GSA Finalises Generative AI Procurement Rule, Emphasises NIST Framework

What happened

The U.S. General Services Administration (GSA) has released its final rule concerning the procurement of large language models (LLMs) and other generative artificial intelligence (AI) technologies by federal agencies. This regulation, set to take effect in October 2026, introduces a more focused definition of generative AI, limiting its scope primarily to foundation models. A key aspect of the rule is the enhanced protection for intellectual property (IP) rights of contractors supplying these AI solutions, alongside a mandate for adherence to the National Institute of Standards and Technology (NIST) AI Risk Management Framework. The GSA's updated approach represents a shift from earlier, broader proposals, concentrating on the foundational technologies rather than every application of generative AI. This refined scope aims to provide clarity for both government agencies and AI vendors. The inclusion of robust IP safeguards is intended to encourage innovation and participation from the private sector, addressing concerns raised during the public comment period regarding data rights and ownership in government contracts.

Why it matters

This regulatory development holds significant implications for AI governance, ethics, and business strategy, particularly for organisations engaging with or aspiring to work with the U.S. federal government. The narrowed definition of generative AI to foundation models simplifies compliance efforts but also places a greater onus on understanding the provenance and capabilities of these core technologies. For businesses, this means a heightened focus on the ethical development and deployment of foundation models, ensuring they meet rigorous standards for transparency, fairness, and accountability. The emphasis on the NIST AI Risk Management Framework is a critical signal for responsible AI implementation. It underscores the government's expectation that AI solutions are not only effective but also developed and operated with a clear understanding and mitigation of potential risks. Businesses must integrate this framework into their AI lifecycle, from design to deployment, to demonstrate compliance and build trust. Furthermore, the strengthened IP protections highlight the growing recognition of AI as a valuable asset, prompting businesses to solidify their own IP strategies when contracting with public sector entities.

By the numbers

• October 2026: The effective date for the GSA's final rule on generative AI procurement.

The Institute take

While the GSA's final rule appears to streamline procurement by narrowing its focus to foundation models and offering IP protections, the real challenge for businesses lies in the substantive integration of the NIST AI Risk Management Framework. Many will view this as a box-ticking exercise, but that misses the point entirely.

The GSA's rule isn't just about compliance; it's a clear directive for proactive risk management in AI. Responsible AI leaders will recognise that simply adhering to the letter of the NIST framework is insufficient. Instead, they must embed its principles deeply into their organisational culture and technical processes, moving beyond mere documentation to genuinely address and mitigate the ethical and operational risks inherent in AI systems, especially at the foundational model level. This requires a commitment to continuous auditing, transparent reporting, and fostering an internal culture of accountability for AI outcomes.