Within 270 days of 3 April 2025 agencies revisit and update their internal acquisition procedures so that AI acquisitions comply with M-25-22 and acquired AI will conform to M-25-21, at minimum enabling relevant officials to review each planned acquisition that involves AI and give feedback on performance and risk management, to convene a cross-functional team (acquisition and competition, IT, cybersecurity, privacy, civil rights and liberties, budget, data, legal, evaluation) in the acquisition's coordination and decisions, and to use appropriate contract terms for intellectual property rights.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.