GSA gives AI vendors a 72-hour incident clock

A GSA acquisition memo gives AI contractors a 72-hour incident-reporting window and a 120-day disclosure deadline for covered systems, with major model changes requiring 30 days of notice and concurrent access, according to Nextgov’s account of the clause. The official RGO-2026-01 document directs GSA contracting activities to insert its safeguarding clause when government data is submitted to or produced by an LLM, agentic system, chatbot, or LLM-enabled productivity tool; the policy takes effect October 19, while officers can use it now. Vendors selling AI into federal contracts should treat model swaps, training-data restrictions, deletion at closeout, and audit logs as contract surface area, not post-sale security paperwork; the archive’s governance cost analysis makes the same cost-of-control point.