OMB M-25-22: Driving Efficient Acquisition of Artificial Intelligence in Government
United States · Guideline · Office of Management and Budget
Our summary
This memorandum sets requirements for federal agencies to acquire artificial intelligence systems and services responsibly and cost-effectively. It applies to executive branch agencies procuring AI systems, excluding common commercial products and national security systems, with requirements taking effect 180 days after issuance. Agencies must establish cross-functional teams for AI acquisitions, protect privacy and intellectual property rights, prioritize American-made AI, and track AI performance to ensure public benefit and trustworthiness.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
5 sections
Jump to a chapter
Subject
Overview
This memorandum provides guidance for federal agencies to acquire artificial intelligence responsibly and cost-effectively, grounded in three themes: ensuring government benefits from competitive American AI markets through attention to vendor sourcing and interoperability, safeguarding taxpayer dollars by verifying AI systems fit their purpose and manage risk, and promoting effective acquisition through cross-functional collaboration among agency officials with varied expertise.
Scope
The memorandum implements requirements from the Advancing American AI Act to establish means for AI contracts to align with prior AI governance guidance and statutory aims under C. § 3502(1), applying to federal agencies except Intelligence Community elements and with certain requirements only for CFO Act agencies, without superseding other applicable federal acquisition policies or agencies' existing authorities and responsibilities. The memorandum excludes common commercial products with embedded AI such as word processors or map navigation unless the AI is embedded in a product primarily used for its AI functionality or the product is specialized for agency use rather than widely available to the public, and does not govern agencies' regulatory actions on non-agency AI use, assessments of AI in law enforcement or national security contexts, development of public testing standards, basic applied or experimental research, or AI used incidentally by contractors.
Agency-level requirements
Within 270 days of issuance, agencies must update acquisition procedures to enable review of AI acquisitions, convene cross-functional teams, maximize American-made AI use, and establish privacy policies for AI systems handling personally identifiable information with Senior Agency Officials for Privacy involvement. Agencies must establish processes addressing government data use, contractual terms clarifying ownership and intellectual property rights, licensing scope to avoid vendor lock-in, data handling with limited vendor collection and retention, and a permanent prohibition on using non-public agency data and outputs to train public or commercial AI algorithms without explicit consent. GSA must develop a publicly available procurement guide within 100 days covering acquisition authorities, approaches, vehicles, and benefits and drawbacks, and must develop a web-based repository within 200 days for Executive Branch agencies only to share AI acquisition information, tools, best practices, standard contract language, and negotiated costs; agencies must determine whether vendors should disclose any AI use in contract performance.
AI acquisition lifecycle guidance
Throughout the acquisition lifecycle, agencies must contemplate and mitigate potential harms to privacy, civil liberties, and civil rights, identify risks to the nine government AI principles in Executive Order 13960, and determine whether AI systems contain high-impact use cases as defined in OMB Memorandum M-25-21; agencies should conduct thorough market research, seek product demonstrations, and use performance-based acquisition techniques with flexibility, performance metrics, and outcome-based incentives. Agencies must disclose in solicitations when AI systems meet high-impact use case thresholds, inform vendors of transparency and documentation requirements for M-25-21 compliance, incorporate contract terms governing intellectual property rights and government data handling, and test proposed AI systems to the greatest extent practicable; evaluation criteria may include interoperable APIs, transparent documentation, open-source options, and non-discriminatory pricing practices. Contracts must permit quarterly or biannual performance monitoring using agency-controlled validation datasets that vendors cannot access, with vendors providing necessary access and time for independent agency evaluation or conducting testing if agencies closely monitor and obtain detailed verifiable results; before operating AI systems, agencies must obtain appropriate clearance under OMB Circular No.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 6 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Prohibited practices, not covered
- Impact assessment, not covered
Data and privacy 1 of 4
- Data governance and quality, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 3 of 6
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 10 are shown.
Overview 1 control
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must obtain AI capabilities that are safe, secure, effective and trustworthy.
Agency-level requirements 6 controls
- ObligationApplies to: Public authorityDrafted by the Index
Within 270 days, agencies must revise internal acquisition procedures to comply with this memorandum and conform to OMB Memorandum M-25-21.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must update acquisition procedures to enable officials to review planned AI acquisitions and give feedback on AI performance and risk management.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must assemble a cross-functional team of internal officials with relevant expertise to participate in coordination and decision-making on AI acquisitions.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must ensure that contracts for AI include appropriate terms governing intellectual property rights.
- ObligationApplies to: Public authorityDrafted by the Index
Consistent with applicable law, agencies should prioritize AI systems and services that are developed and made in the United States.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must establish policies and contractual terms ensuring compliance with privacy requirements when acquiring or using AI systems that process personally identifiable information.
AI acquisition lifecycle guidance 3 controls
- ObligationApplies to: Public authorityDrafted by the Index
Throughout AI procurement, agencies must consider and mitigate risks affecting privacy, civil liberties and civil rights.
- ObligationApplies to: Public authorityDrafted by the Index
Based on procurement requirements, agencies should convene an internal cross-functional team to streamline the acquisition of AI systems or services according to complexity and risk.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must identify reasonably foreseeable use cases from an AI system or service and determine whether the system is likely to involve high-impact AI uses as defined by OMB Memorandum M-25-21.
Change history
No changes recorded since we began monitoring this policy.