GSA AI Rules Take Effect; Army Builds AI Cyber Agents

The General Services Administration’s new rules for buying artificial intelligence took effect Monday, October 19. The message is clear: the government wants more control over what it buys, and contractors will handle the paperwork. The class deviation, designated GSAR 552.239-7001, covers “basic safeguarding of data within large language model artificial intelligence systems.” Contracting officers can add it to deals now. It will appear in the next multiple-award schedule refresh, refresh 34; contractors then have 30 days to comply, with implementation expected about three months later.

A Clause That Took Three Tries

The rule took shape over time. Emily Murphy, a senior fellow at the George Mason University Baroni Center for Government Contracting and a former GSA administrator, said the first version came out in March, roughly seven months ago. She called it broad. It gave the government sweeping rights, dictated where AI could be developed and used, assigned the government ownership of AI-related processes, and required AI to be neutral. Industry pushed back. GSA withdrew that draft, issued a second a few months later, gathered more comments, held an industry listening session, and then produced the version now in force.

Murphy said the agency faces a real bind. “They’ve got a tough challenge because they’ve got an administration that has overall said, we don’t want to regulate superintelligence,” she said. Yet the government is a major AI user. It has to protect taxpayer interests, ensure proper data handling, and avoid building vulnerabilities into its own systems. Murphy said the latest clause tracks NIST standards more closely and favors objective measures. It also caps a contractor’s extraction liability at 25% if the contractor must remove AI from a system after a termination for default.

Where the Lines Get Blurry

Contractors should look hardest at what counts. The clause applies when a large language model is a material feature of a product or service. Earlier drafts exempted productivity tools, but the new version could cover spreadsheets with built-in AI or Zoom’s AI noise suppression, depending on how material those features are. Back-office administrative functions sit outside the rule. Murphy acknowledged that the boundary remains ambiguous and advised contractors to document exactly how they use large language models.

Vendors do get some protections. The clause strengthens intellectual-property protections, streamlines reporting, and requires companies to report any LLM issue within 72 hours, folding in existing FedRAMP and CISA reporting. Murphy also flagged concerns. She questioned whether the clause overrides end-user licensing agreements for commercial software. She also asked how a prime contractor could pass requirements down to suppliers when the AI model may not be a subcontractor on the deal and the prime may have little leverage at the negotiating table.

Enforcement won’t be uniform at first. Murphy said judgments about material use could depend on contracting-officer discretion or negotiations between agencies and contractors. She cited changes between deviations and proposed rules from the Federal Acquisition Regulation Council as evidence that officials are absorbing feedback, though implementation will take time.

The Army Puts AI on Defense

As civilian buyers sort out their rules, Army Cyber Command is moving quickly in another direction. The command launched Task Force Lexington earlier in 2026 to develop AI agents for cyber operations, and it has built four AI-agent work roles, which it has since expanded. Lt. Gen. Christopher Eubank, who leads the command, told reporters at the Association of the U.S. Army’s annual conference in Washington that the task force had assembled an entire agentic cyber protection team. “Since August, the biggest thing we have done is complete the cyber protection team,” he said. The roles include analytic support officers, data engineers, network analysts and host analysts.

The Army trained the agents, ran them in a sandbox, retrained them, and then let them work on the Army’s portion of the Defense Information Network to learn how to spot compromises. Eubank said the team has gone to the joint force. “What we’ve built, we have given to Lt. Gen. Stanton at the Department of Defense Cyber Defense Command.”

Eubank addressed the obvious worry directly. Agentic systems elsewhere have broken out of sandboxes, hacked AI firm Hugging Face, uploaded malware to RubyGems, and attempted to access the Education Department. Eubank said “no agents have strayed to this point” thanks to strict guardrails. “We are treating each one of these agents just like a human operator, so they are basic,” he said. Humans check the work every day. Autonomy expands only as training progresses. “It has been, some would say, maybe a little bit too prescriptive.”

The Army is also preparing to award contracts to two companies for Project Griffin, a pilot to develop agents that can respond to cyberattacks on their own. The program grew from a tabletop exercise examining a scenario in which an adversary launched thousands of autonomous attacks at once. Brandon Pugh, the Army’s principal cyber advisor, said the two firms would take on the “take action element.” “How are we not only autonomously detecting a potential adversary? How are we now doing something, having an autonomous response within prescribed parameters of a human operator?” Pugh said. He added that funding for later deception and red-teaming phases is already aligned.

Why This Matters:

The government is writing rules for the AI it buys while building AI it will use to fight. Both efforts carry costs that taxpayers and contractors will feel. The GSA clause’s 25% liability cap, 72-hour reporting window, and material-use test will shape how companies price and document their products, while vague definitions leave room for discretionary enforcement vendors can’t predict in advance. Murphy’s concern about flow-down obligations points to a practical risk: smaller suppliers with little bargaining power may shoulder compliance burdens the government has placed on the prime. On defense, Eubank’s insistence on human oversight is the kind of restraint that keeps autonomy from becoming a liability. But the Army’s description of a framework that may be “a little bit too prescriptive” suggests the rules governing these agents are still being tested. Whether the government protects taxpayers without slowing innovation will depend on how officials apply these early decisions and whether contractors can absorb the new obligations without passing excessive costs back to the agencies they serve.