Latest OMB Memo Highlights AI Acquisition

Stakeholders in the federal AI procurement space have been anticipating the release of OMB’s latest memo, Advancing the Responsible Acquisition of Artificial Intelligence in Government (M-24-18). The memo fulfills requirements from both the AI executive order and OMB Memorandum M-24-10.

The purpose of the memo, “…helps agencies harness the power of AI through their acquisitions process to promote innovation and competition while managing risks,” according to the associated fact sheet from the White House.

The memo comes at a time of growth in the federal AI space. Deltek’s analysis of FY 2021-2023 contractual transactions identified a $4.6B market in AI-related obligations in the three-year period. Agencies increased spending by 31% from FY 2021 to 2023. Note: for detailed analysis of federal AI spending and forecasts, refer to Deltek’s Federal Artificial Intelligence (AI) Market, 2024-2028 report.

Source: Deltek, FPDS

Below is a summary of the acquisition guidelines for AI systems from the OMB memo based on three main components in federal AI acquisition. The memo defines an AI system as, “data systems, software, applications, tools, or utilities “established primarily for the purpose of researching, developing, or implementing artificial intelligence technology,” as well as data systems, software, applications, tools, or utilities where an AI capability “is integrated into another system or agency business process, operational activity, or technology system.” The term excludes, however, “any common commercial product within which artificial intelligence is embedded, such as a word processor or map navigation system.”

Ensuring Cross-functional and Interagency Collaboration.

• Update or establish policies and procedures on internal agency collaboration to ensure appropriate controls are in place with the acquisition of an AI system or service
• Establish a plan on how the CAIO will coordinate with agency officials on AI acquisitions
• Require the CAIO Council to identify information from AI acquisitions such as lessons learned, templates and best practices, to share with all executive branch agencies
• Establish a federal cross council working group to examine cross-functional issues that arise in AI procurement

Contractor Implications:

Collaboration on AI acquisition across the government sector and at an interagency level will lead to may best practices and lessons learned to improve this new sector of federal procurement. The hopeful result for vendors is revised, defined and successful contractual requirements for AI acquisitions. The collaboration will also prioritize AI acquisitions within across agencies, though the cross-communication could also reduce duplication in such procurements as well.

Managing AI Risks and Performance.

• Prioritize privacy, security, data ownership and interoperability in AI acquisitions
• Ensure compliance of risk management requirements in OMB Memo M-24-10
• Communicate to vendors if acquired AI system or service will be rights- or safety-impacting
• Consider requirements language asking vendors to report on the proposed use of AI as part of proposal submissions for solicitation that do not explicitly ask for an AI system
• Require contractors to provide notification to agency customers prior to integration of new AI features or components into systems and services under a contract
• Communicate with vendors when AI is the primary feature or component in an acquired system or service
• Ensure involvement of the Senior Agency Official for Privacy throughout the AI acquisition lifecycle
• Ensure AI-based biometrics protect public rights, safety and privacy and ensure compliance with civil rights laws to avoid unlawful bias
• Leverage performance-based acquisition approaches and techniques (i.e. statements of objectives, quality assurance surveillance plans, contract incentives)
• Ensure performance of AI justifies use
• Include appropriate contractual terms regarding ownership and intellectual property rights of government and contractor
• Explicitly address how a vendor will ensure compliance with relevant data management policies (i.e. identify tiered levels of access to data) within the terms of contracts
• Ensure compliance related to cybersecurity and data security, including requesting training logs from contractors of data activities during training sessions for models, agency investments in infrastructure to evaluate software controls, detailed documentation of training procedure used for the model, and contract requirements language on expectations of models
• Leverage budgeting and financial planning to estimate costs for operation and maintenance of AI systems
• Ensure practices for managing risk and performance of rights- and safety-impacting AI
  • Disclose in solicitations if planned use is rights- or safety-impacting
  • Ensure vendors comply with transparency requirements to monitor performance
  • Institute ongoing testing, monitoring and build evaluations into vendor contract performance
  • Include contractual terms and criteria for risk mitigation and performance improvement
  • Require AI incident reporting
• Incorporate practices for generative AI including requiring transparency of risk for generated content, mitigating inappropriate use, mitigating harmful and illegal output, and conducting evaluation, testing and red-teaming on enterprise generative AI, and mitigating environmental impacts

Contractor Implications:

As expected, the new memo outlines additional compliance requirements which contractors must adhere to prior, during and even after, the acquisition of AI solutions and services. Some sources predict that the memo serve as a foundation for future changes to Federal Acquisition Regulation (FAR). Contractors can expect to commit additional time and resources to thoroughly define their AI systems and services in proposal submissions, particularly as it pertains to risk, ownership rights and performance metrics.

Promoting a Competitive AI Market with Innovative Acquisition

• Minimize vendor lock-in and potential switching costs in contractual requirements language
• Prioritize vendor practices of interoperability, transparency and public access
• Leverage innovative acquisition practices (i.e. acquisition innovation coaches, reverse industry days, oral presentations, challenge-based prize competitions, on-ramps)

Contractor Implications:

The paves the way for additional innovative procurement approaches, helping to remove barriers to small business and new entrants in the AI market space. Appendix I in the OMB document provides detail and suggestions to the different avenues to acquire AI systems and services. Methodologies such as OTAs and SBIR/STTR awards will see growth. Deltek analysis of OTA and SBIR/STTR transactions in FY 2021-2023 saw peaks of growth in AI-related OTAs and SBIRs/STTRs in the three-year period across both the Defense and Civilian agency sectors. Again, see additional details in Deltek’s Federal Artificial Intelligence (AI) Market, 2024-2028 report.

Agencies are directed to implement components of the OMB memo no later than 180 days after issuance (March 2025). If an existing contract is rights- or safety-impacting, agencies must bring those AI contracts into compliance no later than December 1, 2024.