OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust

What it is

OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, was issued by the Director of the Office of Management and Budget on 3 April 2025 under Executive Order 14179. It sets the policy for how US federal executive agencies adopt and govern AI. It rescinded and replaced M-24-10, the previous administration’s memo of March 2024.

A companion memo, M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government, issued the same day, covers how agencies buy AI. Together they are the closest thing the US has to a binding AI governance framework, but only for the federal government.

Who it applies to

M-25-21 applies to executive branch agencies as defined in the Paperwork Reduction Act, and to new and existing AI developed, used or acquired by or on behalf of those agencies. It does not cover AI in national security systems. Elements of the Intelligence Community are encouraged, but not required, to apply the high-impact practices.

The memo uses the statutory definition of AI from the FY2019 National Defense Authorization Act and reads it broadly. It includes machine learning, reinforcement learning, transfer learning and generative AI, and no system is too simple to count because it has few parameters. Robotic process automation and systems driven only by human-defined rules are excluded.

Private organisations are affected as suppliers. Under M-25-22, contracts for high-impact AI must let the agency meet the minimum practices, and agencies ask vendors for the documentation, test results and data information they need.

What it requires

Governance roles. Each agency designates a Chief AI Officer within 60 days, and agencies covered by the CFO Act convene an AI Governance Board chaired at Deputy Secretary level within 90 days. A Chief AI Officer Council coordinates across government.

Strategy, policy and inventory. CFO Act agencies publish an AI strategy within 180 days. Every agency publishes a compliance plan within 180 days and every two years after, updates its internal IT, data, cybersecurity and privacy policies within 270 days, and should develop a generative AI policy in the same period. Each agency maintains an annual AI use case inventory.

High-impact AI. AI is high-impact when its output serves as a principal basis for a decision or action with a legal, material, binding or significant effect on rights or safety, whether or not a human is in the loop. Section 6 lists purposes presumed to be high-impact, including safety-critical infrastructure, medical diagnosis and treatment, law enforcement risk assessments and biometric identification, immigration risk assessments, eligibility for federal benefits and loans, and federal employment decisions.

Seven minimum practices. For every high-impact use, an agency must do the following.

1. conduct pre-deployment testing that reflects real-world outcomes, using alternative methods such as querying the service if it lacks access to the code, model or data
2. complete an AI impact assessment before deployment covering purpose and expected benefit, data quality and fitness, impacts on privacy, civil rights and civil liberties, reassessment scheduling, costs, an independent review within the agency, and signed risk acceptance
3. conduct ongoing monitoring for performance and adverse impacts, designed to detect changes after deployment
4. train and assess the operators who interpret and act on the AI’s output
5. provide human oversight, intervention and accountability suited to the use, with a fail-safe where practicable
6. offer timely human review and a chance to appeal for people affected by AI-enabled decisions
7. consult and incorporate feedback from end users and the public

Termination and waivers. If a high-impact use does not meet the minimum practices, the agency must safely discontinue it. A Chief AI Officer can waive specific practices for a system after a written, system-specific risk assessment, must recertify waivers annually and report them to OMB within 30 days, and the agency publishes a summary of each determination and waiver.

Key dates

• 3 April 2025. M-25-21 and M-25-22 issued.
• 60, 90, 180 and 270 days. Chief AI Officers, governance boards, AI strategies and policy updates fall due in sequence through 2025.
• 30 September 2025. AI strategies and compliance plans fall due, and M-25-22 applies to contracts awarded from solicitations issued on or after this date.
• 3 April 2026. Agencies must have documented the minimum practices for every high-impact use, or discontinued it.

How it relates to other frameworks

M-25-21 does not mandate the NIST AI RMF, but its minimum practices map closely onto the RMF’s Map, Measure and Manage functions, and agencies commonly use NIST material to structure the work. Its AI impact assessment covers much of what ISO/IEC 42005 describes. The nearest foreign equivalent is Canada’s Directive on Automated Decision-Making, which also binds federal institutions but scores impact on a four-level scale rather than using a single high-impact category.

The memo binds only the federal government. State and local governments have their own policies, and private organisations deal with the state laws listed on the United States page. Vendors selling AI to agencies should expect to support the impact assessment, testing and monitoring practices of each high-impact use they supply.