Incident Response
Two 72-Hour Clocks: The GSA AI Clause and Your Incident Response Plan
If you sell an AI tool to GSA, a security incident now starts a 72-hour clock. Your incident response plan needs to be ready before that happens.
Capital Cyber. Sources are listed at the end of the article.
What Does the GSA AI Clause Cover?
The GSA AI clause is GSAR 552.239-7001. It took effect on October 19, 2026. It covers large language model tools, like chatbots and AI assistants, when government data goes into them or comes out of them.
It applies to GSA contracts, orders and blanket purchase agreements. The AI must be a material feature of what the government buys. Government data must also pass through it.
Government data is broad. It includes prompts, uploaded files and knowledge bases. It also includes the answers, summaries and synthetic data the tool produces.
There are exceptions. AI used only for your own back-office work, and not delivered to the government, is out.
So is a minor AI feature the government does not need, access or feed with its data. Close calls belong with your contracts counsel.
The clause also overrides your terms of service. If your click-wrap or license says something different, the clause wins.
What Are the Two 72-Hour Clocks?
Many people think there is one clock. There are two.
The first clock is a material violation of the clause. That is a breach of the rules that could seriously hurt the work, the government's rights, security or confidentiality. You must tell the contracting officer within 72 hours after you know about it.
The second clock is a security incident affecting the AI system that may touch government data. You must tell the contracting officer and the government's security contacts within 72 hours of finding it.
What Happens After You Report an Incident?
Reporting is only the start. Until the incident is resolved, you owe daily status updates.
You must keep logs and forensic evidence for 90 days. You must also complete the CISA incident reporting form. If you already file FedRAMP reports, those can cover overlapping duties when sent to the contracting officer at the same time.
What Data Rules Apply While the Contract Runs?
Only people the contracting officer approves may access government data. The data must stay on agreed premises or FedRAMP authorized services unless the officer agrees in writing. It must be kept apart from other customers' data.
You may not use the data to train or improve any model, including a third party's model. You may not use it for marketing or sell it. You may not keep it longer than the contract allows.
What Must You Delete When the Contract Ends?
Unless the contracting officer directs otherwise in writing, you must delete it all, for good. That means government data and custom work, including fine-tuned model weights, embeddings, indexes and caches.
Deletion covers every system, copy and backup. Then you must document it in writing to the contracting officer. A vector database left on a forgotten server is a finding waiting to happen.
What Should Go in Your Incident Response Plan Now?
Use this as a starting checklist.
Add two triggers to your plan: material violation and security incident.
Name who calls the contracting officer, and keep that contact list current.
Set a daily update owner and a simple status template.
Hold logs and forensic data for 90 days once an incident starts.
Bookmark the CISA reporting form and practice filling it out.
Map every place government data lives, including embeddings and caches.
Write an end-of-contract deletion runbook that covers backups and ends with a signed record.
Ask each AI vendor and subcontractor for proof they follow the same rules.
GSA also plans to add the clause to its Multiple Award Schedule through Refresh 34, planned for November 2026. Current holders would need to accept that change within 90 days to keep selling on the schedule.
Next step: book a short call with Capital Cyber to review your incident response plan against both clocks.
Frequently Asked Questions
5 QUESTIONSWhat does the GSA AI clause mean for my business?
It means faster reporting and stricter data rules if you sell AI tools to GSA. You must report incidents within 72 hours, protect government data, and delete it at contract end. Your incident plan and data map need to reflect that.
When did the GSA AI clause take effect?
It took effect on October 19, 2026, as a class deviation. A formal rulemaking with Federal Register publication is expected to follow, but the clause is in force now.
Do I have to delete embeddings when a GSA contract ends?
Yes, unless the contracting officer says otherwise in writing. Deletion covers government data and custom work, including fine-tuned model weights, embeddings, indexes and caches, across all systems and backups.
Can we train our model on government data?
No. The clause bans using government data to train, fine-tune or improve any model, including third-party models. It also bans using that data for marketing or selling it.
How long must we keep logs after an incident?
You must preserve logs and forensic artifacts for 90 days. You also owe daily status updates until the incident is resolved, plus the CISA incident reporting form.
Sources
READ 2026-11-04- GSA RGO-2026-01 class deviation, GSAR 552.239-7001 Basic Safeguarding of Data within Large Language Model AI Systems (PDF)
- Wiley, GSA Releases Final Language of AI Contract Clause (2026-10-13)
- Covington, Inside Government Contracts, GSA Previews Significant Changes Planned for Upcoming Multiple Award Schedule Refresh (2026-10-15)
This article explains the regulations and is not legal advice.
Talk it through in 30 minutes.
A call is a conversation, not a pitch. Tell us how your business runs and we will tell you what we would manage.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.