GSA’s AI Clause Goes Live as Washington Moves to Buy Agents
From 19 October, new GSA contracts for chatbots and agentic systems carry clause 552.239-7001: 72-hour incident notice, no training on government data and a record of each agent's steps. The Army and OPM show why the timing matters.
From today, Washington’s central buying agency writes its rules for purchased AI into new contracts. The General Services Administration’s class-deviation memo RGO-2026-01, from Senior Procurement Executive Jeffrey A. Koses, lists 19 October 2026 as the effective date of GSAR Part 552, which holds clause 552.239-7001, “Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems”. New GSA solicitations and contracts for a chatbot, generative assistant, agentic system or LLM-enabled productivity tool that handles government data now carry it; for awarded contracts, adoption is the contracting officer’s call. AI & GPP set out its scope on 12 October. The context has shifted: federal buyers are moving from chatbots that answer to agents that act.
The clause turns AI risk into contract deadlines
Most of what bites is a clock, set out below from the clause text.
| Trigger | Vendor’s deadline | Paragraph |
|---|---|---|
| Incident affecting government data (as defined in the Federal Information Security Modernization Act of 2014) | Within 72 hours of discovery; daily updates; logs kept at least 90 days | (f)(5) |
| Material violation of the clause | 72 hours from actual knowledge | (d)(2) |
| Change that raises bias, weakens guardrails or degrades truthfulness | 7 calendar days | (i)(3) |
| New or replaced model or provider | 30 days’ notice, unless concurrent access is given | (i)(1) |
| Model retired | Reasonable efforts to give 30 days’ (major) or 15 days’ (minor) access to the successor | (i)(2) |
| Which models touch government data | Disclosed within 120 days of starting work, by default | (f)(1) |
| Contract ends | Delete data, fine-tuned weights, embeddings, indexes and caches | (e)(4)(vii) |
| Termination for cause | Decommissioning liability capped at 25 per cent of the order | (j)(3) |
The data-use limits are as blunt. Vendors may use government data to do the work, provide technical support, run de-identified security telemetry or as the contracting officer authorises in writing. Training any model on it, marketing or sales uses and selling it are prohibited. The buying government may also benchmark the deployed model at any time, including for “unsolicited ideological content”, and suspend its use.
Quinn Anex-Ries of the Center for Democracy & Technology called the final terms “a significant improvement from prior draft versions”, Nextgov/FCW reported; Jessica Tillipman of George Washington University greeted the removal of most “unbiased AI principles” language with “Hallelujah”, according to FedScoop.
The agent provisions matter more than the chatbot ones
Where a system relies on “reasoning, retrieval, or agentic steps”, the vendor must expose a summary of what it recorded, from routing choices and tool calls to retrieval sources and any human reviewer’s access, through the interface, an API and an audit trail. The clause asks only for “a summary of recorded steps, not a faithful explanation of the model’s internal reasoning.”
Who is already buying agents, and under whose terms
At the Association of the United States Army (AUSA) annual conference on 12 October, the Army’s principal cyber advisor, Brandon Pugh, said the “take action” element of Project Griffin, an autonomous response “within prescribed parameters of a human operator”, would be awarded that Friday, with contracts going to two companies, Breaking Defense reported. According to Breaking Defense, the August commercial solutions opening drew 108 submissions, cut to ten finalists. Lt Gen Christopher Eubank, head of Army Cyber Command, put the open question plainly: “Are we as humans ready to let the agent actually take action?” By 19 October the desk had found no announcement naming the winners.
Some agents are already inside. Task Force Lexington, formed in April, has moved agents out of a sandbox and into the Army’s part of the Department of Defense Information Network, with humans checking their work, DefenseScoop reported. Eubank said the command had been deliberate about its guardrails, including asking “how do we incrementally reduce the guardrails over time?”
These are Army buys. RGO-2026-01 applies to GSA’s own contracting, so, on this desk’s reading, Griffin’s terms are whatever the Army writes, not 552.239-7001.
On the civilian side, the Office of Personnel Management opened FWD Chat in public beta on 7 October. It turns plain-English questions into SQL queries on federal workforce records and shows the query behind each answer, FedScoop reported; OPM plans to link it to America.gov, the chatbot AI & GPP examined on 6 October. The FWD Chat page warns that “Responses may contain errors or vary between similar questions.” Publishing the SQL is a voluntary version of the traceability GSA now demands.
What decision-makers should do and watch
Contracting officers with open AI solicitations should decide now whether to add the clause. Vendors should test whether incident playbooks meet 72 hours and daily updates; for FedRAMP-authorised systems, reports filed under FedRAMP or to the Cybersecurity and Infrastructure Security Agency (CISA) count if they carry substantially the same information and reach the contracting officer at the same time. AI & GPP’s 12 October cover story compares other governments’ clocks.
Watch three things: the Griffin winners and their terms; whether defence buyers copy GSA’s step-trace and data-use limits; and 30 November, when changes to Part 538, which governs the Federal Supply Schedules, take effect. Formal rulemaking, with notice and comment, is still to come.
Sources
- RGO-2026-01, GSAR Class Deviations in Response to Executive Order 14275 (incl. clause 552.239-7001) — General Services Administration, memo dated 15 January 2026; Part 552 signed 16 July 2026, effective 19 October 2026; clause dated September 2026 (PDF)
- GSA memo to set AI-specific acquisition rules — Nextgov/FCW, 1 October 2026
- ‘Hallelujah’: Stakeholders react with praise and concern to GSA AI acquisitions clause — FedScoop, 6 October 2026
- Army to take a (cautious) step toward employing AI agents to defend networks: Official — Breaking Defense, 13 October 2026
- ARCYBER expanding use of AI agents for network operations — DefenseScoop, 12 October 2026
- OPM launches beta AI chatbot for federal workforce data — FedScoop, 9 October 2026
- FWD Chat – Federal Workforce Data — US Office of Personnel Management, undated (beta; data as of August 2026)
Discussion
No comments yet. Start the conversation.
