Compare
NIST AI RMF vs OMB M-25-21/22: how they differ, side by side
How NIST AI RMF and OMB M-25-21/22 differ: what each is, who owes it, when it applies and who enforces it.
01 / Side by side
NIST AI RMF and OMB M-25-21/22, side by side
| NIST AI RMF | OMB M-25-21/22 | |
|---|---|---|
| What it is | voluntary framework | OMB memorandum |
| Jurisdiction | United States (federal) | United States (federal) |
| Legal force | Voluntary framework | Binding on federal agencies; M-25-22 reaches vendors through contract terms |
| Status | Published standard | In force |
| Applies from | 26 Jan 2023 | 3 Apr 2025 |
| Who owes it | Any organization that designs, develops, deploys, evaluates or uses AI systems and chooses to adopt it; no one is required to by the framework itself. | Federal agencies using (M-25-21) or buying (M-25-22) AI, and through contracts the vendors that supply it; National Security Systems are excluded from both. |
| Enforcement | None; voluntary. Contracts, agency policies or other laws may reference it. | OMB oversight and agency contracting; non-compliant high-impact AI must be discontinued. No monetary penalties. |
02 / NIST AI RMF
What NIST AI RMF requires
AI-specific. It addresses risks such as validity, reliability, safety, security, accountability, explainability, privacy and harmful bias in AI systems across their lifecycle.
- 01GOVERN: set policies, accountability, culture and third-party controls for AI risk across the organization.
- 02MAP: establish each AI system's context, purpose, categorization, benefits, costs and impacts.
- 03MEASURE: select metrics and test, evaluate, verify and validate AI systems for trustworthiness characteristics; track risks over time.
- 04MANAGE: prioritize and treat AI risks, manage third-party risk, and monitor deployed systems with response and recovery plans.
- 05Optionally build use-case or sector profiles that select and tailor the subcategories that matter.
03 / OMB M-25-21/22
What OMB M-25-21/22 requires
Together they cover the federal AI lifecycle: choosing and contracting for AI, then testing, assessing and monitoring it in use. Vendors feel M-25-21 indirectly through M-25-22 clauses.
- 01Govern AI through a Chief AI Officer, governance board, compliance plan and annual use case inventory (M-25-21).
- 02Meet seven minimum practices for each high-impact AI use by 2026-04-03, or stop using it (M-25-21).
- 03Write contract terms that bind vendors to M-25-21 high-impact practices (M-25-22).
- 04Secure contractual rights to test and monitor delivered AI with agency-held data (M-25-22).
- 05Bar vendors from training on non-public agency data and protect against vendor lock-in (M-25-22).
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
National Institute of Standards and Technology
National Institute of Standards and Technology
NIST Trustworthy and Responsible AI Resource Center
Office of Management and Budget
Office of Management and Budget
Federal Register via GovInfo
RELATED
Related: NIST AI RMF: the full guide · OMB M-25-21/22: the full guide · OMB M-25-21/22 vs NIST AI RMF · All comparisons