The published guidance from the FAR council includes the dates when clauses should be included. Your comment about not changing an existing contract is mostly correct, but watch out for GSA schedule MAS contracts. They can be modified and GSA started that process last month.
For non-GSA contracts:
• new contracts awarded on or after November 14 from solicitations issued before October 15 (this includes new orders awarded on or after November 14 from solicitations issued before October 15 under existing indefinite-delivery contracts); • new solicitations issued on or after October 15 and contracts awarded pursuant to those solicitations (this includes new solicitations issued on or after October 15 for orders awarded pursuant to those solicitations under existing indefinite-delivery contracts); • extensions or renewals of existing contracts and orders awarded on or after October 15, 2021; and • options on existing contracts and orders exercised on or after October 15, 2021.
For GSA:
GSA Refresh 8 was issued on October 8, 2021 and impacts all GSA MAS Contract holders. Refresh 8 implements the Executive Order on COVID-19 Safety Protocols for Federal Contractors across all GSA MAS Contracts (also referred to as GSA Schedule Contracts), regardless of whether they are product or service-based.
This mandate in this question has nothing to do with 100 employees, that's the OSHA mandate. This is about federal contractors and subconstractors. They are under a stricter mandate and it's already in place for new contracts and GSA schedule contracts., with a deadline of 12/8.
The updated FAQ at saferfederalworkforce seems to close the loophole for moving people into an affiliate company:
Q: If a corporate affiliate of a covered contractor does not otherwise qualify as a covered contractor, are the employees of that affiliate considered covered contractor employees subject to COVID-19 workplace safety protocols for Federal contractors established through Task Force Guidance?
A: For purposes of Task Force Guidance, business concerns, organizations, or individuals are affiliates of each other if, directly or indirectly: (i) either one controls or has the power to control the other; or (ii) a third party controls or has the power to control both.
Indicia of control include, but are not limited to, interlocking management or ownership, identity of interests among family members, shared facilities and equipment, or common use of employees.
An employee of a corporate affiliate of a covered contractor is considered a covered contractor employee if the employee performs work at a covered contractor workplace.