During evaluation the agency tests proposed solutions as far as practicable, considering a testing environment on agency networks, and reassesses proposals for new AI risks and M-25-21 compliance challenges before selection. Contracts for AI systems and services must address IP rights and government data use, privacy, vendor lock-in protections (knowledge transfer, portability, rights to code and models produced under the contract, licensing and pricing transparency), compliance with the M-25-21 minimum practices for high-impact uses, and ongoing testing and monitoring: the agency can regularly evaluate performance, risks and effectiveness using agency-defined validation data kept from the vendor, the vendor provides the access and time for independent evaluation (or runs closely monitored, reproducible testing), and the contract details the vendor's testing procedures and does not bar internal disclosure of them; agencies are encouraged to require vendor performance monitoring, version performance gates and rollback, and notification before new AI features are integrated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.