Blog
The Part 27 data-rights rewrite and GSA’s new AI clause ask contractors the same question: can you prove where it came from?
October 19 closed one door and opened another. The comment window on the second round of the Revolutionary FAR Overhaul shut that day, including the proposed rewrite of how the government takes rights in technical data and software. The same day, GSA’s new clause governing government data inside large language model systems took effect for new task and delivery orders.
Two rules. One date. For contractors that build AI into what they sell the government, both land on the same desk.
Read side by side, the FAR overhaul and the GSA clause ask for the same thing in different language. Who paid for this? Where did the data go? How was this output produced? Contractors that can answer from records will price, propose, and deliver with confidence. Contractors that answer from memory are about to find out what the new terms cost.
The FAR Council released the second batch of RFO proposed rules on September 18: four FAR cases covering 16 FAR parts, plus the matching Part 52 clauses. FAR Case 2026-011, which covers Parts 9, 27, and 47, carries the change with the longest tail for technology companies.
According to Womble Bond Dickinson’s analysis in the National Law Review, the proposal would replace FAR Subpart 27.4 with two DFARS-derived frameworks: one for technical data and software tied to commercial products and services, and one for everything else. Civilian agencies would start treating data rights the way defense contracting long has, based on who paid for the development.
The mechanics, as Fed Contract Pros lays them out:
SBIR and STTR data would get a single, nonextendable 20-year protection period, followed by government purpose rights.
None of this is final. Eight of the twelve planned RFO proposed rules are out, and the comments filed through October 19 will shape what comes back. The direction is clear, though, and it changes what a proposal has to support. Under a funding-based model, the rights you can assert depend on records: how each component was funded, how it was marked, and whether your subcontract flowdowns say the same thing. A prime can’t grant rights it never obtained.
Separate line items raise the stakes at proposal time. If data and software deliverables are priced on their own, the proposal has to identify each one, state the rights the government receives, assert any restrictions correctly, and put a value on them. Capture teams have often treated data rights as a contracts-office matter settled after award. Under this proposal, they become part of the price volume.
GSAR 552.239-7001, “Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems,” was issued as a class deviation on September 28 and applies to task and delivery orders issued after October 19. As Covington & Burling explains it, the clause covers LLMs, generative assistants, chatbots, and agentic systems where LLM functionality is a material feature and government data goes into or comes out of the model, commercial products included. Internal contractor systems the government doesn’t buy or access fall outside it, as does incidental LLM functionality in products that aren’t primarily AI.
Inside that scope, the obligations read like a standing data-handling audit. Law firm analyses from Covington, Crowell & Moring, and Wiley highlight five terms:
The schedule is next. GSA plans to add the clause to the MAS solicitation through Refresh 34 in November, with contractors given up to 90 days to accept the mass modification.
One rule governs who owns what you deliver. The other governs what happens to government data inside the AI you deliver. Both turn on documentation the contractor has to produce on demand, and three kinds of proof keep showing up.
Under the Part 27 proposal, rights follow funding history. Picture a software component built on internal R&D, extended under a cost-type task order, then reused on a fixed-price follow-on. That’s three funding stories for one component. Your data-rights assertions, your markings, and your separately priced data CLINs all have to tell the same one. Get it wrong and the cost shows up later, when a mis-marked deliverable or an unsupported assertion gives the government broader rights than you meant to grant.
The GSA clause bars training on government data and requires written confirmation of deletion at closeout. A contractor whose AI runs on a shared model has to answer for a data path it may not fully control. A contractor that owns its deployment can show that path end to end.
Under the final clause, an LLM that uses intermediary processing must produce a summary of the steps it records, including any human-reviewer access to government data connected to the interaction, according to Wiley’s review of the final language. The clause asks for a record of the steps. It doesn’t require citations. Contractors who want to stand behind their outputs will want both: the steps an agent took and the source behind every passage.
The 2026 Deltek Clarity Government Contracting Industry Study found that 90% of respondents are using or planning to use AI in at least one business function this year. Only 5% describe their AI maturity as fully developed. Data privacy and security top the list of AI concerns at 37%, and 45% say they’re unclear on the return.
That gap between adoption and maturity is where the new rules bite. General-purpose AI tools were built to produce fluent answers. Most weren’t built to show which document a sentence came from, to keep one organization’s data out of a model others share, or to prove deletion on request. For a capture team drafting a technical volume, that used to be a quality problem. Under funding-based data rights and a clause that overrides commercial terms, it becomes a contract problem.
The question has moved from whether to use AI to whether you can account for it.
Whatever AI you deliver, the proposal comes first. It’s where you assert data rights, describe how your AI works, and commit to how government data will be handled. Those commitments should come from tooling that meets the same standard: your data kept separate, none of it used to train anyone else’s model, and every claim traceable to a source document.
That bar is the one we’ve argued for since the new standard for AI in federal acquisition started taking shape, and it’s what UnifiedRespond™ is built around:
For teams with stricter requirements, Rohirrim supports CMMC-compliant deployments and is pursuing FedRAMP 20x certification.
Only 5% of GovCon firms call their AI maturity fully developed. The FAR overhaul and GSA’s AI clause just told the other 95% what “developed” will mean in contract terms: funding records that match your assertions, data paths you can document, and outputs you can trace back to a source.
The government sped up its buying this year. Now it’s writing down what it expects to see on the way in.
Start with the paper trail.
See how UnifiedRespond keeps every response traceable to its sources. Book a demo.
Rohirrim builds AI purpose-built for the proposal and procurement lifecycle. The Unified Acquisition Platform™ — including UnifiedRespond™ for proposal teams and UnifiedAcquire™ for government procurement organizations — is trusted by Fortune 500 enterprises, federal agencies, and government contractors to automate proposal responses, improve quality, and deliver measurable time and cost savings, with the security and compliance architecture regulated industries require. Learn more at rohirrim.ai.
The Revolutionary FAR Overhaul (RFO) is the FAR Council’s rewrite of the Federal Acquisition Regulation, released as a series of proposed rules. The second round, published September 18, 2026, covered 16 FAR parts across four FAR cases, including data rights in Part 27. Eight of twelve planned rules have been released, and none is final.
GSAR 552.239-7001 applies to orders issued after October 19, 2026, where LLM functionality is a material feature and government data enters or leaves the model. It bars training on government data, sets a 72-hour reporting clock, requires notice to the contracting officer when a model version is retired, and requires documented deletion at closeout.
The proposal would replace FAR Subpart 27.4 with two DFARS-derived frameworks and tie rights to funding. Private funding generally yields limited or restricted rights, government funding yields unlimited rights, and mixed funding yields Government Purpose Rights that convert to unlimited after the GPR period. Contractors will need funding records to support their assertions.
