Apply minimum risk-management practices to high-impact AI

Practical action

Vendors should prepare test evidence and documentation that agencies can reuse in impact assessments.

Who does it apply to?

Federal agencies using high-impact AI; indirectly their vendors.

Actors

Public authority / government body

Sectors

Public services and government

Use cases

AI in public servicesGovernment procurement of AI

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• supportsTechnical measureQuality or testing lead · at launch and on material change
  Accuracy, robustness, fairness and security testing

  Serves 15 recorded duties · evidence: Pre-release test report, Test plan and acceptance criteria, Release test sign-off

  Pre-deployment test evidence agencies can reuse.

• supportsProcessAI system owner · once per ai system
  Human oversight design and override procedure

  Serves 12 recorded duties · evidence: Human oversight and override procedure, Human-involvement design rationale, Overseer training completion

  Human oversight and operator arrangements.

• supportsProcessAI system owner · once per ai system
  AI impact and fundamental-rights impact assessment

  Serves 11 recorded duties · evidence: AI impact assessment, Impact assessment approval, Impact assessment procedure and template

  AI impact assessment content.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• AI Risk Register (MIT AI Risk Repository taxonomy)

  Register · XLSX · v4

• AI Impact Assessment

  Assessment · DOCX and XLSX · v5

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v3

• AI Audit Evidence Tracker

  Register · XLSX · v1

All 5 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every United States duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Apply minimum risk-management practices to high-impact AI (OMB M-25-21)” [AIPT-OBL-0116, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0116 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0116: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: M-25-21 Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, Office of Management and Budget, https://www.whitehouse.gov/omb/information-for-agencies/memoranda/.

@misc{aipolicytracker2026_applyminimumriskmanageme,
  author       = {{AIPolicyTracker}},
  title        = {{Apply minimum risk-management practices to high-impact AI (OMB M-25-21)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices}},
  url          = {https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Operators of high-impact AI must establish and operate a risk management plan — AI Basic Act, South Korea
• Developers must use reasonable care to avoid algorithmic discrimination — Colorado AI Act, Colorado (United States)
• Deployers must use reasonable care to avoid algorithmic discrimination — Colorado AI Act, Colorado (United States)
• Establish a risk management system for high-risk AI — EU AI Act, European Union
• Deployers must implement a risk management policy and programme — Colorado AI Act, Colorado (United States)
• Ensure AI systems are safe, secure and robust throughout their lifecycle — UK AI regulation framework, United Kingdom (voluntary)
• Prioritise, respond to and monitor AI risks (Manage) — NIST AI RMF, United States (voluntary)