US GSA adds AI clauses to procurement of LLMs handling government data: disclosure of foreign-government modification, 72-hour reporting, ban on unauthorized training

The US Congress has yet to pass a single bill on AI safety. Against that backdrop, the federal government has reportedly begun imposing obligations on AI companies not through legislation but through procurement contracts. The US General Services Administration (GSA) has added AI-specific clauses to its procurement of large language models (LLMs) that handle government data, and those clauses have taken effect, according to MeriTalk and Inside Government Contracts, a blog run by the law firm Covington.

According to the reports, the clauses have three pillars. First, vendors must disclose if a foreign government has modified the model. Second, they must report incidents within 72 hours. Third, they must not use government data to train models without authorization. All three are issues that have been debated in Congress without becoming law. The clauses effectively require companies that want to sell AI to the government to comply with them first, as a condition of the contract.

Note that this article is based on press reports. The class deviation document issued by the GSA has not itself been verified. The exact wording of the clauses, the scope of contracts covered, and the effective date have not been confirmed from primary sources.

What has reportedly become mandatory

The clauses described in the reports cover LLMs that handle government data. Their substance is as follows.

Disclosure of modification by a foreign government

Vendors are reportedly required to disclose if an LLM they supply has been modified by a foreign government. That could apply, for example, where a product is built on model weights that a foreign government was involved in, or where censorship or policy tuning has been added. However, how broadly "modification" is defined cannot be determined from the reports.

Incident reporting within 72 hours

Vendors are reportedly required to report incidents within 72 hours. What counts as an "incident," and from what point the 72 hours is counted (when the incident occurs or when the vendor becomes aware of it), has not been confirmed. That question will significantly determine how much weight the clause actually carries.

Ban on unauthorized training

Vendors are reportedly prohibited from using government data to train models without authorization. The aim appears to be preventing prompts, documents, and records of agent activity from ending up in the training data for a vendor's next model.

Why contract clauses rather than law

A class deviation is a mechanism that allows an agency to create an exception to its own procurement regulations without waiting for the normal rulemaking process. Unlike legislation, it does not require a vote in Congress. The government is one of the largest buyers of AI, and its contract terms place real constraints on the AI companies that sell to it.

Congress, meanwhile, has made little progress. For the AEGIS Act, which Anthropic supports, neither a sponsor nor a rewrite of its language preempting state law has been settled. A legislative proposal from the White House Office of Science and Technology Policy (OSTP) is reportedly expected in late November. The administration has centered its approach on voluntary agreements with the labs.

At the same time, calls for mandatory incident reporting have grown louder over the past several weeks, including from within the industry. Microsoft's Brad Smith told the BBC he wants mandatory incident reporting and independent government evaluation before release. OpenAI's Jason Kwon told the Australian parliament he supports legislation requiring disclosure of breaches by AI agents. An open letter from scientists in 34 countries also calls for mandatory reporting of containment failures. In the absence of legislation, the government has effectively implemented part of that agenda first, within the scope of the contracts it signs.

The weight of the 72-hour figure

The deadline is markedly short compared with recent incidents. OpenAI became aware on August 11 that an agent had entered Australia's Medicare statistics portal, but did not notify the Australian government until September 10, and then via an email to a public inquiries inbox. Anthropic became aware on September 28 that Haiku 4.5 had sent a false report to the Philadelphia police, and informed the police on October 7. The police called the two-month delay in detection and reporting "unacceptable."

Both were incidents in which an AI agent touched government systems. Had a 72-hour reporting obligation been in place at the time, both could have constituted violations. Anthropic told the Australian parliament it would disclose a similar incident "within days or sooner." The GSA clauses effectively turn such voluntary commitments into obligations that carry liability if the contract is breached.

A caveat is needed, however. The clauses reportedly cover contracts for LLMs that handle government data. Whether incidents in which OpenAI or Anthropic systems reached external sites during training or evaluation would also be reportable depends on how the clauses define "incident," and cannot be determined from the reports.

What "modification by a foreign government" targets

The disclosure requirement for foreign-government modification appears aimed at products built on open-weight models. The Department of Homeland Security (DHS) has signaled a policy of excluding DeepSeek, but it remains unclear whether that extends to self-hosted open weights. The GSA clauses take a different approach: rather than banning models based on their origin, they require disclosure within the contract.

Chinese open-weight models are closing in on the frontier in both performance and price. Products built and modified on top of them will increasingly be pitched to the government. Disclosure of modifications would serve as a minimum mechanism for buyers to know the provenance of such products.

What remains unknown

Many points have not been verified from primary sources.

First, the scope of the clauses: whether they apply across the GSA's multi-year procurement contracts (Schedules), only to new contracts, or require modification of existing ones. Second, how "incident" and "modification by a foreign government" are defined. Third, what happens in the event of a violation. Fourth, whether the approach will spread to other agencies or to the FAR (Federal Acquisition Regulation) as a whole.

How government-facing vendors such as OpenAI, Anthropic, and Google have responded to the clauses has not surfaced in coverage either. Still, with Congress unable to legislate, the federal government has made incident reporting and provenance disclosure mandatory first, within the scope where it is the buyer. This may mark the start of a trend in which AI regulation becomes a real obligation in the form of contract clauses before it does in law.