpolicy@gsa.gov