United StatesOMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government
In force since .
An AI governance rule binding government bodies.
- Obligation class
- Governance, Disclosure
As of .
What it requires
- This memorandum binds executive agencies, not vendors; a vendor meets it through the terms of a contract awarded under a solicitation issued on or after the date 180 days after , or through an option to renew or extend exercised after that date.
- If you sell an AI system or service to an agency, accept contract terms on intellectual property rights and use of government data, privacy, protections against vendor lock-in, compliance with the minimum risk management practices for high-impact use cases, and ongoing testing and monitoring.
- Do not use an agency's non-public inputted data or outputted results to further train publicly or commercially available AI algorithms without the agency's explicit consent, where your contract so provides.
- Give the agency the access and time necessary to complete independent evaluation of your system or service, and detail your examination, testing and validation procedures in the contract without barring the agency from internally disclosing how you test or the results.
- For a system with potential or expected high-impact use cases, provide the transparency and documentation the agency requires of you.
- Where a solicitation requires it, disclose your use of AI in performing the contract.
These lines are LexLint's reading of the law's text, as of .
What this law does
The memorandum, addressed to the heads of executive departments and agencies, is dated . It rescinds and replaces an earlier OMB memorandum. Except as specifically noted, it applies to all agencies defined in 44 U.S.C. 3502(1). It does not apply to elements of the Intelligence Community. It does not apply to AI acquired for use as a component of a National Security System.
It applies to any contract awarded under a solicitation issued on or after the date 180 days after its issuance, and to any option to renew or extend a contract exercised after that date. Agencies must include appropriate contractual terms that clearly delineate the respective ownership and intellectual property rights of the government and the contractor.
Agency processes should ensure that contracts permanently prohibit the use of non-public inputted agency data and outputted results to further train publicly or commercially available AI algorithms, consistent with applicable law, absent explicit agency consent. For AI systems with potential or expected high-impact use cases, agencies must inform vendors of reasonable transparency and documentation requirements that will be placed on the vendor.
Where applicable, agencies must include in contracts for AI systems and services terms that address a listed set of subjects. Contracts must ensure compliance with minimum risk management practices for high-impact use cases. Contractual terms must provide the contracting agency the ability to regularly monitor and evaluate the performance, risks, and effectiveness of an AI system or service. Vendors must provide the access and time necessary for agencies to complete independent evaluation.
Contracts must detail the examination, testing, and validation procedures of the vendor and must not prohibit agencies from internally disclosing how the vendor conducts testing or the results of testing. Terms on protections against vendor lock-in are necessary to reduce the risk that switching vendors could become cost-prohibitive. Agencies must determine whether circumstances merit a solicitation provision requiring disclosure of AI use as part of a contract's performance. The memorandum is directed to agencies, which reach a vendor through the terms they include in a contract.
When LexLint raises it
When your app profile says your app distributes a software product or trains models.