AI Regulation Tracker / Federal policy

OMB's Federal AI Memos Are More Than a Year Old. Here Is What Agency Teams Actually Have to Operationalize Now

More than a year after OMB issued M-25-21 and M-25-22, the federal AI conversation has moved from governance to execution. Here is what agencies and the contractors who serve them must actually have in place, in plain operational terms.

By Anthony Guerriero · Reviewed by The Leveraged Years Editorial Desk · Published June 28, 2026 · Last updated June 28, 2026

OMB's Federal AI Memos Are More Than a Year Old. Here Is What Agency Teams Actually Have to Operationalize Now

The Leveraged Years AI Regulation Tracker

OMB's two federal AI memos, M-25-21 on use and M-25-22 on acquisition, issued April 3, 2025, are now more than a year into implementation. Agencies must name an accountable AI official, keep a current AI inventory, apply heightened practices to high-impact uses, and ask vendors for documentation at procurement; for contractors, those duties become the questions in the next solicitation. Primary source: OMB Memoranda M-25-21 and M-25-22.

Regulatory Briefing

Bindingness: Binding Policy (federal agencies and their contractors)
Scope: United States federal agencies, plus the vendors and contractors that sell AI to them / Sector: government, public-sector technology, procurement
What Changed: On April 3, 2025, the Office of Management and Budget issued two memoranda, M-25-21 on federal agency use of AI and M-25-22 on federal acquisition of AI. A year on, the work has shifted from writing governance language to operationalizing it: naming accountable officials, inventorying AI uses, applying risk practices to high-impact AI, and disciplining how agencies buy it.
Who This Affects: Agency executives and Chief AI Officers, federal program and procurement teams, and the government contractors and SaaS vendors whose AI products must now clear agency governance and acquisition requirements.
Current Status: In Force (policy in effect; implementation maturing)
Effective Date: Issued April 3, 2025; implementation ongoing through 2026
Primary Source: OMB Memoranda M-25-21 (Accelerating Federal Use of AI) and M-25-22 (Driving Efficient Acquisition of AI), via the White House Office of Management and Budget: https://www.whitehouse.gov/omb/information-regulatory-affairs/
Secondary Analysis: Brookings, "From governance to execution in federal AI policy" (June 2026): https://www.brookings.edu/articles/from-governance-to-execution-in-federal-ai-policy/
Workflow Impact: An agency can no longer treat AI as an unmanaged experiment. It needs a named accountable official, an inventory of where AI is used, heightened risk practices for high-impact uses that affect rights or safety, and a procurement process that asks vendors the right questions before purchase. For contractors, those agency duties become the questions in the next solicitation.
Operational Next Step: If you run an agency program, confirm who owns AI accountability, that your high-impact uses are inventoried and risk-assessed, and that your acquisition language asks vendors for documentation. If you sell to government, build the evidence package those questions will demand before the RFP arrives.
Last Verified: June 28, 2026

From writing policy to running it

More than a year ago the federal AI story was about language. On April 3, 2025, OMB issued two memoranda, M-25-21 on how agencies use AI and M-25-22 on how they buy it, and the immediate work was interpretation. What counts as high-impact AI. Who has to sign. What the inventory must contain. External analysts at Brookings characterize the shift this way: in a June 2026 analysis they describe the federal conversation as having moved "from governance to execution." The memos are no longer the news. Operationalizing them is.

That shift matters for two audiences who do not always talk to each other: the agency teams that have to comply, and the contractors whose products have to clear what the agencies now require.

What M-25-21 asks an agency to actually have

The use memo, M-25-21, is built to push agencies past pilots and into managed adoption. In practice it reduces to a few things an agency must be able to show.

It needs accountability with a name on it. The framework expects a senior official responsible for AI, not a diffuse committee. It needs an inventory, a real list of where AI is used across the agency, because you cannot govern what you have not counted. And it needs heightened practices for high-impact AI, the uses that affect people's rights, safety, or access to benefits. Those uses carry extra duties around testing, monitoring, and human oversight that a low-stakes back-office tool does not.

The point of the structure is to let agencies move faster on the low-risk majority while putting real controls on the consequential minority. An agency that cannot say which of its AI uses are high-impact has not done the first step.

What M-25-22 changes about buying AI

The acquisition memo, M-25-22, is the one contractors should read closely, because it turns governance expectations into purchasing requirements. It pushes agencies toward disciplined AI procurement: understanding what they are buying, asking vendors for documentation about performance and risk, avoiding lock-in, and protecting government data.

For a vendor, that means the sales conversation now includes the agency's governance checklist. The questions that used to come up after a problem now come up before the contract. Can you document how the model performs on the agency's use case? What data does it touch and where does it go? How does the agency keep oversight and avoid being trapped in your platform? The vendor who has those answers ready wins. The one who improvises loses time the procurement schedule does not have.

Why this is an execution problem, not a paperwork problem

The temptation, more than a year in, is to treat the memos as a documentation exercise: write the policy, file the inventory, move on. That misreads the moment. The reason external analysts describe this as an execution phase is that the hard part is operational, building the actual review steps, the monitoring, the procurement language, and the accountability that turn a written policy into a process that runs without heroics.

The agencies that are ahead did not write better memos. They built the workflow underneath: a clear owner, a living inventory, a triage that separates high-impact uses from routine ones, and acquisition language that does the governance work at the point of purchase. That is the difference between an agency that can adopt AI safely and one that keeps relearning the same lesson on each project.

The practical next move

For an agency program, the checklist is concrete. Confirm there is a named accountable official. Confirm the AI inventory exists and is current. Confirm your high-impact uses are identified and carry the extra risk practices. And confirm your acquisition templates ask vendors for the documentation the memos contemplate. For a contractor, the move is the mirror image: assemble the performance, data-handling, and oversight evidence the agency must now collect, so that when the solicitation arrives you are answering questions you already prepared for.

Frequently Asked Questions

What are OMB M-25-21 and M-25-22?

They are two memoranda OMB issued on April 3, 2025. M-25-21 governs how federal agencies use AI, pushing for accountable officials, AI inventories, and heightened practices for high-impact uses. M-25-22 governs how agencies acquire AI, pushing for disciplined procurement, vendor documentation, data protection, and avoiding lock-in.

Do the OMB memos affect government contractors?

Yes. M-25-22 turns agency governance expectations into procurement requirements, so vendors selling AI to the government should expect solicitations to ask for documentation on performance, data handling, oversight, and lock-in avoidance before a contract is awarded.

What is "high-impact" AI under M-25-21?

Broadly, AI uses that affect people's rights, safety, or access to benefits and services. These carry additional duties around testing, monitoring, and human oversight, distinct from low-stakes administrative tools, which is why agencies need to triage their inventory by impact.

A year later, what should agencies prioritize?

Execution, not paperwork. Name an accountable official, keep a current AI inventory, identify and properly govern high-impact uses, and build acquisition language that asks vendors the right questions at the point of purchase.