United States (federal) · OMB memorandum
OMB M-25-21/22: what it requires, and the records to keep
Issued together on April 3, 2025, the pair replaced M-24-10 and M-24-18: M-25-21 governs how agencies use and govern AI, and M-25-22 governs how they buy it. M-25-22 requires contracts to ensure compliance with M-25-21's high-impact practices, so the two work as one regime from purchase to operation.
01 / What it requires
What OMB M-25-21/22 requires
Federal agencies using (M-25-21) or buying (M-25-22) AI, and through contracts the vendors that supply it; National Security Systems are excluded from both.
- 01Govern AI through a Chief AI Officer, governance board, compliance plan and annual use case inventory (M-25-21).
- 02Meet seven minimum practices for each high-impact AI use by 2026-04-03, or stop using it (M-25-21).
- 03Write contract terms that bind vendors to M-25-21 high-impact practices (M-25-22).
- 04Secure contractual rights to test and monitor delivered AI with agency-held data (M-25-22).
- 05Bar vendors from training on non-public agency data and protect against vendor lock-in (M-25-22).
02 / AI work
Where it touches AI work
Together they cover the federal AI lifecycle: choosing and contracting for AI, then testing, assessing and monitoring it in use. Vendors feel M-25-21 indirectly through M-25-22 clauses.
03 / Dates
The dates that matter
EO 14179 orders revision of M-24-10 and M-24-18
Both memos issued
M-25-22 applies to new solicitations; M-25-21 compliance plans due
M-26-04 adds unbiased AI principles for LLM procurement
M-25-21 high-impact minimum practices deadline
04 / Enforcement
Who enforces it
OMB oversight and agency contracting; non-compliant high-impact AI must be discontinued. No monetary penalties.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01AI use case inventory and high-impact determinations
- 02Impact assessments, pre-deployment tests and monitoring records
- 03AI contract clauses on data, portability, testing and M-25-21 compliance
- 04Independent evaluation results on agency-held datasets
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
What's the difference between OMB M-25-21 and M-25-22?+
M-25-21 governs how federal agencies use and govern AI; M-25-22 governs how they buy it. M-25-21 sets up Chief AI Officers, use case inventories and seven minimum practices for high-impact AI, including pre-deployment testing, impact assessment, monitoring and human oversight. M-25-22 sets contract terms on government data, vendor lock-in, agency rights to test and monitor delivered AI, and compliance with M-25-21's practices. Both were issued April 3, 2025, replacing M-24-10 and M-24-18, and M-25-22 applies to solicitations issued from September 30, 2025. Read the full answer
SOURCES
Go back to the source
Office of Management and Budget
Office of Management and Budget
Federal Register via GovInfo
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: OMB M-25-21/22 vs EO 14179 · OMB M-25-21/22 vs DoW RAI S&IP · OMB M-25-21/22 vs NIST AI RMF · OMB M-25-21/22 for defense AI workflows · NIST AI RMF · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4 · NIST SP 800-53 Rev. 5