OMB Memorandum M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust
The operative US federal AI use policy. Replaces the rights- and safety-impacting split with a single high-impact AI category carrying minimum practices for pre-deployment testing, impact assessment, ongoing monitoring and human oversight.
Overview
Issued on 3 April 2025 alongside its procurement companion M-25-22, this memorandum rescinded and replaced M-24-10, the March 2024 policy that had governed federal agency use of AI. The framing shifts toward accelerating adoption while keeping the governance spine: agencies designate a Chief AI Officer, publish an AI strategy, maintain a use-case inventory, and apply minimum risk management practices to a consolidated category of high-impact AI, meaning uses that materially affect rights, safety, access to government services or significant agency operations. Because the earlier memorandum is no longer in force, anything written against M-24-10's rights-impacting and safety-impacting terminology now describes a rescinded policy.
Key dates
- Apr 3, 2025Issued, rescinding and replacing M-24-10
- Jun 30, 2025Deadline to designate a Chief AI Officer
- Sep 30, 2025CFO Act agency AI strategies due (180 days from issuance)
- Sep 22, 2026Agencies report minimum practices for high-impact AI; non-compliant uses must stop
Risk areas addressed
Who it applies to
Federal agencies, with CFO Act agencies carrying the heavier strategy and reporting duties. Vendors feel it through agency procurement, where M-25-22 sets the contracting requirements.
Key obligations
- Designate a Chief AI Officer with authority to establish processes for high-impact AI.
- Publish an agency AI strategy covering infrastructure, data, workforce, risk management and procurement.
- Maintain and report an AI use-case inventory, identifying which uses are high-impact.
- Apply minimum risk management practices to high-impact AI before deployment and continuously afterwards, including pre-deployment testing, an AI impact assessment, ongoing monitoring, transparency and human oversight.
- Discontinue any high-impact use case that does not meet the minimum practices by the reporting deadline.
How to prepare
- Read M-25-21 rather than M-24-10, and retire any internal mapping built on the rights- and safety-impacting categories.
- Classify each inventoried use case against the high-impact definition, and record the reasoning, because the classification is what pulls the minimum practices in.
- Stand up the evidence trail the minimum practices imply: test results, the impact assessment, the monitoring record and the human-oversight design, held per use case.
- For anything bought rather than built, align the vendor questions and contract terms to M-25-22 so the evidence you need is contractually owed.
Penalties & enforcement
Administrative. A high-impact AI use case that does not meet the minimum practices must be discontinued.
Enforced by: Office of Management and Budget; agency Chief AI Officers
OMB M-25-21 is enforced by Office of Management and Budget; agency Chief AI Officers. The next dated milestone falls on Sep 22, 2026, 14 days away: Agencies report minimum practices for high-impact AI; non-compliant uses must stop. In practice that means knowing which of your AI systems fall in scope in public sector, holding assessments that speak to governance & accountability, human oversight and transparency, and being able to produce that evidence on request.