# Apply minimum risk-management practices to high-impact AI

- **Record type**: Obligation
- **Instrument**: OMB Memorandum M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust
- **Jurisdiction**: United States
- **Category**: risk_management
- **Binding**: Yes
- **Provision**: Section 4

## In brief

Apply minimum risk-management practices to high-impact AI is a legal requirement under the OMB M-25-21 in the United States (Section 4). The record carries 2 evidence examples and mappings to 1 framework. In practice: Vendors should prepare test evidence and documentation that agencies can reuse in impact assessments.

## What the duty requires

For AI whose output serves as a principal basis for decisions with significant effects on rights, safety or access to services, agencies must complete pre-deployment testing, an AI impact assessment, ongoing monitoring, operator training, human oversight and a mechanism for affected people to seek remedy, or stop using the AI.

## What an organisation does about it

Vendors should prepare test evidence and documentation that agencies can reuse in impact assessments.

## Controls that meet this duty

- Accuracy, robustness, fairness and security testing (supports): https://aipolicytracker.org/controls/accuracy-robustness-security-testing
- Human oversight design and override procedure (supports): https://aipolicytracker.org/controls/human-oversight-and-override
- AI impact and fundamental-rights impact assessment (supports): https://aipolicytracker.org/controls/ai-impact-assessment

## Parent instrument

- OMB Memorandum M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust
  - Record: https://aipolicytracker.org/policies/us-omb-m-25-21
  - Context file: https://aipolicytracker.org/policies/us-omb-m-25-21.md

## Provenance

- **Permanent id**: AIPT-OBL-0116 (https://aipolicytracker.org/id/AIPT-OBL-0116; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/us-omb-m-25-21-high-impact-ai-practices
- **Official source**: https://www.whitehouse.gov/omb/information-for-agencies/memoranda/
- **Provision**: Section 4
- **Review status**: verified
- **Confidence**: medium
- **Facts last confirmed**: 2026-09-26
- **Confirmed by**: Bhaskar Bhatt (see https://aipolicytracker.org/reviewers)
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Apply minimum risk-management practices to high-impact AI (OMB M-25-21)" [AIPT-OBL-0116, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0116 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.