United States (federal) · OMB memorandum
OMB M-25-22: what it requires, and the records to keep
M-25-22 sets how agencies buy AI and rescinds M-24-18. It requires contract terms on government data, vendor lock-in, compliance with M-25-21's high-impact practices, and agency rights to test and monitor the delivered AI.
01 / What it requires
What OMB M-25-22 requires
Federal agencies (44 U.S.C. 3502(1)) acquiring AI systems or services; excludes Intelligence Community elements and AI bought as part of a National Security System.
- 01Apply the memo to contracts under solicitations issued, and options exercised, 180 days or more after issuance.
- 02Update internal acquisition procedures within 270 days so acquired AI conforms to M-25-21.
- 03Permanently bar vendors from training public or commercial AI on non-public agency inputs and outputs without agency consent.
- 04Include vendor lock-in protections such as knowledge transfer, data and model portability, and licensing transparency.
- 05Give the agency contractual rights to regularly test and monitor performance, risks and effectiveness using its own data.
- 06Require vendor testing results detailed enough to be independently verified or reproduced, where vendors test.
02 / AI work
Where it touches AI work
It is the main federal rule shaping AI contract terms, so vendors selling AI to agencies meet its data, portability and testing clauses. It also encourages notice before vendors add new AI features.
03 / Dates
The dates that matter
M-25-22 issued; rescinds and replaces M-24-18
Applies to new solicitations and option exercises (180 days)
M-26-04 adds unbiased AI principles for LLM procurement
Agency acquisition procedures due to be updated (270 days)
04 / Enforcement
Who enforces it
Enforced through agency contracting and OMB oversight; vendor remedies follow the contract. No statutory penalties.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Contract clauses on data use, IP rights and portability
- 02Agency-held validation and test datasets kept from the vendor
- 03Periodic (e.g. quarterly) performance and risk evaluation reports
- 04Vendor testing procedures and reproducible test results
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
What AI clauses must federal contracts include after Sept 2025?+
For AI contracts under solicitations issued, or options exercised, from September 30, 2025, M-25-22 requires terms that permanently bar vendors from using non-public agency inputs and outputs to train public or commercial AI without agency consent; protect against vendor lock-in through knowledge transfer, data and model portability and licensing transparency; ensure compliance with M-25-21's high-impact practices; and let the agency regularly test and monitor the delivered AI. Where vendors do the testing, results must be detailed enough to verify or reproduce, if practicable. LLM purchases also follow M-26-04. Read the full answer
How do I prevent AI vendor lock-in in a federal contract?+
Write lock-in protections into both the solicitation and the contract, as M-25-22 directs: vendor knowledge transfer, data and model portability, agency rights to code and models produced under the contract, and transparent licensing and pricing. Bar the vendor from training on non-public agency data without consent, and keep your own validation data so you can evaluate the system independently. When you decide not to extend a contract, work with the vendor to carry out the terms on continued access to data and derived products, including agreed formats and a transfer plan. Read the full answer
SOURCES
Go back to the source
Office of Management and Budget
Office of Management and Budget
The White House
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: OMB M-25-22 for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4