Federal Guidelines for the Responsible Acquisition of AI

The Office of Management and Budget (“OMB”) recently issued a memorandum outlining new requirements for the responsible procurement of artificial intelligence (“AI”) capabilities by federal agencies. While the OMB’s guidance is intended for federal agencies, local governments and agencies can enhance the responsible procurement and use of AI in their operations by adopting similar vendor oversight and contracting provisions. As vendors of AI systems begin aligning their offerings with the new OMB standards, local agencies are likely to encounter AI products designed to meet these new guidelines. This provides an ideal opportunity for local agencies to begin reviewing and adjusting their procurement practices to align with best practices for responsible AI integration.

What is Artificial Intelligence?

OMB generally defines AI as systems that can perform tasks, solve problems, or make decisions based on data without significant human oversight. As they accumulate data, these systems can improve their performance over time. Whether developed in software or hardware, AI can learn from data sets and adapt to new situations in a human-like manner. An “AI system” is defined as any data system, software, application, tool, or utility that uses machine learning algorithms or other forms of artificial intelligence. AI can be either a system’s primary function or an integrated component of a larger system or process.

OMB provides additional safeguards for generative AI, which is defined as AI that emulates “the structure and characteristics of input data in order to generate derived synthetic content.” OMB excludes from the definition “any common commercial product within which artificial intelligence is embedded, such as a word processor or map navigation system.”

Strategies for Mitigating AI Risks in Local Agency Operations

Local agencies can draw valuable insights from OMB’s recommended practices to manage risks—such as privacy, data security, and civil rights—when acquiring AI systems. Key practices from OMB’s memo include:

Establish Whether AI Will be Acquired: Clear communication is needed to inform potential vendors about AI rules and needs, and from vendors as they notify purchasing agencies about existing or new AI uses. Local agencies can benefit from engaging with vendors early on in the procurement process to ask detailed questions about how AI models process, store, and use data.
Establish Contractual Obligations and Monitor AI Performance Post-Acquisition: OMB guidance emphasizes the danger of inaccurate or biased outputs impacting the public’s rights, safety, privacy or civil rights. To address these risks, agencies should include contractual provisions requiring vendors to identify risks and mitigation strategies, update the agency on changes or new features or development techniques, and report incidents. Contracts should incorporate transparency requirements to ensure agencies can monitor performance; delineate responsibilities for testing and monitoring; and establish criteria for risk mitigation and performance improvement. The OMB guidance addresses specific concerns with AI-based biometrics and AI training data that can produce unlawful discrimination.
Special Concerns with Generative AI: The OMB guidance requires maximum disclosure when generative AI outputs are not ready distinguishable from reality; active mitigation of inappropriate, harmful or illegal output; on-going evaluation, testing and red-teaming with results that can be shared publicly as much as possible; and mitigation of environmental impacts. OMB urges agencies to ensure that the product is the best fit for the agency’s mission.
Intellectual Property Rights and Data Ownership in AI Contracts: Agencies can define intellectual property rights in AI contracts to preserve ownership and use of their data. Contracts can prohibit vendors from using agency data to train their AI systems without explicit consent and from using the data or outputs for public or commercial AI algorithms.

Applying OMB Principles for Responsible Acquisition of AI

Local governments can draw from the OMB’s guidance to establish effective AI acquisition strategies that focus on risk management and performance oversight. Notable practices include:

Formalize Cross-Department Review Processes: The OMB guidance strongly emphasizes the importance of collaboration between key departments—such as IT, procurement, and legal—before, during and after AI system acquisition to establish needs, monitor performance and ensure compliance with AI-specific procurement rules.
Document and Share Resources: The OMB guidance requires federal agencies to document uses of AI and share information such as best practices and templates to enhance knowledge throughout the government.
Promote Competition: The new guidance places a high priority on acquisition and contractual requirements that prevent vendor lock-in and promote interoperability. OMB requires agencies, where relevant and practicable, to ensure vendors train agency staff; ensure data and model portability; provide agencies with rights to code, data and models produced pursuant to the contract; and transparent licensing terms. OMB urges the selection of firms that offer pricing transparency across the product’s lifecycle; the ability to disclose pricing to other federal agencies; and pricing that is not dependent on tying, minimum spending or other anti-competitive terms.

Conclusion

The new OMB guidance builds on a prior memo and executive order, with the goal of developing a comprehensive scheme to evaluate and use AI in compliance with applicable law and in a manner that promotes data security, privacy and competition. Local governments can benefit by reviewing and emulating, where appropriate, the federal model. Local agencies should review and update their procurement and risk management practices accordingly to ensure responsible and compliant AI integration.

White House Memo Summarizing OMB AI Guidance.

OMB AI Guidance.

For more information, contact Tim Lay, Cheryl Leanza or Andrew Fausto.

Disclaimer: BBK Legal Alerts are not intended as legal advice. Additional facts, facts specific to your situation, or future developments may affect subjects contained herein. Seek the advice of an attorney before acting or relying upon any information herein.