General Services Acquisition Regulation; Acquisition of Information and Communication Technology; Notice of Listening Sessions and Request for Comments
The General Services Administration (GSA) is seeking public comment on the draft of a new General Services Administration Acquisition Regulation (GSAR) clause regarding basic safeguarding of data within Large Language Model Artificial Intelligence Systems (LLMs). Due to the complexity of the issue, GSA is publishing this notification and draft clause to gather feedback from stakeholders before taking future action (e.g., deviation and/or formal rulemaking).
What this rule actually says
The GSA (the federal agency that buys stuff for the government) is drafting new requirements for AI systems that handle government data. The rule would require "basic safeguarding" of data in Large Language Models—think: encryption, access controls, audit logs. Right now it's still a draft; they're asking for feedback before finalizing anything.
Who it applies to
- If you sell to the U.S. federal government (directly or as a subcontractor): this will likely apply to you. State and local governments: probably not covered yet.
- If your AI system processes government employee or citizen data: yes, this matters. Medical scribes in VA hospitals, hiring tools used by federal agencies, support chatbots on .gov sites all count.
- If you're a fully private company (no government contracts): this doesn't apply to you right now, but monitor it—similar rules will probably spread.
- If you're pre-revenue or only pitch to startups/private companies: you can safely ignore this for now.
What founders need to do
- Check your sales roadmap (30 minutes). Do you currently sell to any federal agency, or is that a target? If no and not planned, stop here. If yes or maybe, continue.
- Audit your current data practices (2-3 days). Document how you store LLM training data and user inputs. Do you already have encryption, access logs, and data retention policies? Most mature startups do. If you're still shipping a MVP, note the gaps but don't panic yet—the rule isn't final.
- Monitor the rulemaking process (ongoing, ~5 minutes/month). The GSA is holding listening sessions and accepting public comments through late 2026. Follow Federal Register updates or subscribe to alerts. The final rule could be much softer, much stricter, or never happen.
- Plan for compliance if the rule finalizes (1-2 weeks of eng work, once finalized). If this becomes law, you'll need to document data safeguards and possibly pass government audits. Budget for this in 2027 if you're serious about federal sales.
- Consider commenting if you have specific concerns (4-6 hours). If this rule would break your business model or if you have relevant expertise, the GSA wants to hear from you before they finalize it.
Bottom line
Monitor, don't panic: this is still a draft and only matters if you sell to the U.S. government or plan to—but if you do, start thinking about data safeguards now because they're coming in some form.