GSAR 552.239-7001: The Clause That Will Govern Federal LLM Buying

On June 17, 2026, GSA published a proposed rule (91 FR 36559, amending 48 CFR Parts 539 and 552) introducing GSAR clause 552.239-7001, Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems. Public comments closed August 3, 2026 with 77 comments received; the final rule is pending. For anyone selling an LLM-touching product or service into GSA vehicles, this is the compliance architecture to plan against now.

What the clause requires

A training ban. The prohibited-use paragraph bars using government data for “training, fine-tuning, or otherwise improving an LLM, including those operated by third parties, or to develop or improve the LLM(s) for any other customers or any commercial or non-commercial purposes.” This hardens the consent-based prohibition M-25-22 already requires in contracts into standing regulatory text.

Automated “eyes-off” data handling. Contractors must implement automated technical controls that restrict human access to government data: automated processing without human content review, transmission encrypted and unreadable to humans, access controls preventing personnel from viewing the data, and audit logs that do not themselves capture the data.

Incident discipline. Notify the contracting officer within 72 hours of known non-adherence to the clause, and within 72 hours of discovering any FISMA-defined incident, preserving “all relevant logs, forensic images, and incident artifacts” for at least 90 calendar days.

Disclosure obligations. Within 30 days of award, disclose whether the LLM has been modified or configured to comply with any non-U.S. government requirements. Disclose general model characteristics, intended use, limitations, risk considerations, known biases, and performance metrics. Notably, the clause exempts proprietary source code, model weights, and trade secrets. It demands characterization, not the crown jewels.

Four flow-down sub-clauses. The rule defines role-specific obligations for Developers, Operators, Integrators, and Service Providers (552.239-7001-1 through -4), flowing requirements down the supply chain regardless of prime or subcontractor status.

Why it matters

The clause’s structure is a regulatory admission that governing one model under one contract is insufficient. Four role-differentiated flow-downs exist because the LLM supply chain is composed of parties who never signed the prime contract, which is Governance Must Span Systems expressed as acquisition regulation. The foreign-configuration disclosure exists because trust properties do not survive handoffs between jurisdictions. See Trust Does Not Travel, in a contracting officer’s language.

Note what the clause does not reach: it governs data within LLM systems, and says nothing about agent authority, meaning what an autonomous system may do with tools and permissions once it has the data. Data safeguarding and behavior governance are different control planes. Programs that treat 552.239-7001 compliance as agent governance will have solved the smaller half of the problem.