The General Services Administration is updating its acquisition regulations to establish specific data protection requirements for contractors using large language models to process government information. The changes, included in a memo signed by GSA Senior Procurement Executive Jeffrey Koses, will take effect on October 19 following industry feedback during a public comment period.
The new section titled “Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems” outlines restrictions contractors and subcontractors must follow when their LLMs handle government data. Contractors are prohibited from using government data to train LLMs, inform advertising, or sell to third parties. The rules also mandate encrypted data transmission and audit logging systems for data handling procedures.
GSA signed off on the final language in July after initially attempting to implement similar rules through a public comment process that faced industry pushback.
Several stakeholders welcomed the revised approach. Quinn Anex-Ries, a senior policy analyst at the Center for Democracy and Technology, noted in a statement that GSA’s final AI terms represent a significant improvement from earlier drafts. Anex-Ries highlighted that the rule nearly eliminated language requiring contractors to adhere to “unbiased AI principles,” which had been one of the most contentious provisions due to unclear compliance testing methods.
These include a 120-day disclosure deadline, 72-hour incident reporting requirements, deletion of embeddings and fine-tuned weights at contract closeout, 30 days’ notice and concurrent access before major model swaps, and government rights to benchmark deployed models for bias and truthfulness.
