On 3 October 2024 the US Office of Management and Budget issued Memorandum M-24-18, “Advancing the Responsible Acquisition of Artificial Intelligence in Government”. The memo tells federal agencies how to buy AI, and in doing so it sets the terms on which AI vendors can sell to the largest single purchaser of technology in the United States.
Procurement as regulation
Government procurement is often the most effective form of technology regulation, because it operates through contract rather than statute. M-24-18 requires agencies to manage risk, performance and market competition when acquiring AI, which translates into contractual obligations: testing and evaluation before award, monitoring during performance, documentation of limitations, and protections against lock-in. A vendor that cannot answer those requirements is not disqualified in principle, but it will lose on the paperwork.
The memo also asks agencies to consider the effect of their buying behaviour on the wider market. Concentrating spend on a small number of very large suppliers is easy to justify on capability grounds but hard to justify on competition grounds, and the memo pushes agencies to weigh both.
Beyond the immediate requirements, the memo sits within a broader architecture. The direction of travel is captured in our notes on the US AI leadership executive order and on EO 14365 and the national AI policy framework, while the growth and adoption agenda appears in the US AI Action Plan. For the most advanced models, review obligations are described in our note on the US AI model review executive order.
Why it reaches beyond federal contractors
Procurement conditions travel. State and local governments, universities and regulated entities commonly adopt federal templates, and enterprise buyers frequently copy them into commercial contracts. Enforcement posture in adjacent areas reinforces the point: the FTC’s use of the CLEO AI enforcement approach shows that overstated AI capability claims carry legal consequences independent of procurement.
Practical preparation
Vendors selling into this market should build an evidence pack that maps to procurement expectations: model documentation, evaluation results, known limitations, incident handling and a data-flow description. Two drafting points are worth attention in commercial contracts — accuracy representations should be limited to what has actually been tested, and the customer’s right to audit should be scoped to defined records rather than open-ended access.
This article is based on US Office of Management and Budget Memorandum M-24-18 and public information and is for reference only; it does not constitute legal advice.