Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Federal agencies should treat AI procurement as a lifecycle review—not a security check added just before launch. Under Office of Management and Budget (OMB) Memorandum M-25-22, agencies should identify AI uses during acquisition planning, test proposed capabilities against mission needs and operating conditions, set clear data and intellectual-property terms, and obtain the required authorization before deploying an AI system operated as an agency information system. Those steps supplement, rather than replace, other applicable acquisition, privacy, cybersecurity, and federal information-security requirements.
Which federal AI acquisitions does the current OMB guidance cover?
OMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government, issued April 3, 2025, is the current government-wide acquisition memo identified here. It rescinded and replaced M-24-18. It applies to covered federal agencies acquiring AI systems or services, subject to exclusions that include National Security Systems and Intelligence Community elements. Agencies must apply it alongside other relevant federal policies, not in place of them.
As an Amazon Associate I earn from qualifying purchases.
The memo’s definition can reach software, tools, utilities, and systems where AI is integrated into a business process or operational activity. But not every commercial product with an embedded AI feature necessarily falls within the definition: some products are excluded when AI is not their primary functionality. To make that distinction, consider whether the product is broadly available and has substantial non-AI purposes, or whether its primary function is specialized AI.
OMB frames the acquisition goals around competitive markets and avoiding costly vendor dependence, tracking performance and managing risk, and engaging the right functions across the agency. It directs agencies to review and update internal acquisition procedures, have relevant officials review planned AI acquisitions, convene cross-functional teams, and use appropriate intellectual-property terms. OMB’s stated standard is that “Agencies must ensure that the AI systems they procure are fit for purpose and deliver consistent results that preserve public trust in the manner outlined in Executive Order 13960.”
#1 Best Overall
How should agencies identify AI and risk before solicitation?
Ask how AI will be used
During planning, determine whether AI is a primary feature of an offering or will be used to perform work under the contract. Require vendor disclosure where the agency considers it appropriate. Identify reasonably foreseeable use cases, including uses that could emerge from the proposed workflow, and consider early whether any could be high-impact.
M-25-22’s high-impact concept turns on the significance of a system’s output to effects involving rights, privacy, access to important services or resources, well-being, infrastructure, or public safety. This is a reason to examine the intended decision or service, not merely the model’s technical label.
Give the review a cross-functional owner
Bring acquisition, IT, cybersecurity, privacy, confidentiality, civil-rights and civil-liberties, legal, budget, data, and evaluation expertise into a cross-functional team. The team should match its review effort to the procurement’s complexity and risk, assign responsibility for issues that need resolution, and create an initial list of risks to investigate. Involving the Senior Agency Official for Privacy early and throughout planning and requirements definition is particularly important when personally identifiable information is involved.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How can an agency test vendor claims and compare proposals?
Use market research and realistic demonstrations
Conduct broad market research. Where practicable, arrange demonstrations and tests that resemble the agency’s intended operating environment, including relevant network characteristics. Use those exercises to probe both capabilities and limitations. They can also expose practical dependence on one vendor, including costs or obstacles involved in switching.
Translate mission needs into performance-based statements of objectives or work where appropriate. Pair them with quality-assurance surveillance plans, measurable outcomes, and contract incentives that connect vendor commitments to agency results. A demo is evidence to inform a decision; it is not, by itself, proof that a system is suitable for every use or an authorization to deploy it.
Make evaluation reproducible where practicable
At proposal evaluation and before award, test offered capabilities to the greatest extent practicable. Contract terms should support recurring monitoring of performance, risk, and effectiveness. M-25-22 calls for access and time for independent agency evaluations where appropriate, with agency-defined evaluation data protected from vendor access. If a vendor conducts testing, require results detailed enough for the agency to verify or reproduce when practicable.
For each proposed solution, compare test results and limitations against intended data and network conditions; data rights and privacy terms; transparency and access; the ability to monitor changes; interoperability; and ongoing costs. Weight these factors according to the impact of the use case and the agency’s requirements rather than assuming one score or procurement structure fits every mission.
Compare acquisition approaches on lifecycle fit
| Decision | What to weigh |
|---|---|
| Agency-directed requirements or vendor-led proposal | Whether the agency has defined the mission need and evaluation criteria clearly enough to judge the proposed capability and its limits. |
| Contract or another agreement mechanism | Whether the chosen mechanism provides suitable performance expectations, oversight, data and intellectual-property rights, and remedies for the specific acquisition. |
| AI product or license versus ongoing AI service | Who operates and maintains the capability, what access the agency needs to assess it, and how continuing costs and risks will be monitored. |
| Demonstrated mission fit versus lifecycle flexibility | Balance tested performance against total ongoing costs, data and model portability, and the difficulty of changing providers. |
These are real acquisition approaches and trade-offs documented by the Government Accountability Office (GAO), not a universal ranking. The appropriate choice depends on the use case and contract requirements.
Rank #3
What should the contract say about data, privacy, and vendor exit?
Define rights and permitted data use
Allocate government and contractor data and intellectual-property rights clearly, including rights relevant to training, fine-tuning, and development. Specify what data may be collected, how long it may be retained, who may access it, and what uses are permitted.
M-25-22 says contracts must permanently prohibit the use of nonpublic agency inputs and outputs to further train publicly or commercially available AI algorithms unless the agency explicitly consents, consistent with applicable law. The contract should make the boundary operational: identify the protected inputs and outputs, the allowed uses, and the agency consent required for any exception.
Address privacy and continuity
When personally identifiable information is involved, establish privacy processes and contractual terms that comply with applicable law and policy. Coordinate with the Senior Agency Official for Privacy from planning through requirements definition rather than treating privacy as a final review gate.
Plan for continuity and exit in the solicitation and contract. Address licensing and pricing, knowledge transfer, data and model portability, and access to components needed to operate and monitor the capability. These provisions can reduce dependence on one provider and help preserve the possibility of future competition.
Rank #4
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
What does a security review require before deployment?
An AI evaluation and an authorization to operate are different decisions. M-25-22 states that “any AI systems and services operated as an information system by or on behalf of an agency must receive an authorization to operate from an appropriate agency official prior to deployment.” Agencies must apply that requirement consistently with OMB Circular A-130 and applicable FISMA policies. A successful demonstration or procurement award does not substitute for the required authorization.
Security review should also consider software and service supply-chain risk. NIST’s 2024 Appendix F explains that federal agencies face cybersecurity risks through acquired, deployed, used, and managed software and services, including open-source components. It treats cybersecurity supply-chain risk management as relevant to federal acquisition and maintenance, so agencies should consider the components and services on which an AI capability depends.
NIST’s AI Risk Management Framework (AI RMF) is voluntary guidance, not a replacement for an agency’s applicable security authorization. NIST released AI RMF 1.0 on January 26, 2023, and says it is being revised. NIST published its Generative AI Profile, AI 600-1, on July 26, 2024. Agencies can use these resources to inform risk assessment and testing while separately meeting binding policy and authorization requirements.
What should oversight look like after award?
Contract oversight should continue after deployment. Monitor performance and emerging privacy, civil-rights, and civil-liberties risks, using contract terms that support recurring assessment. Periodic reviews may also compare effectiveness, efficiency, risk, and operating costs. This is why monitoring access, data protections, evaluation rights, and change visibility belong in the contract rather than being left to informal vendor assurances.
What recent federal oversight says—and does not say
In a 2026 review, GAO examined 13 AI acquisitions at the Department of Defense, Department of Homeland Security, General Services Administration, and Department of Veterans Affairs. The acquisitions included agency-directed and vendor-driven efforts, contracts and other agreements, and AI products and services. GAO analyzed 44 contracts and agreements supporting those 13 acquisitions.
GAO found that the selected agencies were not yet systematically collecting acquisition lessons learned; officials at GSA, DOD, DHS, and VA said their policies did not require such collection. GAO identified potentially reusable lessons, including data-rights contract terms and testing requirements. Because the 13 acquisitions were a nongeneralizable sample, these findings should not be treated as a conclusion about every federal agency.
| GAO-reported measure | Scope and period |
|---|---|
| 32 to 282 generative AI use cases | Among 11 selected agencies, from 2023 to 2024; GAO, 2025. |
| 571 to 1,110 total reported AI use cases | Selected agencies’ reported use cases, from 2023 to 2024; GAO said the total nearly doubled; GAO, 2025. |
| Ninefold increase in generative AI use | Federal agencies, from 2023 to 2024, as reported by GAO in 2025. |
| 44 contracts and agreements | Supporting the 13 acquisitions in GAO’s 2026 review. |
GAO also reported that selected agencies faced challenges complying with policy, securing technical resources and budget, keeping acceptable-use policies current, and responding to rapid technology change. The figures above describe GAO’s reported scopes; they do not establish an identical trend or readiness level for every agency.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
