GSA’s AI Contract Clause Takes Effect October 19. Internal and Incidental AI Use Can Fall Outside It. Small Business Status Does Not.

1. What GSA Actually Finalized, and When It Bites

GSA has issued its revised AI contract clause, GSAR 552.239-7001, through a class deviation that becomes effective October 19, 2026, and contracting officers may put it into solicitations and contracts before that date. The final text sits on page 129 of the Revolutionary GSAR Overhaul memorandum RGO-2026-01, signed by GSA Senior Procurement Executive Jeffrey A. Koses, and carries the date line “Sept 2026.” The memorandum’s own Attachment A lists GSAR Part 552 as signed July 16, 2026 with an effective date of October 19, 2026.

GSA Regulation 552.239-7001 is a contract clause that governs how a contractor protects, uses, reports on and changes a large language model the Government is buying through a GSA vehicle when Government Data goes into or comes out of that model. It limits Government Data to authorized contract purposes, bars using it to train or improve models for other customers or unrelated purposes, requires incident reporting within 72 hours and 30 day notice before model changes, and lets the Government benchmark, suspend and decommission the model.

Two procedural details matter more than they look. First, this is a deviation, not a finished rule. The memorandum says formal rulemaking will follow “including a full notice and comment period,” so the text can still move. Second, the memorandum gives contracting officers discretion in both directions: they may apply GSAR changes to new solicitations before the effective date, and for open solicitations and already awarded contracts the decision to add the change is theirs. GSAR 501.107(d)(3), in the same document, says contracting officers may include GSAR changes in an existing contract “with appropriate consideration,” which points to a modification, not a unilateral rewrite.

So October 19 is the deviation’s implementation date, not a universal deadline that amends every existing GSA contract. Your obligations depend on the clause actually being incorporated into the contract, BPA or order in front of you, together with any applicability language the contracting officer adds. Crowell and Moring’s October 2, 2026 alert dates the issuance to September 28, 2026 and reads the clause the same way. GSA updates the RGO PDF in place as further parts take effect, so the dates and page numbers cited here reflect the version retrieved on October 8, 2026.

The final text follows at least two public drafts. GSA circulated earlier versions in early 2026, which our guide to the 2026 federal AI procurement rules covered, and pulled them back after industry pushback. GSA then published a revised draft in the Federal Register on June 17, 2026, held a listening session on July 14 and took written comments through August 3. The final text answers most of what commenters asked for and keeps most of what agencies wanted.

Who should care is decided by use, not size. In its August 2024 Federal Register rule on price adjustments, GSA estimated roughly 14,000 Schedule contractors in fiscal year 2023, over 12,000 of them, or 85 percent, small businesses. Those are fiscal year 2023 estimates, and they say nothing about how many firms the clause will reach. The clause contains no small business exemption; it reaches whoever sells, integrates or operates an AI product the Government actually uses, whatever their size.

2. Does the Clause Apply to Your Contract? The Two Part Test

The clause applies only when both of two conditions are true: the Government is procuring an LLM based product where LLM functionality is a material feature, and Government Data will be submitted directly to or produced by that LLM. Paragraph (a)(1)(i) names the product types: an LLM, generative assistant, chatbot, agentic system, LLM enabled document or productivity tool, “or similar system.” The matching prescription at GSAR 539.71 tells contracting officers to insert the clause only in that situation, including in commercial product and commercial service buys.

The first prong is about what the Government is buying, not about what is in your technology stack. A cybersecurity firm that uses a commercial chatbot to draft its own reports is not selling an LLM. A small reseller that delivers 500 seats of an AI writing assistant to an agency is. The phrase “material feature” is not defined in the clause, and that gap is where most real applicability arguments will happen.

The second prong is about the data path. “Government Data” means Data Inputs plus Data Outputs. Data Inputs are anything submitted to the LLM “by, or on behalf of,” the Government, including prompts, system prompts, documents, knowledge bases, government email addresses and user account information. Data Outputs are what the model generates in response, including derivative, anonymized and synthetic data. If no Government Data enters or leaves the model, the clause has nothing to attach to.

The definition of “LLM” is wider than the model itself. It covers the whole information system the model runs in: hosting, system prompts, configurations, knowledge bases, retrieval mechanisms, APIs, user interfaces, guardrails and monitoring. A retrieval augmented chatbot you built on a frontier API is one LLM for clause purposes, not just the API call. If you integrate or host, you own a piece of that system even if you never trained a model.

Also note who counts as “the Government.” The clause defines it as any entity authorized to obtain procurement services through GSA under 40 U.S.C. 501 and 502. An order another federal agency places against your Schedule contract can carry the clause just as a GSA order can.

3. The Two Self Deleting Exceptions, and Where Small Firms Usually Land

Unless the contracting officer says otherwise, the clause “is self deleting and imposes no obligation” in two situations: when LLM use is limited to the contractor’s internal business, back office, operational or performance support systems that are not delivered to or accessed by the Government, and when LLM functionality is incidental or ancillary to a commercial product whose primary purpose is not AI. Both exceptions sit in paragraph (a)(1)(ii) and are repeated in the prescription at GSAR 539.71(b).

The internal use exception is the one most small services firms need. It applies “even if they incidentally process Government Data.” A program management firm whose analysts use an enterprise AI assistant to summarize meeting notes, inside the firm’s own tenant and never delivered to the agency, is likely the intended exclusion, subject to the solicitation and any contracting officer applicability language. That does not make the practice risk free. Your other contract clauses, controlled unclassified information rules and agency AI policies still apply, as we explained for defense work in our piece on CMMC, AI tools and CUI.

The incidental exception has four conditions packed into one sentence. On the plain text, the product’s primary purpose must not be AI, and the LLM functionality must not be required in the solicitation or contract, accessed by the Government, or used to process Government Data. The wording supports reading those as cumulative. Separately, Crowell notes the two self deleting conditions are not joined by “and” or “or,” leaving it uncertain whether either one independently suffices. Document your interpretation and seek written contracting officer clarification where the result matters. If an agency turns on the AI feature in a product you sold, the incidental argument gets much weaker.

The words “unless otherwise identified by the contracting officer” are the escape hatch for the Government. A contracting officer can keep the clause in force even where an exception would otherwise apply. Read the order, not just the base contract. And remember that your own applicability memo is evidence of your analysis, not a binding Government determination.

The table reflects our reading of the clause text. The sources reviewed for this article did not identify public GSA applicability examples or any decision testing the material feature line as of October 8, 2026. Treat each row as a starting position for a written determination, not an answer.

4. What Changed Between the June Draft and the Final Clause

The issued clause is narrower in scope, lighter on ideology and more protective of contractor intellectual property than the June 17 draft, but it keeps nearly every operational deadline. Comparing the Federal Register draft with the RGO-2026-01 text line by line, the biggest movement is at the front door: the June draft applied whenever Government Data “will be processed by” an LLM, with exceptions only for AI embedded in a common commercial product and incidental functionality. The final version adds the material feature test and the internal use exception.

Two definitional changes help contractors more than the headline items. “Data Outputs” now expressly excludes technical system data with no Government Data or “Government Usage Context,” such as performance metrics, token counts, processing times, metadata and logs. And a new paragraph (e)(1)(ii) states that nothing in the contract transfers ownership of the contractor’s pre existing commercial products, models, scripts, workflows or know how to the Government. Paragraph (e)(1)(v) adds that the assignment of rights in improvements does not reach general capability gains that do not incorporate, derive from, reveal or disclose Government Data. Not every improvement made during performance becomes Government property.

One new concept cuts the other way. “Government Usage Context” is information that exists because the Government used the LLM and either reveals how the Government works or supports a material inference about its nonpublic activities, priorities or methods. Aggregated usage analytics that show which agency office is asking about which topic can fall inside it. Product teams that mine usage patterns across all customers need to wall off federal tenants.

Stakeholders noticed the shift. Jessica Tillipman of George Washington University told FedScoop on October 6 that removing the principles list reflected how unworkable that requirement was, while the Center for Democracy and Technology called the final terms a significant improvement that still leaves room for broad interpretation.

5. The Reporting, Disclosure and Model Change Deadlines

A covered contractor must be able to meet eight timed obligations, and the shortest is 72 hours. Kevin Martin of Government Acquisitions Inc wrote that the remaining workload is still substantial, as quoted by Government Executive on October 2, and the clause text bears that out. These clocks run from events most small firms do not currently track, such as a model provider’s deprecation notice.

The 72 hours is an outer limit, not a waiting period: the clause says “as soon as possible but not longer than within 72 hours,” and daily status updates go to all points of contact until the incident is resolved. The 120 day disclosure window is likewise not a grace period for data safeguarding, incident reporting or any other obligation that applies from the first day of performance.

The incident clock is also the one with the most built in relief. For FedRAMP authorized systems, reports already filed under FedRAMP, CISA or other federal cybersecurity requirements satisfy the overlapping obligation if they contain substantially the same information and go concurrently to the contracting officer and any Government security contact. The initial notice must cover, to the extent known, the nature and scope, data affected, immediate remediation, resolution timeline and recurrence prevention. The clause also tells you to complete the CISA incident reporting form.

The model change clocks are the ones small resellers are least ready for. Paragraph (i)(1)(iv) states that advance notice “is not required for model changes where concurrent access is provided as outlined in (i)(2),” and (i)(2) asks for reasonable efforts to give the Government concurrent access to a successor model for at least 30 calendar days on a major version and 15 on a minor one. That waiver covers model changes only; reduced data controls, a change in FedRAMP status or a new provider still need 30 days’ notice. When the deprecation is forced by a commercial provider you do not control, you instead have five business days from that provider’s notice to tell the contracting officer. If your product runs on a frontier API, that provider’s deprecation emails are now a contract event, a dependency we traced from the EU side in our analysis of what flows down to products built on frontier APIs.

Every notice under paragraph (i) must describe the change, affected roles, systems and data, trade offs, the evaluation approach used, rollback options, and a confirmation that the clause has been flowed down. That last item turns every model swap into a flowdown check.

6. What You Can and Cannot Do With Government Data

A covered contractor may use Government Data only to perform the contract, provide required support and maintenance, run de identified security telemetry, and do whatever else the contracting officer authorizes in writing; other uses are prohibited. The license in paragraph (e)(1)(iv) is limited, revocable and lasts only for the life of each award. The Government keeps ownership of all Government Data and all Custom Developments, including fine tuned versions of a model built for it.

Paragraph (e)(3) gives five examples of prohibited use. You may not use Government Data to train, fine tune or improve any LLM, including third party models, for other customers or for commercial or noncommercial purposes outside the contract. Government specific training or fine tuning is a different case: the clause treats models modified “as a result of model training or fine tuning” for the Government as Custom Development, so assess that work against the contract’s authorized scope and any written contracting officer approval. You may not use it to inform advertising, marketing, sales or business strategy. You may not retain it beyond the contract’s scope, pass it to an unauthorized party, or sell or license it to anyone. This is consistent with the approach to Government Data in OMB Memorandum M-25-22, which we covered in our procurement rules guide.

The handling rules in paragraph (e)(4) replace the June draft’s eyes off language with Data Handling Procedures. Access to Government Data is restricted to personnel the contracting officer authorizes, through automated processing, technical access controls, encryption that renders the data unreadable, and audit logs that track processing without capturing the data itself. Human access is allowed only on a specific purpose, time bound basis, must be logged, and must be provided to the Government on request.

The clause states that zero persistence architectures, which do not retain Government Data, satisfy those minimum measures. That is a meaningful design choice for a small integrator. A stateless architecture that does not store prompts or outputs removes much of the retention, segregation and deletion burden in a single decision.

Data localization is stricter than many commercial terms. Without the contracting officer’s written consent, Government Data may not leave the agreed premises or FedRAMP authorized services. Government Data must be logically segregated from other customers’ data, though the clause says continuing compliance with the specified FedRAMP authorization level is deemed to satisfy that requirement.

Closeout is where the hidden cost sits. At completion, termination or expiration, and unless the contracting officer directs otherwise in writing, paragraph (e)(4)(vii) requires secure and permanent deletion of all Government Data and Custom Developments, expressly including fine tuned model weights, embeddings, indexes and caches, across all systems, copies, backups and derivatives, documented in writing to the contracting officer. Do not delete Government owned custom work early if the Government expects delivery, transfer or continued operation, and check any legal retention duties first. If you cannot find every vector store your product created for the agency, you cannot document that deletion.

7. When You Are the Subcontractor: How Flowdown Now Works

A subcontractor receives the applicable requirements of the clause, mapped to its tasks and data handling rather than every paragraph, when it performs AI Design, AI Development, AI Deployment, or Operation and Monitoring tasks, as described in Appendix A of the NIST AI Risk Management Framework 1.0, for an LLM that processes Government Data, and only to the extent it collects, processes, stores, retains, trains on, fine tunes on or otherwise handles that data. This replaces the June draft’s four defined roles and their separate supplemental clauses with task categories most practitioners already know.

“Subcontractor” is defined broadly as any supplier, distributor, vendor or firm that furnishes supplies or services to the prime or another subcontractor and processes, transmits or handles Government Data. The clause uses “Contractor” to mean whichever entity sits in the applicable role for flowdown purposes. A two person firm that hosts a retrieval layer for a larger prime is squarely in the Operation and Monitoring bucket.

Crowell’s alert flags a drafting loose end. Paragraph (e)(1)(iii) still says only LLM Developers, System Operators, System Integrators and Service Providers may receive and process Government Data, and paragraph (i) still refers to those roles, but the final clause no longer defines them or includes the companion clauses that did. Until GSA cleans that up, map your role to both vocabularies in your subcontract.

The prime’s duty toward you is “best efforts” due diligence in selecting and overseeing subcontractors that perform those tasks. Paragraph (d)(3) lists how a prime can show it: flowdown of the applicable requirements, an attestation from an authorized individual that the requirements are implemented, supported where practicable by independently verifiable evidence rather than attestation alone, or existing artifacts.

That list of acceptable artifacts is the most useful sentence in the clause for a small firm. It names model cards, system cards, FedRAMP authorization packages, SOC 2 reports, ISO/IEC 27001 certifications or audit materials, and “substantially equivalent security, risk management, or assurance documentation,” and it says you need not create duplicative documentation. ISO/IEC 42001 is not named. ISO/IEC 42001 documentation may contribute evidence about AI governance, supplier oversight and risk management, but it does not establish compliance with the clause’s specific data security, notification, localization or deletion requirements, and a certificate helps only if its scope covers the Government deployment.

Open models get their own lane. Requirements about origin, ownership, jurisdiction or foreign control need not flow down to an “Open LLM Component” or a “Fully Open Model,” which the clause defines as one with public architecture, weights, code and training data. For open components, identifying the published information satisfies due diligence without a per contract attestation. For purposes of this clause, the defined “Open Weight Model” category, with public weights but not code and data, is treated separately from the more fully open categories; for it you document best effort diligence commensurate with its role. The open model carve out covers only the origin, ownership, jurisdiction and foreign control provisions, not the data safeguards.

8. What Is Left of the Unbiased AI Requirement

The issued clause drops the June draft’s itemized Unbiased AI Principles and replaces them with a single duty to use reasonable efforts to design, train and configure the LLM to prioritize accuracy, scientific inquiry and objectivity on factual prompts and to acknowledge uncertainty where reliable information is incomplete or contradictory. Where the contractor curates or supplies the Background Data the model draws on, the same reasonable efforts standard applies to that data.

The policy underneath has not gone away. OMB Memorandum M-26-04, issued December 11, 2025 to implement Executive Order 14319, requires every agency solicitation or order for an LLM to include contract terms addressing the two principles of truth seeking and ideological neutrality. It required agencies to update procurement policies by March 11, 2026 and sunsets two years after issuance unless OMB extends it.

Several remnants survive inside the issued GSA text. Paragraph (f)(7) still lets the Government request testing methodologies used to detect noncompliance with the “unbiased AI principles described in paragraph (j)(1),” even though (j)(1) now holds the accuracy duty. Paragraph (j)(2) reserves the Government’s right to run automated assessments of the deployed model “at any time” for bias, truthfulness, safety, “unsolicited ideological content” and other factors it chooses.

The Electronic Frontier Foundation told FedScoop it is unclear what unsolicited ideological content means. For a reseller, the practical answer is to get the model developer’s acceptable use policy, model or system card, end user resources and feedback channel into your file now. M-26-04 already requires agencies to request exactly those four items in LLM solicitations, so you will be asked for them either way.

The Government’s benchmarks, test data and methods are themselves Government Data, and it need not disclose them except for data or methods used as the basis for an adverse action under (j)(3). Where it does act, (j)(3)(ii)(C) requires it to disclose enough, under confidentiality protections, for you to understand the basis and remediate. Plan for the possibility that you learn the details of a test only at that stage.

9. Order of Precedence, Suspension and the 25 Percent Cap

The clause overrides your commercial terms: for order of precedence purposes it is incorporated into the “schedule of supplies/services,” and where it conflicts with your policies, license agreements, terms of service, click wrap or browse wrap terms, the clause wins. The final text adds that it supplements rather than replaces FAR 52.212-4 or GSAR 552.212-4 and does not override applicable law, regulations or mandatory clauses. Crowell expects industry concern over the override to persist.

That matters most when you resell someone else’s AI product. Your upstream provider’s standard terms may allow training on customer data unless the customer opts out, retain prompts for 30 days for abuse monitoring, or change models without notice. Under this clause, you have promised the Government terms your supplier may not have promised you. Close that gap in your supplier agreement before you accept the order.

The remedies section is short and sharp. The Government may suspend use of the LLM “at any time,” without the June draft’s qualifier. That is a suspension of the model’s use, not suspension or debarment of your company, a termination or a formal stop work order, which are separate actions. If the contracting officer terminates for cause after you fail to remediate following specific written notice of noncompliance, you owe reasonable decommissioning costs, which exclude reprocurement and replacement system development and cannot exceed 25 percent of the value of the affected task or delivery order.

Put numbers on that. On a $400,000 task order, the decommissioning exposure is capped at $100,000. For a small reseller whose margin on that order might be a fraction of the cap, a single uncured noncompliance notice can erase the order’s profit. The 25 percent limit applies only to this decommissioning cost remedy; it is not a cap on all contract liability or on the Government’s other remedies.

Watch the Schedule mechanics. RGO-2026-01’s instructions for Part 538 say new Schedule solicitations are updated through a solicitation refresh and existing Schedule contracts follow standard refresh and mass modification protocols. The sources reviewed for this article did not identify a published MAS refresh notice incorporating 552.239-7001 as of October 8, 2026, so the first place many small firms will meet this clause is likely a task order or BPA that a contracting officer chooses to include it in.

10. An 11 Day Plan Before October 19, and a 120 Day Plan After

The right first move for a small contractor is a documented applicability analysis for every GSA contract, BPA and open order, ideally before October 19, 2026 and in any case before accepting covered work or a modification. That is our recommendation, not a legal requirement, and where the answer matters you should get contracting officer clarification in writing. Deltek’s Clarity study of more than 900 government contractors found as many as 90 percent of firms now use AI in some capacity, so “we do not use AI” is not a credible starting assumption for most firms. The question is which uses are delivered to or accessed by the Government.

Before October 19. List every GSA vehicle and order. For each, record whether the Government is buying an LLM based product as a material feature, and whether Government Data goes into or comes out of it. Where you rely on an exception, write down which one and why, in two or three sentences, and keep it with the contract file. Check whether the clause has actually been incorporated, and review any modification adding it before you sign. Flag any order where an agency has turned on an AI feature in a product you sold.

For covered or likely covered work, identify every party that performs design, development, deployment, or operation and monitoring tasks, and pull their existing artifacts: SOC 2 report, FedRAMP status, ISO/IEC 27001 certificate, model or system card, and acceptable use policy. Compare each upstream provider’s terms against the training, retention, localization and change notice rules. Anything that conflicts goes on a supplier negotiation list.

From day one of a covered award. Complete the paragraph (f)(3) disclosure on whether the model has been modified at a non U.S. government’s request or to comply with foreign law. That requires a written inquiry to your model provider, so send it on day one. Set up your incident path so a FISMA incident affecting the LLM reaches the contracting officer within 72 hours, and decide whether your FedRAMP or CISA reporting can do double duty.

Within 120 days of starting work. Deliver the LLM disclosure, relying on current existing artifacts where they contain what the clause asks for. Build the data map that closeout deletion will depend on: every place Government Data, embeddings, indexes, caches and fine tuned weights live, including backups. Subscribe whoever owns vendor management to your model providers’ deprecation notices, because the five business day clock starts with their email.

If you want a single framework to hang this on, the clause already points to one. The NIST AI RMF supplies the task vocabulary for flowdown and the documentation standard for paragraph (f)(7), and ISO/IEC 42001 gives a small firm a certifiable management system that produces much of the attestation, change control and supplier oversight evidence this clause keeps asking for, alongside the specific security and deletion controls it does not replace. That is the difference between answering a contracting officer in a day and answering in a month.

This article is provided for general informational purposes and reflects the state of the law as of October 2026. It is not legal advice. Regulations in this area are changing quickly. Confirm current requirements and consult qualified counsel before making decisions for your organization.