GSA proposes LLM data safeguards for federal contractors

1. Alert card: the event, publication date, docket signal, and comment deadline.
2. Rule breakdown: the clause applies when LLMs process Government Data, with exceptions for common commercial products and incidental LLM functionality. 1
3. Impact map: the draft would push requirements down the LLM supply chain to developers, system operators, system integrators, and service providers. 1

• Government Data includes inputs and outputs such as prompts, queries, responses, analyses, logs, synthetic data, and derivative data. 1
• Contractors would be barred from using Government Data to train or improve LLMs, support advertising or sales decisions, sell or license the data, or process it through unauthorized parties. 1
• The draft requires disclosure of LLMs and entities filling covered roles, with disclosure due within 120 days after work begins if no contract date is specified. 1
• Known non-adherence and security incidents affecting government data carry a 72-hour notification requirement; planned material changes require 30 days' written notice. 1
• Status check: this is a proposed rule and request for comments, not a final binding clause yet. GSA says the draft is meant to gather feedback before future action such as a deviation or formal rulemaking. 1