Question · OMB M-25-22
What AI clauses must federal contracts include after Sept 2025?
M-25-22 sets how agencies buy AI and rescinds M-24-18.
01 / The answer
The short answer
For AI contracts under solicitations issued, or options exercised, from September 30, 2025, M-25-22 requires terms that permanently bar vendors from using non-public agency inputs and outputs to train public or commercial AI without agency consent; protect against vendor lock-in through knowledge transfer, data and model portability and licensing transparency; ensure compliance with M-25-21's high-impact practices; and let the agency regularly test and monitor the delivered AI. Where vendors do the testing, results must be detailed enough to verify or reproduce, if practicable. LLM purchases also follow M-26-04.
02 / The rule
What OMB M-25-22 requires
M-25-22 sets how agencies buy AI and rescinds M-24-18. It requires contract terms on government data, vendor lock-in, compliance with M-25-21's high-impact practices, and agency rights to test and monitor the delivered AI.
- 01Apply the memo to contracts under solicitations issued, and options exercised, 180 days or more after issuance.
- 02Update internal acquisition procedures within 270 days so acquired AI conforms to M-25-21.
- 03Permanently bar vendors from training public or commercial AI on non-public agency inputs and outputs without agency consent.
- 04Include vendor lock-in protections such as knowledge transfer, data and model portability, and licensing transparency.
03 / Records
Records to keep
- 01Contract clauses on data use, IP rights and portability
- 02Agency-held validation and test datasets kept from the vendor
- 03Periodic (e.g. quarterly) performance and risk evaluation reports
- 04Vendor testing procedures and reproducible test results
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Office of Management and Budget
Office of Management and Budget
The White House
RELATED
Related: OMB M-25-22: the full guide · How do I prevent AI vendor lock-in in a federal contract?