Memorandum 25-22 (Driving Efficient Acquisition of Artificial Intelligence in Government)

• Authority: Executive Office of the President
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. regulations, executive orders, and agency policies
• Most recent activity: Enacted
• Most recent activity date: 2025-04-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• AI system security vulnerabilities
• Competitive dynamics
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Overreliance and unsafe use

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8-10 subdomains, with strong focus on AI system security (2.2), competitive dynamics (6.4), governance failure (6.5), and system safety failures (7.3, 7.4). Coverage is concentrated in security, procurement governance, and AI system reliability domains. The document addresses risks related to vendor lock-in, system performance monitoring, and transparency requirements.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This document governs AI acquisition across all federal government operations, primarily regulating the Public Administration sector. It applies to all federal agencies acquiring AI systems or services, with specific exemptions for Intelligence Community elements and National Security Systems.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal memorandum from the Office of Management and Budget (OMB) with mandatory requirements for federal agencies, enforcement mechanisms through agency compliance obligations, and specific timelines for implementation.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Office of Management and Budget (OMB); Executive Office of the President
• Summary: The memorandum is issued by OMB under the authority of the Executive Office of the President, implementing requirements from the Advancing American AI Act and Executive Order 14179.

Target

• Entity Types: AI_Governance_Actor, AI_Deployer
• Entities: Federal agencies as defined in 44 U.S.C. § 3502(1); Chief Financial Officers Act (CFO Act) agencies as identified in 31 U.S.C. § 901(b); AI vendors and contractors
• Summary: The memorandum applies to all federal agencies acquiring AI systems or services, with specific requirements for CFO Act agencies. It also regulates AI vendors through contractual requirements.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Office of Management and Budget (OMB); General Services Administration (GSA); Chief AI Officer Council; Senior Agency Officials for Privacy
• Summary: OMB has oversight authority, GSA develops implementation guidance and repositories, the Chief AI Officer Council reviews agency processes, and Senior Agency Officials for Privacy ensure privacy compliance.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Chief AI Officer Council; Office of Management and Budget (OMB); General Services Administration (GSA); individual agency officials
• Summary: The Chief AI Officer Council periodically reviews agency processes, GSA coordinates information sharing, and agencies must perform ongoing monitoring of AI system performance and compliance.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all AI lifecycle stages from planning through operational monitoring, with particularly detailed guidance on deployment and ongoing monitoring. It addresses the complete acquisition lifecycle including requirements identification, market research, solicitation, selection, contract administration, and closeout.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly mentions AI systems and AI models throughout, with detailed definitions of covered AI. It does not specifically mention frontier AI, general purpose AI, foundation models, generative AI, predictive AI, or compute thresholds. It addresses open-weight models implicitly through IP rights discussions but does not use that terminology.