Seventy-two hours to report an AI incident

AI vendors whose US General Services Administration (GSA) contracts carry a new clause, GSAR 552.239-7001, must report security incidents within 72 hours. The clause took effect on Monday 19 October. It sets data, reporting and model-change terms for large language models (LLMs), the systems behind chatbots and AI assistants.

GSA, the federal government's main buying agency, issued the clause as a class deviation, a change that applies to its contracting staff before formal rulemaking. The clause text, titled "Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems", is part of the agency's rewritten acquisition rules posted on acquisition.gov. The 19 October start date was reported by FedScoop and the law firm Wiley Rein. Contracting officers may add it to existing contracts at their discretion, FedScoop said.

It applies when the government buys an LLM, "generative assistant, chatbot, agentic system, LLM-enabled document or productivity tool, or similar system" where LLM functionality is a material feature and government data goes into or comes out of the model, the text says. It does not apply to a contractor's internal tools that are not delivered to or accessed by the government, or where AI is incidental to a product bought for another purpose.

The clause sets several separate clocks. A vendor must notify the contracting officer within 72 hours of discovering a security incident that may affect government data, then send daily updates until it is resolved, and separately within 72 hours of learning of a material violation of the clause. It needs 30 calendar days' written notice before adding, replacing or materially changing a model or provider, unless it lets the government use the old and new models side by side. That overlap must last at least 30 days for a major version and 15 for a minor one. If an outside model provider retires a version, the vendor has five business days to tell the government. A change that materially increases output bias, weakens safety guardrails or degrades truthfulness must be reported within seven calendar days. Incident logs and forensic material must be kept for at least 90 days.

Government data may not be used to train, fine-tune or otherwise improve any LLM, including third-party models, or to inform a vendor's marketing, sales or business decisions. At the end of a contract the vendor must permanently delete government data and any custom work, "including fine-tuned model weights, embeddings, indexes, and caches", unless the contracting officer directs otherwise in writing. LLM services must let the government export its data in open or standard formats.

The clause also overrides vendors' own paperwork. Where it conflicts with a company's "terms of service, click-wrap, browse-wrap, or other commercial agreements", the clause takes precedence, though it does not replace the standard commercial-items clause. The government may run its own automated tests of a deployed model at any time, for bias, truthfulness, safety and "unsolicited ideological content", and "retains the right to suspend use of the LLM at any time". If a contract is ended for cause after a vendor fails to fix a problem it was warned about in writing, the vendor pays reasonable decommissioning costs, capped at 25 per cent of the affected task or delivery order.

The final text is softer than the drafts that industry fought over this summer. At a July listening session reported by FedScoop, Menaka Kalaskar, who leads Palantir's US government legal and contracting team, said GSA "seems to be taking a lot of risk with this initiative, and it's not obvious why", and called the material-change notice "unworkable" for software-as-a-service companies. GSA received over 75 comments, FedScoop reported. The earlier "unbiased AI principles" language was largely dropped in favour of a duty to use "reasonable efforts" to prioritise accuracy and acknowledge uncertainty. Nvidia's chief external affairs officer, Bruce Andrews, had argued that "obligations should follow the data, not the model's authorship"; the final clause exempts fully open models, which publish their architecture, weights, code and data, from its foreign-control flowdowns. Models that publish only their weights do not qualify.

GSA plans to add the clause to its Multiple Award Schedule, the catalogue of pre-approved vendors, in Refresh 34, which Wiley put at 6 November, with a GSA webinar on 26 October. It also arrives as the agency moves to paid AI deals: on 10 September GSA announced a 27-month, consumption-based OneGov offer for OpenAI's ChatGPT models from 1 October, at a 50 per cent discount on token-based use, the first agreement in the next phase of its OneGov AI strategy. Komposite covered an earlier draft of the clause in September, and the private-sector version of these fights in enterprise buyers' AI contract terms.