OMB M-25-21: requirements, deadlines and compliance actions
OMB Memorandum M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust
What is the OMB M-25-21?
M-25-21 directs US federal agencies on how to govern and use AI. It requires agencies to designate Chief AI Officers, maintain AI governance boards, publish AI use-case inventories, and apply minimum risk-management practices to "high-impact" AI, including pre-deployment testing, AI impact assessments, ongoing monitoring, human oversight and training, and remedies for affected individuals. It replaced the 2024 memoranda with a greater emphasis on adoption and innovation while retaining core risk practices.
Status note: Binding on federal agencies as OMB policy; issued together with M-25-22 on federal acquisition of AI. Replaced M-24-10 and M-24-18. Deadlines in the memo run from its issue date; a reviewer should confirm current status.
Who does it apply to?
Applies to federal executive agencies' development, acquisition and use of AI, with exceptions for national security systems and certain research. It does not bind private organisations but sets the expectations vendors must meet to sell AI to federal agencies.
Federal agencies, their Chief AI Officers, and by extension AI vendors and contractors.
- Risk categories
- Not classified by the instrument
- AI system types
- Generative AI systemAutomated decision-making system
When do the requirements apply?
Issued 3 April 2025 with staggered compliance deadlines for governance, inventories and high-impact AI practices.
What must organisations do?
Agencies must implement the governance and high-impact practices; vendors should be able to supply documentation, test results and monitoring support that agencies need for high-impact use cases.
Legal requirement Apply minimum risk-management practices to high-impact AI Section 4
For AI whose output serves as a principal basis for decisions with significant effects on rights, safety or access to services, agencies must complete pre-deployment testing, an AI impact assessment, ongoing monitoring, operator training, human oversight and a mechanism for affected people to seek remedy, or stop using the AI.
Practical action: Vendors should prepare test evidence and documentation that agencies can reuse in impact assessments.
Evidence examples: AI impact assessment; Pre-deployment test results
Framework mapping (original, editorial): NIST AI RMF 1.0 MAP, MEASURE, MANAGE
Obligation page Source-linked
Legal requirement Publish an annual AI use-case inventory Section 3
Agencies must inventory their AI use cases annually and publish the inventory, identifying high-impact uses, with limited exclusions.
Practical action: Agencies maintain the inventory; vendors may be asked for use-case descriptions.
Evidence examples: AI use-case inventory
Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 1.6
Obligation page Source-linked
Penalties
None; internal executive-branch policy.
Public-sector rules and enforcement
- Federal acquisition of AI must follow OMB M-25-22 — The companion memorandum M-25-22 sets requirements for agencies buying AI, including protecting government data and avoiding vendor lock-in, performance-based contracting, and requiring vendors to support the documentation and testing agencies need for high-impact AI. (applies to: Federal executive agencies and their AI vendors)
Official sources
-
OMB Memorandum M-25-21
Office of Management and Budget · 3 Apr 2025 · Tier 1 source
Change history
Record version 1: Initial structured record; direct PDF link to be confirmed by reviewer.. Full edit history is in the GitHub repository.
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.