Beyond M-24-18: Navigating the M-25-22 Efficiency Mandates for Federal AI

The New Era of AI Acquisition Efficiency

In April 2025, the Office of Management and Budget (OMB) issued Memorandum M-25-22, which officially rescinded and replaced the widely cited M-24-18. For federal contractors, this represents a pivot from 'responsible exploration' to 'efficient execution.' The new guidance demands that agencies prioritize speed and interoperability, moving away from siloed, proprietary AI implementations that create vendor lock-in.

Key Shifts in M-25-22 for Contractors

Practitioners must understand that M-25-22 places a heavy emphasis on 'vendor-agnostic' and 'model-agnostic' requirements. Agencies are now directed to describe their needs in ways that allow them to quickly switch between models as technology advances.

For capture and proposal managers, this changes the win theme strategy:

• Interoperability as a Core Requirement: Proposals must demonstrate how an AI solution can integrate with other agency systems without 'egress fees' or proprietary data formats. The memo specifically targets the elimination of fees that charge users for taking their data away from a service.
• Data Rights and Portability: Under the new guidance, agencies are encouraged to secure broad data rights. Contractors should be prepared to address DFARS 252.227-7013 and similar clauses with a focus on how agency-trained models can be transitioned to a different host if necessary.
• Performance Testing for Bias: M-25-22 reinforces the requirement for vendors to provide results of performance testing for algorithmic discrimination. This is no longer a 'nice to have' but a prerequisite for safety-impacting and rights-impacting AI systems.

FedRAMP and AI Security

Security remains the bedrock of federal AI. All AI cloud services must be FedRAMP-authorized or actively pursuing authorization. The GSA Buy AI portal emphasizes that AI services should leverage existing Authorities to Operate (ATOs) to maximize cost savings. Contractors offering Generative AI (GenAI) must be particularly transparent about 'data leakage' risks—specifically how agency data is used (or not used) to train the vendor’s base models.

Actionable Steps for BD Executives

1. Audit Your AI Stack: Ensure your solution does not rely on proprietary 'black box' components that violate the model-agnostic mandates of M-25-22.
2. Update Pricing Models: Account for the 'ongoing cost management' requirements in the memo, which require agencies to estimate the total lifecycle costs, including post-award oversight and corrective actions.
3. Leverage Tech Sprints: The memo encourages agencies to use 'tech sprints' and 'challenge-based competitions' to test capabilities before purchase. Position your firm to participate in these rapid-prototyping events rather than waiting for a traditional RFP.