OMB issues M-24-18 on responsible acquisition of AI in government

OMB Memorandum M-24-18, Advancing the Responsible Acquisition of Artificial Intelligence in Government, is guidance the Office of Management and Budget released to federal agencies on September 24, 2024, the Office of Management and Budget (OMB) released. The memo set requirements for managing AI risk and performance, cross-functional and interagency collaboration, and competitive AI procurement, phased in from November 2024 through March 2025.

What it is

The memo focuses generally on agency use of AI, including generative AI and uses it classifies as rights-impacting or safety-impacting. The 36-page memo builds on OMB's March 2024 guidance governing federal agencies' use of AI, Memorandum M-24-10. It applies not just to Executive departments and agencies but also to independent regulatory agencies and government corporations. The memo does not apply to AI acquired by elements of the Intelligence Community or acquired for use as a component of a National Security System. More than seven months later, OMB rescinded and replaced M-24-18 with Memorandum M-25-22 on April 3, 2025.

What it requires

The guidance centers on three main principles: managing AI risk and performance, establishing cross-functional and interagency collaboration to reflect new AI responsibilities. Agencies had to identify any contracts associated with agency use of rights-impacting or safety-impacting AI by November 1, 2024. Existing and new contracts for rights-impacting and safety-impacting AI then had to comply with both M-24-10 and M-24-18 by December 1, 2024. Starting March 23, 2025, 180 days from the memo's issuance, the requirements applied to any new contract awarded under a solicitation issued after that date. Contractors were expected to identify and disclose to agencies serious AI incidents and malfunctions of the acquired AI system or service within 72 hours. For generative AI, agencies were told to ensure audio, image and video outputs not readily identifiable as AI-generated use some sort of mechanism, such as a watermark, to signify the AI-source of the media. The memo expressly excluded AI used incidentally by a contractor during performance of a contract, giving the example of a contractor's use of AI when not directed or required to fulfill requirements.

What security leaders should do

Security leaders working with agencies or selling into government should map any AI-enabled offering against the rights-impacting and safety-impacting categories early, since those labels trigger the incident-reporting, testing and transparency terms described above. Contract owners should build a 72-hour incident notification path into their internal processes now rather than waiting for a specific solicitation to require it, since that expectation is already visible in agency contract language. Teams should also inventory which of their AI-enabled products embed watermarking or provenance signals for generated audio, image or video, because agencies may ask for evidence of that capability during evaluation. Finally, given that OMB has already rescinded and replaced this memo once, security and compliance teams should track the successor OMB guidance for the current binding requirements rather than treating M-24-18 as the final word.