GSA's New AI Rules Test Taxpayer Protections

The General Services Administration’s latest artificial intelligence acquisition requirements took effect Monday, October 19, giving contracting officers the power to write new safeguards into federal purchases. The clause, GSAR 552.239-7001, covers “basic safeguarding of data within large language model artificial intelligence systems.” It’s the government’s attempt to decide, in writing, what happens to public data when private AI tools become part of federal work.

The path to this point wasn’t smooth. Emily Murphy, a Senior Fellow at the George Mason University Baroni Center for Government Contracting and a former GSA administrator, said the first version of the clause came out in March, about seven months ago. She described it as broad. It gave the government extensive rights, set requirements on where AI was developed and used, assigned the government ownership of processes involving AI, and required AI to be neutral. After receiving comments, GSA pulled that version. A second version followed a few months later, then more comments and an industry listening session before the third version emerged.

Who Bears the Risk

Murphy framed the core tension plainly. “They’ve got a tough challenge because they’ve got an administration that has overall said, we don’t want to regulate superintelligence,” she said. The government, she argued, is now an AI user, and it has to protect taxpayer interests, ensure data is used appropriately and avoid creating vulnerabilities. That job falls to public officials, not the market.

The newest clause is more closely tied to NIST standards and oriented toward objective measures. It includes a 25% cap on a contractor’s extraction liability if the contractor must remove AI from a system following termination for default. Murphy said it addresses bringing AI into government systems and taking it out, neutrality, and differences between open-source and open-weight models. Questions remain, though. She said it’s unclear how the clause will connect with commercial licensing provisions at the Department of War, or how requirements could differ among the Department of War, GSA and Department of Homeland Security.

The Coverage Gap

The scope of the rule is where the ambiguity gets practical. The clause applies when a large language model is a material feature of a purchased product or service. Earlier versions exempted productivity tools, but the new language could reach spreadsheets with built-in AI or Zoom’s AI noise suppression if those uses count as material. Back-office administrative functions don’t count, though Murphy said the boundary remains ambiguous and contractors should document how they use large language models.

Murphy raised concerns about the clause overriding end-user licensing agreements for commercial software. She also flagged how contractors might flow requirements down to suppliers when the AI model may not be a subcontractor on a particular government contract, and the contractor may lack leverage to negotiate. Smaller vendors, in other words, could absorb obligations they have little power to shape. Murphy said judgments about material use could depend on contracting-officer discretion or negotiations between agencies and contractors, which makes uniform implementation unlikely at the outset.

Army Cyber Command Builds an Agentic Team

While GSA writes its procurement rules, Army Cyber Command is moving quickly on its own AI work. The command launched Task Force Lexington earlier in 2026 to develop AI agents for cyber functions. It first created four AI-agent work roles, then expanded them. Lt. Gen. Christopher Eubank, who leads the command, said the task force had built an entire agentic cyber protection team. “Since August, the biggest thing we have done is complete the cyber protection team,” Eubank told reporters at the Association of the U.S. Army’s annual conference in Washington. Roles include analytic support officers, data engineers, network analysts and host analysts.

Eubank insisted the agents are tightly constrained. “We are treating each one of these agents just like a human operator, so they are basic. And with that mindset, they are only allowed to do so much. It is a really tight framework,” he said. He added that humans check the agents’ work every day, and that the approach has been, “some would say, maybe a little bit too prescriptive.” The Army is also set to award contracts to two companies for Project Griffin, a pilot program to develop agents that can respond autonomously to cyberattacks. Brandon Pugh, the Army’s principal cyber advisor, said the effort would pursue an autonomous response “within prescribed parameters of a human operator.”

That’s a reassuring phrase. But it carries weight only if those parameters are public, enforceable and reviewed by people outside the programs themselves.

Why This Matters:

The rules governing AI in federal purchasing and the Army’s autonomous cyber work are being written in real time, and the people most exposed to errors have the least say. Taxpayers pay for these systems and depend on them to keep data secure. Smaller contractors may be asked to accept terms they can’t negotiate. Murphy’s own account shows how much revision has already happened, with two versions withdrawn or superseded after industry and public comment. That feedback loop is what democratic oversight looks like in practice, and it should continue past the current clause. Whether the government’s guardrails hold will depend on transparency, outside review and a willingness to keep tightening rules as the technology moves faster than the paperwork.