What the federal government's AI rules mean for companies bidding to it
OMB's 2025 memos M-25-21 and M-25-22 changed how agencies buy and use AI. What a contractor should expect in solicitations, and in its own proposals.
Artificial intelligence reaches a government contractor from two directions at once. Agencies are buying AI, which creates new requirements to bid on. And agencies are setting rules for AI that shows up inside the work they buy, which changes what a contractor has to disclose and prove even when the contract is not "an AI contract."
The rules that govern both arrived in April 2025, in two memoranda from the Office of Management and Budget. They replaced the 2024 guidance and followed Executive Order 14179. Here is what they say, in the terms that matter to a bidder.
The two memos, in one paragraph each
M-25-21, "Accelerating Federal Use of AI through Innovation, Governance, and Public Trust," is about how agencies use AI. It requires each agency to have a Chief AI Officer, to publish an AI strategy, and to apply minimum risk-management practices to high-impact AI: systems whose outputs materially affect people's rights, access to services, safety, or sensitive federal resources. Those practices include testing before deployment, human oversight, and a way to take feedback and correct course.
M-25-22, "Driving Efficient Acquisition of Artificial Intelligence in Government," is about how agencies buy AI. It asks agencies to favor a competitive American AI marketplace, to protect government data and intellectual property in AI contracts, to track AI performance and manage risk over the life of a contract, and to decide what disclosures they need when a contractor uses AI to perform the work. It applies to solicitations issued 180 days after the memo, which means it has been shaping new solicitations since late 2025.
What changes in the solicitations you read
Expect AI to show up in places it did not before:
- Disclosure of AI use. A solicitation may ask whether you will use AI to perform the contract, where, and with what controls. "AI" here can include tools your staff use, not only a product you deliver.
- Data rights and data use. Clauses about whether government data may be used to train or improve a vendor's models, and who owns what a model produces. Read these closely; they can conflict with a vendor's standard terms.
- Performance and monitoring. For an AI system, expect requirements to report performance over time, not only at acceptance, and to support the agency's own testing.
- High-impact use cases. If the system you propose could fall into the high-impact category, expect questions about testing, human review and how an affected person can contest an outcome.
- Avoiding lock-in. The acquisition memo emphasizes portability and interoperability. A proposal that depends on proprietary formats or one-way data flows invites a weaker score.
What changes in your own proposal
Even on a contract with no AI in the requirement, many proposal teams now use AI to read solicitations and draft responses. That is allowed, and it is worth doing well. Three habits protect you:
- Answer disclosure questions precisely. If a solicitation asks how AI will be used in performance, say what it does, who reviews its output, and what data it touches. A vague answer reads as either evasion or a lack of control.
- Keep controlled information out of tools that are not authorized for it. Controlled Unclassified Information and export-controlled data carry handling rules regardless of how convenient a tool is. Know where each tool sends your data and whether it trains on it.
- Never let a tool make a claim for you. A drafted certification, a past-performance figure or a staffing commitment is still your representation to the government. Every one needs a person who checked it against a source.
Where AI requirements create opportunity
The memos are, on balance, an instruction to adopt AI faster and more carefully. That creates demand for a few kinds of work that did not exist at this scale a few years ago:
- Evaluation and testing of AI systems before and after deployment.
- Data preparation and governance so agency data can be used safely.
- Integration of commercial AI into existing systems, with the monitoring the memos require.
- Training and change management for the workforce using the tools.
Many of these requirements are new, which means they have no incumbent. For a company with relevant experience, a new requirement without an incumbent is one of the best competitive positions in the federal market.
A caution about pace
Agency implementation is uneven. Some agencies have published strategies and updated their acquisition procedures; others are still catching up, and the broader FAR rewrite under Executive Order 14275 is changing the surrounding rules at the same time. Read each solicitation's own clauses rather than assuming last quarter's language from another agency applies.
The short version
Agencies now have written rules for using and buying AI: governance and human oversight for high-impact uses, and acquisition terms covering data, performance and disclosure. Expect those questions in solicitations, answer them precisely, keep controlled data where it belongs, and treat every AI-drafted claim as yours to verify. Look for the new requirements the rules create; many have no incumbent yet.