How Should Contractors Safeguard Government Data When Using LLMs?

According to GSA’s June 2026 notice, the draft GSAR clause 552.239-7001 is meant to establish basic safeguarding for Government Data within LLM systems when they process that data. GSA also says the clause does not apply when LLMs are embedded in common commercial products or when LLM functionality is incidental. Under FAR 52.204-21, contractors must limit access to authorized users and authorized functions, verify and control connections to external information systems, control information posted or processed on publicly accessible systems, identify and authenticate users and devices, sanitize or destroy media containing Federal contract information before disposal or reuse, protect communications at external and internal boundaries, and use malware protection and scanning. NARA says its CUI guidance applies to applicable contractors, and ISOO’s March 2026 AI notice states that CUI and classified information must be handled under the governing executive orders and regulations when AI systems are involved. The cited guidance therefore turns on the data category, the system’s status, and the contract clause that applies.