GSA Enacts New Class Deviation for Artificial Intelligence Procurement

The General Services Administration (GSA) has enacted GSAR 552.239-7001, a new class deviation targeting fundamental data security in large language model artificial intelligence systems. The process underwent a three-stage evolution based on industry feedback and listening sessions following the initial draft published in March, approximately six months ago.

The new regulation implemented by the General Services Administration (GSA) is based on the protection of data in large language model artificial intelligence systems. The background of the application dates back about six months to March. The initial version published by the GSA had raised questions in the industry because it was quite comprehensive, granted the government rights over the places and processes where artificial intelligence is developed and used, and included neutrality requirements that were difficult to prove.

Following criticisms and listening sessions attended by the industry, the GSA revised the text to prepare a second version and subsequently a third version that entered into force. Taking effect as of October 19, this rule will not be seen immediately in direct contracts; it will be a part of the multiple-award schedule refresh (refresh 34). Following this stage, companies have a 30-day period and then a three-month implementation period. Additionally, since it is a deviation, the rule will go through a rulemaking process where stakeholders can offer reinterpretation and contributions.