Under M-23-16, a free pilot or demo of a product that is otherwise sold stayed in scope for attestation. The exemption covered proprietary software that is freely obtained and publicly available, such as a browser. M-26-05 has since rescinded the memo, so check what your agency customer expects now.
What M-23-16 said
M-23-16 clarified scope for "Freely Obtained and Publicly Available Proprietary Software." Agencies were not required to collect attestations for products that are proprietary but freely obtained and publicly available. The memo gave the reason: users of such software, for example web browsers, have no opportunity to negotiate with the producer, so getting an attestation is not feasible. Agencies were still required "to assess the risk in utilizing such software and take appropriate steps to minimize or eliminate identified risks."
Then it added the limit: "Though freely obtained, demonstrations or pilots of software products that are otherwise unavailable on a no-cost basis remain subject to M-22-18 attestation requirements, as amended."
Applying it
| Situation | In scope under M-23-16? | Reasoning |
|---|---|---|
| A no-cost product anyone can download | No | Freely obtained and publicly available |
| A paid product offered as a free trial to an agency team | Yes | Demonstration or pilot of a product otherwise unavailable at no cost |
| A pilot under a signed agreement with the agency | Yes | Same reasoning |
| An open source project the agency downloads directly | No | The form lists freely and directly obtained open source as out of scope |
The key test is whether the product is otherwise unavailable on a no-cost basis. Free does not equal exempt.
Why sales teams get caught out
Trials move fast. A team at an agency starts a pilot with a vendor login, nobody involves procurement, and months later the pilot is in daily use. If the attestation question arrives only when a purchase is under way, the vendor has the form to prepare while the buyer waits.
A better habit is to ask at pilot kickoff: "Will this go on an agency network, and does the agency expect an attestation for pilots?" Then you can prepare the form in parallel.
What to do now
M-26-05 rescinded M-22-18 and M-23-16 in January 2026, and says agencies may choose to use the form. The pilot rule above is history, but it shows the logic agencies used and may still use:
- Ask the agency contact whether a pilot triggers any assurance step in their process.
- Keep your attestation, if you have one, ready to share.
- For short pilots without one, offer a plain description of your practices in the four areas of the form and say clearly that it is not an attestation.
- Document what data the pilot touches. A pilot with live agency data is a different risk from a pilot with sample data.
Quick check
Is a proof of concept the same as a pilot?
The memo used the words demonstrations or pilots. A proof of concept of an otherwise paid product falls in the same spirit, but the agency decides how it applies.
Does free software from us ever need an attestation?
If it is freely obtained and publicly available, M-23-16 put it out of scope. Agencies still had to assess the risk themselves.
Sources
Last reviewed: 19 October 2026.
