GSA sets AI-specific acquisition rules to protect government data

The General Services Administration added a section on safeguarding government data processed in large language models to its acquisition regulation. Contractors are barred from training LLMs on government data, using it for advertising or selling it to third parties, and must encrypt transmissions and keep audit logs; the rule takes effect Oct. 19.

• Contractors cannot train LLMs on government data, use it for ads or sell it
• Encrypted data transmission and audit logging systems are required
• Rule excludes internal contractor LLMs and incidental AI functionality
• Deadlines: 120-day disclosure, 72-hour incident reporting, weight deletion at closeout