The subcontracting partner federal primes actually want to call back.

M-25-21 (Accelerating Federal Use of AI) and M-25-22 (Driving Efficient Acquisition of AI) were issued April 3, 2025 and replaced the rescinded M-24-10 and M-24-18. M-25-21 governs how agencies use AI; M-25-22 governs how they buy it. Together they are the current binding guidance for federal AI programs.

Four obligations create work: designating and empowering a Chief AI Officer, publishing and maintaining a public AI use-case inventory, applying minimum risk-management practices to every high-impact AI use case, and writing Responsible AI evaluation criteria into solicitations and contracts. Each one requires documented artifacts an agency can defend, which is where subcontracted support gets bought.

Agencies had 60 days from April 3, 2025 to identify a Chief AI Officer, 180 days to publish an AI strategy, and 365 days to bring high-impact AI use cases into compliance with the minimum risk-management practices or stop using them. Use-case inventories are refreshed annually. Those recurring compliance and inventory cycles keep the demand live rather than one-time.

It pushes agencies toward performance-based acquisition for AI, requires vendor terms that protect government data and avoid vendor lock-in, and expects Responsible AI requirements to appear in the requirement documents themselves - not as an afterthought at award. Primes bidding AI work are increasingly evaluated on the governance package, not just the model.

AI whose output serves as a principal basis for decisions with a legal, material, safety, or rights-affecting consequence for the public. Those use cases carry the heaviest obligations: pre-deployment testing, AI impact assessment, ongoing monitoring, human oversight, and a documented determination. Getting the determination right is what keeps obligations right-sized.

We lead with program management and FAR/DFARS compliance, then apply AI governance inside that discipline. Deliverables are the artifacts a contracting officer can accept: high-impact AI determinations, use-case inventory support, risk-management plans mapped to the NIST AI RMF, model documentation, and human-oversight runbooks - sized so an agency carries only the controls that actually apply.