Question · OMB M-25-22
How do I prevent AI vendor lock-in in a federal contract?
M-25-22 sets how agencies buy AI and rescinds M-24-18.
01 / The answer
The short answer
Write lock-in protections into both the solicitation and the contract, as M-25-22 directs: vendor knowledge transfer, data and model portability, agency rights to code and models produced under the contract, and transparent licensing and pricing. Bar the vendor from training on non-public agency data without consent, and keep your own validation data so you can evaluate the system independently. When you decide not to extend a contract, work with the vendor to carry out the terms on continued access to data and derived products, including agreed formats and a transfer plan.
02 / The rule
What OMB M-25-22 requires
M-25-22 sets how agencies buy AI and rescinds M-24-18. It requires contract terms on government data, vendor lock-in, compliance with M-25-21's high-impact practices, and agency rights to test and monitor the delivered AI.
- 01Apply the memo to contracts under solicitations issued, and options exercised, 180 days or more after issuance.
- 02Update internal acquisition procedures within 270 days so acquired AI conforms to M-25-21.
- 03Permanently bar vendors from training public or commercial AI on non-public agency inputs and outputs without agency consent.
- 04Include vendor lock-in protections such as knowledge transfer, data and model portability, and licensing transparency.
03 / Records
Records to keep
- 01Contract clauses on data use, IP rights and portability
- 02Agency-held validation and test datasets kept from the vendor
- 03Periodic (e.g. quarterly) performance and risk evaluation reports
- 04Vendor testing procedures and reproducible test results
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Office of Management and Budget
Office of Management and Budget
The White House
RELATED
Related: OMB M-25-22: the full guide · What AI clauses must federal contracts include after Sept 2025?