A European vendor that sells an LLM or agent to the US federal administration through the GSA, directly or as a subcontractor to an integrator, remains eligible. The clause calls for "maximising" the use of models developed, managed and operated under US jurisdiction, without excluding others. However, it requires the vendor to give 30 days' notice of any adaptation of its model to the rules of a non-US government that substantially changes its responses. Adjustments made under the AI Act may fall within this scope. The vendor must also declare, within 30 days of award, its adaptations to the rules of a non-US "federal" government. The application of this term to EU law remains to be clarified. These obligations flow down to subcontractors that design or operate the LLM.

Clause 552.239-7001, "Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems", appears in the new Part 552 of the acquisition regulation of the General Services Administration (GSA), the purchasing agency of the US federal administration. According to Nextgov, its services were due to apply it by 19 October 2026 at the latest. It is published in memorandum RGO-2026-01, signed on 15 January 2026 by Jeffrey Koses, GSA's senior procurement executive, and supplemented during the year. As of 22 October, the online version runs to 224 pages. The GSA published the clause on 28 September 2026, according to law firm Crowell & Moring.

A deviation, pending the regulation

This is a "class deviation": the GSA is amending its regulation by deviation, as part of the overhaul of federal acquisition rules launched by Executive Order 14275, and announces that a formal rulemaking with public consultation will follow. The text applies to tenders issued from the effective date. The contracting officer decides the fate of open solicitations and contracts already awarded.

Industry had criticised an initial draft. Linked to MAS Refresh 31, it had been published on the GSA Interact platform (12 January 2026 according to the GSA, 6 March according to law firms Venable and Jenner). A revised version was then submitted for comment to the Federal Register of 17 June 2026. That initial draft excluded components manufactured, developed or controlled by non-US entities, according to Crowell & Moring. The June draft merely preferred LLMs from an entity incorporated in the United States.

No training or reuse of government data

The obligations described below appear in the June draft; Nextgov and Crowell & Moring confirm the essentials for the final version. Government data, both inputs and outputs, may not be used to train, fine-tune or improve an LLM, including those of third parties, nor to develop a model for other customers. It may not feed the vendor's advertising, marketing, monetisation or business decisions. Its resale is prohibited. The contractor has only a limited licence for contract performance, technical support and de-identified security telemetry, unless another use is authorised in writing by the contracting officer.

At contract end, unless otherwise instructed in writing, the contractor must permanently delete the data and all specific developments, including fine-tuned model weights, embeddings, indexes and caches, including backups, and report this in writing. During the contract, data may not leave the agreed premises or FedRAMP-authorised services without the contracting officer's written consent. Two 72-hour deadlines are added. One is for reporting a substantial breach of the clause, the other for notifying a security incident affecting the LLM and data, followed by a daily update until resolution.

The definition of an LLM is broad. It covers the model, but also hosting, system prompts, knowledge bases, retrieval mechanisms (RAG), APIs, guardrails and workflows. Paragraph (c) states that the clause prevails over the vendor's terms and conditions and commercial licences in the event of conflict.

US preference and foreign laws

The preference targets an entity subject to US law and beyond the reach of a foreign government. The only passage drafted as a prohibition concerns another case: no core component (model, storage, generation, security) may be developed or operated by an entity under the influence of an "adversary" foreign government, within the meaning of regulation 15 CFR 791.4. Components developed abroad, including open source, remain acceptable if they introduce no substantial security risk or foreign control.

The declaration covers the laws, regulations or policies of a "non-U.S. federal government". The advance notice also covers training changes and effects on the accuracy or truthfulness of responses, unless simultaneous access to the new model is provided. If no date is set in the contract, the inventory of LLMs used and their suppliers is due within 120 days of the start of work.

The clause cites no foreign text. It must be flowed down to subcontractors that also handle government data. Only fully open components are exempt from the paragraphs on origin and foreign laws. An open-weight model whose code and training data are not published does not qualify.

Who escapes the clause

Two exceptions render it ineffective. The first covers an LLM limited to the contractor's internal systems (management, back office, support tools), not delivered to the government or accessible by it, even if they incidentally process government data. The second concerns products whose primary purpose is not AI and where the LLM function is ancillary: not required by the contract, not used by the administration, and not processing its data. A chatbot purchased to answer users falls within scope. A management software with an assistant that the administration does not use falls outside.

The scope remains purchases made through the GSA, including on behalf of entities authorised to buy through it. It was through its catalogue of framework contracts, the Multiple Award Schedule, that Anthropic's Claude, Google's Gemini and OpenAI's ChatGPT were offered to federal agencies in August 2025. These ongoing contracts do not automatically switch to the new clause.

A 2025 principle becomes an enforceable clause

The ban on training on government data predates the clause. On 3 April 2025, Office of Management and Budget memorandum M-25-22 already required agencies to ensure their contracts permanently prohibited the use of their non-public data and outputs to train commercial AI, unless explicitly agreed. It recalled that US policy is to "maximise" the use of AI developed and produced on US soil. The GSA is turning this into a standard contract text, flowed down to relevant subcontractors.

Testing, suspension and exit costs

The administration may suspend use of the LLM at any time and test it with its own evaluation sets, on bias, truthfulness and unsolicited ideological content. The burden is likely to be mainly documentary for vendors that already hold FedRAMP authorisations, SOC 2 reports or ISO/IEC 27001 certifications, which the clause accepts as evidence. It would weigh more heavily on integrators that assemble multiple models and subcontractors, each to be traced and covered. In the event of termination for default after an unheeded cure notice, the vendor is liable for dismantling costs, capped at 25% of the order value, according to Crowell & Moring. The June draft left this percentage to be set contract by contract.

Our articles will then appear first in Google Top Stories.