Answer capsule
Even outside government, the memo's focus on competition, interoperability, data, testing, and rights can sharpen vendor review.
What the source establishes
- M-25-22 addresses efficient acquisition of AI in U.S. agencies.
- It accompanies M-25-21 on adoption and governance.
- The memo addresses vendor and acquisition considerations rather than declaring products safe.
Separate service layers
Contract terms should identify the application, platform, model, hosting, and data providers involved so a change in one layer does not silently alter the service.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Protect portability
Export rights for prompts, configurations, evaluations, logs, indexes, and generated records matter as much as access to the underlying business data.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Preserve competitive options
A bundled discount can be rational, but the architecture decision should show switching costs, proprietary interfaces, and which capabilities can be replaced independently.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Write acceptance evidence
Use workload-specific accuracy, safety, security, latency, cost, support, and recovery criteria rather than accepting a generic enterprise feature list.
The accountable team should translate this point into a named workflow, affected population, source data, human owner, approval right, exception path, retained evidence, and review date. That translation is what separates an interesting AI development from a decision that can be governed and evaluated.
Decision test
Ask whether the source changes the decision itself, the evidence required, the implementation sequence, or only the language used to describe an existing capability. Record which claims are directly supported, which are provider statements, which require an independent test, and which remain unknown. A source-linked review should make uncertainty easier to see, not bury it inside a blended score.
Questions to take into review
- Which services are common and which remain workload-specific?
- How can a team change a model without rewriting the application?
- Are source permissions enforced at retrieval and answer time?
- How are stale or superseded documents handled?
- Which repositories and dependencies are exposed?
- What checks gate generated changes?
- What actions can the assistant execute?
- Which record remains authoritative for incident and change state?
The publication supports research and executive decision preparation. It does not provide legal, financial, accounting, employment, clinical, cybersecurity, investment, procurement, or implementation advice.