United States (federal) · OMB memorandum
High-Impact AI: what it requires, and the records to keep
High-impact AI is M-25-21's single risk tier for federal AI: AI whose output is a principal basis for decisions with a legal, material, binding or significant effect on rights or safety, with 15 listed categories presumed high-impact. Each such use must meet seven minimum practices, have a CAIO waiver, or be discontinued.
01 / What it requires
What High-Impact AI requires
Federal agencies and their Chief AI Officers, for each AI use whose output is a principal basis for a decision or action with legal, material, binding or significant effect on rights or safety.
- 01Run pre-deployment testing reflecting real-world outcomes; if no access to code, models or data, test by querying the service.
- 02Complete and periodically update an AI impact assessment, including independent review and a signed risk acceptance.
- 03Monitor performance and adverse impacts after deployment, detecting changes to the system, its data or context of use.
- 04Train and assess operators, and provide human oversight, intervention, accountability and a fail-safe where practicable.
- 05Offer affected people timely human review and appeal, and collect feedback from end users and the public.
- 06Document a decision when a presumed high-impact use is judged not high-impact; notify the CAIO in writing.
02 / AI work
Where it touches AI work
This is the federal test for which agency AI uses carry mandatory testing, impact assessment and monitoring duties. Human involvement does not by itself take a use out of scope.
03 / Dates
The dates that matter
M-25-21 defines high-impact AI, replacing M-24-10's two risk categories
Minimum practices must be documented for high-impact uses
2025 inventory reportedly lists 445 high-impact use cases
04 / Enforcement
Who enforces it
Agency CAIO and OMB oversight; a use that does not meet the practices must be safely discontinued. Waivers need a written, system-specific risk assessment, annual recertification and public summary.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01High-impact determination or written not-high-impact justification
- 02Pre-deployment test plan, results and risk mitigation plan
- 03Signed AI impact assessment with independent review comments
- 04Ongoing monitoring logs, reassessment schedule and any CAIO waiver
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
What does OMB M-25-21 require for high-impact AI?+
OMB M-25-21 (April 3, 2025) requires each high-impact AI use to meet seven minimum practices or be safely discontinued: pre-deployment testing, an AI impact assessment, ongoing monitoring, adequate operator training and assessment, human oversight and accountability, consistent remedies or appeals for affected people, and feedback from end users and the public. Agencies had until April 3, 2026 to document these practices and be ready to report them to OMB. A Chief AI Officer may waive a practice only after a written, system-specific risk determination, recertified annually. Read the full answer
What counts as "high-impact AI" under the federal AI memo?+
Under OMB M-25-21, an AI use is high-impact when its output is a principal basis for decisions or actions with a legal, material, binding or significant effect on civil rights, liberties or privacy; access to education, housing, credit, employment and similar programs; critical government services; health and safety; critical infrastructure; or strategic assets. Section 6 lists 15 categories presumed high-impact, including medical functions, law enforcement risk assessments, benefits eligibility and federal employment decisions. Human oversight does not by itself remove a use from scope, and an official must notify the Chief AI Officer in writing when deciding a presumed use is not high-impact. Read the full answer
SOURCES
Go back to the source
Office of Management and Budget
Nextgov/FCW
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: High-Impact AI for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4