United States (federal) · OMB memorandum
OMB M-25-21: what it requires, and the records to keep
M-25-21 is OMB's governing policy for how federal agencies adopt, govern and manage the risk of AI; it rescinded and replaced M-24-10. It sets up Chief AI Officers and governance boards, an annual use case inventory, and minimum risk practices that every high-impact AI use must meet or be shut off.
01 / What it requires
What OMB M-25-21 requires
Heads of all executive branch departments and agencies, including independent regulatory agencies; AI used as a component of a National Security System is excluded.
- 01Designate a Chief AI Officer within 60 days; CFO Act agencies convene an AI Governance Board within 90 days.
- 02Publish a compliance plan within 180 days and every two years until 2036; CFO Act agencies publish an AI strategy.
- 03Update IT, data, cybersecurity and privacy policies and issue a generative AI policy within 270 days.
- 04Publish an AI use case inventory annually, consistent with OMB instructions.
- 05Within 365 days, document the minimum practices for each high-impact AI use, or safely stop using it.
- 06Track, report to OMB within 30 days, and publicly summarize high-impact determinations and waivers.
02 / AI work
Where it touches AI work
It applies directly to AI the agency builds or buys, including generative AI. Its testing, impact assessment and monitoring practices are the main federal evidence duties for AI behaviour.
03 / Dates
The dates that matter
EO 14179 directs OMB to revise M-24-10 within 60 days
M-25-21 issued; rescinds and replaces M-24-10
Agency compliance plans and CFO Act AI strategies due (180 days)
High-impact minimum practices must be documented (365 days)
OMB publishes 2025 AI use case inventory (reported)
EO 14434 renames AI to 'Super Intelligence' in new federal documents
04 / Enforcement
Who enforces it
OMB oversight through accountability reviews, inventories and requests; non-compliant high-impact AI must be discontinued. No monetary penalties.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01CAIO designation and AI Governance Board charter
- 02Published compliance plan and AI strategy
- 03AI use case inventory entries with high-impact determinations
- 04Per-use-case impact assessments, test results, waivers and risk acceptance signatures
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
How do I prove pre-deployment testing for a federal AI system?+
Keep a documented, repeatable test record that matches what M-25-21 asks for: pre-deployment tests and a risk mitigation plan reflecting expected real-world outcomes and benefits. If the agency has no access to the source code, model or data, the memo allows testing by querying the AI service and observing outputs, or by giving evaluation data to the vendor and obtaining results. Record the test data, metrics, conditions and results so the run can be repeated, and keep them with the AI impact assessment. Agencies had to document these practices for high-impact uses by April 3, 2026. Read the full answer
SOURCES
Go back to the source
Office of Management and Budget
The White House
Nextgov/FCW
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: OMB M-25-21 for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4