Skip to content

Large Language Model Procurement Requirements

Use this free template to write your agency's Large Language Model Procurement Requirements. It maps to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5, and it sits with the System and Services Acquisition (SA) family. This copy follows the High baseline with the High Value Asset (HVA) overlay from the Cybersecurity and Infrastructure Security Agency (CISA). It names 0 controls. It calls the agency that adopts it "the Organization", and it names each person by role and each tool by its function. It cites 6 federal sources.

Approved by: Chief Information Security Officer (CISO)

Download

Downloads need a free FedXchange account. Sign in, and the download starts.

Controls covered

    Every System and Services Acquisition (SA) template

    The text of the Large Language Model Procurement Requirements

    Approval #

    Role Name Signature
    Chief Information Security Officer (CISO)

    Revision History #

    Date Version Description Reviewer
    2026-10-31 1.0 Initial issuance [Reviewer name]

    Review cycle: Every year until the document retires on 2027-12-11, unless the Office of Management and Budget (OMB) extends M-26-04.

    Mandate. OMB issued M-26-04, Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles, on December 11, 2025. It requires each agency to:

    • Put contract requirements for the Unbiased AI Principles, truth-seeking and ideological neutrality, in every solicitation or order for a large language model.
    • Get enough information from the vendor to judge compliance.
    • Keep a process for users to report outputs that violate the principles.

    M-26-04 is the guidance that Executive Order (EO) 14319, Preventing Woke AI in the Federal Government (July 23, 2025), required. The order requires agency heads to buy only large language models (LLMs) built under the Unbiased AI Principles. It also requires these principles in each new LLM contract, along with a term that charges decommissioning costs to the vendor after a termination for noncompliance. Agencies must also revise existing LLM contracts where practicable (EO 14319, §4(b)).

    Agencies were to update their LLM procurement policies and procedures by March 11, 2026. The memorandum sunsets on December 11, 2027; this document is retired on that date unless OMB extends the requirement. It supplements the Super Intelligence (SI) Governance and Acquisition Policy (POL-AI-001). Executive Order 14434 (September 29, 2026) has agencies use Super Intelligence (SI) in place of the older term in policy documents, so this document does too; the titles of earlier orders and memoranda keep their published wording (EO 14434, § 2).

    1. Applicability #

    These requirements apply to every solicitation, order, or renewal by the Organization for a large language model. They apply whether the Organization buys the model as a stand-alone service, as a model behind an application, or as a capability in a commercial product it configures for its own use.

    2. Contract Requirements #

    Every covered solicitation and order includes terms under which the vendor’s large language model:

    1. Is truth-seeking: it prioritizes historical accuracy, scientific inquiry, and objectivity, and acknowledges uncertainty where the evidence is incomplete or contradictory.
    2. Is ideologically neutral: it does not manipulate responses in favor of ideological positions, and any intentional behavioral adjustment is disclosed to the organization.
    3. Comes with the documentation the Organization needs to judge compliance: model and system documentation, evaluation results, and disclosure of the system prompts and behavioral policies that shape outputs. The contract’s protective terms cover confidential material.
    4. Is subject to remedies when outputs violate the principles, including correction within an agreed time and, where correction is not achieved, termination. After a reasonable time to cure, the vendor pays the decommissioning costs of a termination for noncompliance (EO 14319, §4(b)(i)).
    5. Is not a DeepSeek model, and is not a third-party product or service built using a DeepSeek implementation. Staff must not buy one, and System Owners must remove any in use (FASCSA Exclusion and Removal Order 2026-01).

    The Contracting Officer adds these terms to existing LLM contracts where practicable, at the next modification, option, or renewal (EO 14319, §4(b)(ii)).

    Contracting officers and representatives insert these terms; the Chief Super Intelligence Officer (CSIO) and the CISO review the vendor’s documentation before award.

    3. User Reporting Process #

    Any user who believes an output violates the principles reports it through the organization’s SI reporting channel. The CSIO’s office reviews each report, records the finding in the use-case inventory entry, notifies the vendor where the contract requires, and reports patterns to the organization’s SI governance forum. Reports are tracked to closure.

    4. Records #

    For each covered procurement the acquisition file contains the clause language used, the vendor documentation relied on, and the compliance review record. The CSIO keeps a register of the user reports described above.

    5. Sunset #

    This document expires on December 11, 2027 with OMB M-26-04. Sixty days before that date the CSIO confirms whether OMB has extended or replaced the memorandum and either retires this document or reissues it under the successor authority.

    6. References #

    These are the sources this document cites, with a link to each official text.

    Sources on the governance tracker

    The FedXchange governance tracker follows each source this document cites and records each change to it.

    Change history

    1. : First published in the library. Template version 783d0494946e.