The Vendor's New AI Feature Ships Friday. The Authorizing Official Has Not Decided.

On April 3, 2025, the Office of Management and Budget issued memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government. It applies to contracts awarded under solicitations issued on or after the date 180 days after the memo was issued, which was September 30, 2025, and to options to renew or extend existing contracts exercised after that date.

The memo lists contract terms agencies must address, where applicable, for AI systems and services, including ongoing testing and monitoring, vendor performance requirements and new feature notification. On that last point, agencies should consider requiring vendors to notify relevant agency stakeholders "prior to the integration of new AI enhancements, features, or components," and agencies "should also ensure, prior to release, that compliance requirements will be followed."

It also restates a rule that already exists: any AI system operated as an information system by or on behalf of an agency "must receive an authorization to operate from an appropriate agency official prior to deployment."

Hypothetical: a federal benefits program's case management vendor sends notice that its next release, two weeks out, adds a feature that drafts summaries of applicant correspondence. The program office wants it. The Chief AI Officer's team needs to confirm whether the feature changes the use case's high-impact determination. Security needs to know whether the current authorization covers it.

The final call belongs to the Authorizing Official, whose review calendar is full through the end of the month. Release day comes. The feature either goes live without a recorded decision or gets switched off by default.

The file is ready. The person who can release it is not.

If the feature goes live, the agency runs an AI capability no one formally accepted. If it stays off, caseworkers keep writing summaries by hand. Either way, the next notice joins the same queue, and an auditor who asks who decided gets a list of emails.

The vendor's notice starts a decision packet the day it arrives: the feature description, the use case inventory entry, the earlier high-impact determination, test results on agency data, and the security impact summary. The Chief AI Officer's team adds its recommendation.

The Authorizing Official decides before release day: on, off, or on with limits. The decision, the date and the reason are recorded against the contract and the system, so the next notice starts from a precedent instead of a blank page.

WisdomTwin.ai is building a Judgment Platform for regulated enterprises. It is designed to give each named approver a role-specific judgment twin that prepares the decision packet the way that person reviews, with the evidence attached, so the decision moves faster and leaves an auditable record. It is designed to run on-premises or in your private cloud, and the named person still makes the call.

We don't replace judgment. We remove the wait.

Examples in this issue are hypothetical, and nothing here describes a customer result.

Book a 20-minute call: https://calendly.com/romanbodnarchuk/20min

Roman Bodnarchuk

Co-Founder and CEO, WisdomTwin.ai