Lighter rules, heavier contracts: OMB’s April 2025 AI memos handed governance to the buyer
OMB’s April 2025 memos trimmed internal AI process but asked contracts to carry more of the load. Agencies that treated each stage of the contract as a governance control kept bargaining power that review boards alone could not provide.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On April 3, 2025, the Office of Management and Budget issued two memoranda on artificial intelligence. M-25-21, on federal use of AI, replaced the 2024 memo M-24-10. It kept chief AI officers and public use case inventories. It merged the earlier rights-impacting and safety-impacting categories into one category of high-impact AI, with one year to document minimum risk practices. M-25-22, on AI acquisition, replaced M-24-18. It told agencies to stop vendors from training commercial models on non-public agency data without consent. It also called for rights in data and outputs, and for interoperability and portability terms to avoid lock-in. It applied to solicitations issued from early October 2025. Both memos followed a January executive order that revoked the prior administration’s AI order.
Earlier in this series, we argued that the January 2025 rescission changed the vocabulary of federal AI work more than its substance, and that the inventories created under the 2024 memo were the durable plumbing. The April memos confirmed both points. Their more consequential move was elsewhere. M-25-22 asked contracts to do much of the governance work that the earlier framework had placed with internal review. A review board can decide whether a tool should be used. Only the contract can compel a vendor to disclose, test, notify, cooperate and leave cleanly. That shifts real accountability to contracting officers and program managers at four stages of an acquisition: defining the requirement, setting terms at award, managing performance, and planning the exit.
Requirement: deciding what is being bought
Governance starts before a solicitation is written. The memo encouraged agencies to describe the outcomes they need and to plan how they will test whether a system delivers them. Many AI purchases begin instead as product demonstrations, with requirements written around a tool someone has already seen.
The practical work is to decide early whether the use is likely to be high-impact under M-25-21. That classification drives everything downstream. A tool that informs benefit eligibility, fraud flags or enforcement priorities needs testing data, evaluation criteria and human review built into the statement of work. A drafting assistant for internal memos does not. Program offices should also ask whether AI is embedded in products they are buying for other reasons, such as case management or contact center software. Embedded features often arrive through a routine upgrade and escape review entirely.
Market research belongs in this stage too. Before a solicitation, agencies can ask vendors how their models are evaluated, what data they retain, and how they handle government content. The answers reveal which offerings can meet the agency’s eventual terms, and they spare a contracting officer from discovering incompatibilities after award, when bargaining power is lowest.
Award: data and rights terms
The award is where the memo’s data protections become enforceable. Agencies were told to restrict vendors from using non-public agency data to train publicly or commercially available models without explicit consent. They were also told to secure the rights they need in government data, outputs and any derived models, and to address intellectual property in a tailored way rather than accepting commercial defaults.
These terms sound standard. They are not standard in most commercial AI agreements, which typically reserve broad rights for the vendor to improve its services. Contracting officers need specific language on four points. Where is agency data stored and processed? Are prompts and outputs retained, and for how long? Does any agency data feed model improvement? Who owns fine-tuned models or retrieval indexes built from agency content? Each point needs a verification mechanism, such as an attestation, an audit right or a technical control like tenant isolation.
Performance: watching a system that changes
Traditional software changes when the agency installs an update. Hosted AI models can change underneath an agency without notice. A model version swap can alter accuracy, tone or refusal behavior in ways that matter for a high-impact use. M-25-21’s minimum practices include ongoing monitoring, and monitoring is impossible if the vendor will not say what changed.
Contracts therefore need model change notification, access to the evaluation results the vendor runs, and logs sufficient for the agency to investigate a complaint or an error. The contracting officer’s representative, a role often staffed by program personnel with little technical background, carries day-to-day oversight. Agencies that paired those representatives with a technical evaluator from the chief AI officer’s team had a realistic chance of noticing drift. Agencies that did not were relying on the vendor to report its own problems.
Incident terms belong here as well. A wrong benefit determination produced by a model is not a security breach, but it may need the same urgency. Contracts should define what counts as an AI incident, how fast the vendor must report one, and what cooperation it owes the agency’s investigation.
Exit: leaving without losing the work
Lock-in was the memo’s most distinctive concern. AI systems accumulate agency-specific assets over time: prompt libraries, fine-tuned models, embeddings, evaluation sets and workflow integrations. If those assets exist only in the vendor’s proprietary formats, recompeting the contract means starting over, which makes recompetition unlikely.
Exit terms should require export of agency data and agency-specific artifacts in documented formats, knowledge transfer to a successor, and transition assistance for a defined period. Pricing transparency matters too. Introductory pricing that rises sharply at renewal is a form of lock-in when switching costs are high. State and local agencies are not bound by the memo, but they buy from the same vendors, and clauses written for federal buyers tend to appear in their agreements.
The trade-off across all four stages is speed. Each of these terms takes negotiation, and the memos also told agencies to move faster. Agencies that drafted a standard AI clause set once, with procurement and the chief AI officer together, could buy quickly without giving up protections. Agencies that negotiated each deal from scratch tended to trade governance away for speed.
With hindsight
The contract-centered approach was tested quickly. From August 2025, GSA announced government-wide agreements offering major commercial AI models to agencies at nominal prices for an introductory period, which made data, logging and exit terms urgent. In December 2025, OMB memo M-26-04 added contract requirements for large language model purchases under the administration’s Unbiased AI Principles.
In March 2026, GSA proposed a standard AI clause for its Schedules. It would bar training on government data, require data portability and AI system disclosure, and require incident reports to CISA within 72 hours. GSA then delayed its rollout to take more comment. In April 2026, GAO reported that four large agencies were not prepared to share acquisition lessons through the GSA repository M-25-22 called for. The memo’s contract-first logic held up. Execution lagged.