CMMC guide
Is My Product in Scope of the GSA LLM Clause? A Self-Check
If you sell software with an AI chat or writing feature to GSA buyers, the GSA LLM clause may already apply to you. This self-check helps you find out.
What is the GSA LLM clause?
The clause is GSAR 552.239-7001, Basic Safeguarding of Data Within Large Language Model AI Systems. GSA issued it as a class deviation. It took effect on October 19, 2026.
It can show up in GSA solicitations, contracts, task and delivery orders, and BPAs. It covers commercial products and services too.
One point up front. This is a GSA clause, not a CMMC rule. It does not change your CMMC level or your SPRS score.
When does it reach my Schedule contract?
GSA plans to add it to Multiple Award Schedule contracts through MAS Refresh 34, planned for November 2026. Current holders would get a mass change to their contract. They must accept it within 90 days after it is issued to keep selling on the Schedule.
A formal rule in the Federal Register will follow. The deviation is in force now, so do not wait for that rule.
Test 1: Is AI a material feature of what you sell?
The clause applies when the government buys an LLM or a similar system. The list includes a generative assistant, a chatbot, an agentic system, and an LLM-enabled document or productivity tool.
The LLM part must be a material feature. A writing tool with a built-in AI assistant can count, not just products sold as AI.
Test 2: Does government data go in or come out?
Both tests must be true. The second asks whether Government Data will go straight into the LLM, or come out of it.
Government Data is broad. Inputs include prompts, system prompts, documents, knowledge bases, government email addresses and account details. Outputs include responses, analysis, and derived, anonymized and synthetic data.
System metrics do not count. Token counts, logs and metadata with no Government Data in them are left out.
What if we only use AI inside our own company?
That is the first carve-out. The clause does not apply when your LLM use stays in your own internal business, back office, operations or staff support tools.
Those tools must not be delivered to the government or reached by it. The carve-out holds even if the tools happen to touch Government Data along the way.
What if AI is a small extra in our product?
That is the second carve-out. It covers an LLM feature that is incidental or ancillary to a commercial product whose main purpose is not AI. All three of these must also be true:
- The feature is not required in the solicitation, statement of work, product description or requirements.
- The government does not access the feature.
- The feature is not used to process Government Data.
In both carve-outs, the contracting officer can still say the clause applies.
Why is "incidental" so hard to call?
The clause does not define incidental or ancillary beyond that text. Close calls are a judgment for you and the contracting officer.
Write down your reasoning for each product. Then read the clause with your contracts counsel before you decide you are out.
What should I do this week?
- List every LLM feature. Go product by product. Mark any chat, drafting, summary or agent feature, and note whether Government Data touches it.
- Map your model providers. For each feature, name the LLM and who builds, runs and hosts it. You need this list for the next two steps.
- Plan the 120 day disclosure. You must disclose the LLMs that process Government Data by the contract date, or within 120 days after work starts if none is set. Model cards, FedRAMP packages, SOC 2 or ISO 27001 reports may cover it.
- Set up a 30 day change notice. You owe 30 calendar days' written notice before you add, replace or materially change an LLM or its provider. If an outside provider retires a model you do not control, you have 5 business days from its notice.
Tell whoever runs incidents too. The clause has two 72 hour clocks: one for a material violation of the clause, and one for a security incident that may affect Government Data.
Next step: start the feature list today, and talk with us if you want help with data handling, incident playbooks or vendor due diligence.
Sources
Questions contractors ask
FAQWhat is the GSA LLM clause?
It is GSAR 552.239-7001, a GSA clause on keeping data safe in large language model AI systems. It took effect on October 19, 2026 as a class deviation. It covers who owns the data, how it may be used, model disclosure, incidents and model changes.
Is the GSA LLM clause part of CMMC?
No. It is a GSA contract clause, not a CMMC requirement. It does not affect your CMMC level or your SPRS score. It shows up in GSA solicitations, contracts, orders and BPAs.
What does this mean for my business?
If you sell an AI feature to GSA buyers and Government Data flows through it, you may have new duties now. Start with a list of your LLM features and providers. Then plan your model disclosure and your 30 day change notice process.
Does using an AI chatbot inside our office put us in scope?
Not by itself. Internal back office use is carved out when the tool is not delivered to the government or reached by it. That holds even if it happens to touch Government Data. The contracting officer can still say otherwise.
Can the clause override our terms of service?
Yes. If the clause conflicts with your terms of service, license, click-wrap or other commercial agreements, the clause wins. Check your own terms against it before Refresh 34 reaches your contract.
Already know you want to talk?
BOOK A CALLSkip the form. Pick a time and talk to us directly.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Defense supplier under 75 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.