What OMB M-26-10 Actually Requires, and Why Most Agencies Aren’t Ready

Here is a question worth sitting with: if your agency experienced its largest cloud and AI usage event of the year this month, a major service launch, a filing deadline, a policy announcement that drove ten times normal traffic, could you produce a bureau-level cost attribution report, reconciled against current appropriations, before your next OMB submission is due?

If the answer is no, or if it would take weeks of manual work to get there, that is exactly the gap OMB M-26-10 is designed to surface.

Issued on March 31, 2026 by OMB Director Russell Vought, M-26-10 is not a surprise audit exercise. It is OMB’s formal acknowledgment that the federal government has built decades of procurement infrastructure with almost no consumption intelligence to go alongside it. Agencies know what they contracted for. Most have very little reliable visibility into what they are actually using, what it is costing by bureau and program, and whether they are getting defensible value from it.

M-26-10 is the first formal mandate to close that gap.

What the mandate actually requires

M-26-10 has two operative sections, and it helps to understand them separately.

Section 1 requires all 24 CFO Act civilian agencies to report IT contracts to OMB monthly, beginning May 2026. The top-level CIO signs off on every submission. This is a named, personal reporting obligation, not something that can be quietly delegated. Six monthly reports are due through October 2026, with the possibility of extension.

Section 2 is broader and more permanent. Effective immediately, agencies must collect utilization rates and pricing data from all current IT vendors (hardware, software, services, and resellers), compile it in machine-readable, open-standard formats, and share it with OMB and GSA on demand. This is not a one-time data call. It is a structural change to how agencies manage IT acquisition data going forward.

Together, the two sections create a compliance challenge that is less about reporting and more about infrastructure. Most agencies do not have a centralized system that ties IT service consumption to cost centers, normalizes data across vendors, and produces machine-readable outputs on a monthly cycle. Building that capability is what M-26-10 is actually asking for.