Current OMB Requirements for Federal AI Use and Procurement

The rules surrounding government agency use of artificial intelligence (“AI”) have changed. On April 3^rd, 2025, in accordance with President Trump’s January 23^rd Executive Order regarding AI, the Office of Management and Budget (“OMB”) issued M-25-21 and M-25-22, reshaping how federal agencies must use, inventory, and buy AI technologies. These sweeping memoranda rescind and substitute the Biden-era OMB memos M-24-10 and M-24-18, ushering in a full regulatory buildout that prioritizes US-developed AI, mandates risk assessments for AI that may have significant impacts on Americans, and introduces new source-selection and intellectual property (“IP”) language into Requests for Proposals (“RFPs”).

M-25-21: How Agencies Must Use AI

OMB Memorandum M-25-21 requires agencies to bring structure and transparency to how they use AI—not just in future programs, but with AI tools currently in use as well. By July 2^nd, 2025, every Chief Financial Officer (“CFO”) Act agency must appoint a Chief AI Officer (“CAIO”), establish an internal AI Governance Board, and participate in an interagency CAIO council led by OMB. These officers will oversee agency compliance and coordinate implementation across programs and procurements. Under the direction of their CAIOs and AI Governance Boards, the agencies must develop an “AI Strategy” by September 30^th, 2025. The AI Strategy must include: the current and planned AI use cases most impactful to the agency’s mission operations or service delivery; an assessment of their current AI maturity; and a plan to achieve the agency’s AI maturity goals.

Further, all agencies (except for the Department of Defense and those in the Intelligence Community) must create a public-facing AI use-case inventory and update it at least yearly. These inventories must flag “safety-impacting,” “rights-impacting,” and especially “high-impact” AI systems, which are defined by their potential to significantly affect individual rights, safety, or access to benefits. For any system labeled high-impact, agencies have 365 days to either mitigate the risks to an acceptable level or terminate the system.

M-25-22: How Agencies Must Buy AI

OMB Memorandum M-25-22 transforms AI acquisition from soft guidance into hard procurement rules. Starting October 1^st, 2025, any contract awarded under a solicitation involving AI must follow new practices designed to “maximize the use of AI developed and produced in the United States.” Agencies are now expected to verify the origins of their AI tools through representations and certifications, justify any exceptions in writing, and insert domestic-preference language directly into RFPs.

All AI procurement flow through cross-functional acquisition teams made up of contracting, IT, cybersecurity, privacy, legal, and program staff. These teams will screen for vendor-lock risks, auditability gaps, and data-portability issues long before an award is made. To support this, agencies must adopt new contracting language covering pre-award testing rights, post-award monitoring, and explicit IP and data-ownership clauses around training data, model weights, and derivative use.

Five Things to Do Before FY 2026 RFPs Drop

For federal contractors that develop, integrate, or resell AI tools, OMB’s new memos aren’t background noise; they’re a roadmap. Here are five steps for companies that want to get ahead of the AI procurement:

1. Map your AI supply chain. Document where your models were trained, tuned, and deployed. You’ll need this to back up “US-developed and produced” certifications starting October 2025.
2. Build a training data audit trail. Agencies must now assess bias, provenance, and IP risks. Start logging datasets, third-party sources, and red-team results in a defensible, pull-ready format.
3. Draft fallback IP language. M-25-22 directs agencies to prevent vendor lock-in. Offer flexible licensing that allows continued access or retraining—without giving up your core IP.
4. Use risk-tier language in your proposals. Terms like “high-impact” or “rights-impacting” are official risk categories agencies are now required to track. Speak their language.
5. Track pending FAR and DFARS updates. These memos are just the beginning. Rulemaking could start by early 2026. Stay ready with quarterly gap reviews and comment strategies.

If you have questions or need assistance, please feel free to reach out to this blog’s author at [email protected], or to any of our other attorneys.