Planisphere Download for Mac

Medicine · OMB M-25-21/22

OMB M-25-21/22 for clinical AI workflows

OMB M-25-21/22 in clinical AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Legal forceBinding on federal agencies; M-25-22 reaches vendors through contract terms
Applies from3 Apr 2025
SectorMedicine
Checked21 Oct 2026

01 / The rule

What OMB M-25-21/22 requires

Federal agencies using (M-25-21) or buying (M-25-22) AI, and through contracts the vendors that supply it; National Security Systems are excluded from both.

  1. 01Govern AI through a Chief AI Officer, governance board, compliance plan and annual use case inventory (M-25-21).
  2. 02Meet seven minimum practices for each high-impact AI use by 2026-04-03, or stop using it (M-25-21).
  3. 03Write contract terms that bind vendors to M-25-21 high-impact practices (M-25-22).
  4. 04Secure contractual rights to test and monitor delivered AI with agency-held data (M-25-22).
  5. 05Bar vendors from training on non-public agency data and protect against vendor lock-in (M-25-22).

02 / In this sector

In a clinical AI workflow

Together they cover the federal AI lifecycle: choosing and contracting for AI, then testing, assessing and monitoring it in use. Vendors feel M-25-21 indirectly through M-25-22 clauses.

Usually asked by

Clinical committees and health system AI governance.

Named alongside

HHS §1557 · HIPAA · FDA PCCP.

Sector pagePlanisphere for medicine

03 / Records

Records to keep

  1. 01AI use case inventory and high-impact determinations
  2. 02Impact assessments, pre-deployment tests and monitoring records
  3. 03AI contract clauses on data, portability, testing and M-25-21 compliance
  4. 04Independent evaluation results on agency-held datasets

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

PRIMARY
M-25-21

Office of Management and Budget

PRIMARY
M-25-22

Office of Management and Budget

PRIMARY
Executive Order 14179, 90 FR 8741

Federal Register via GovInfo

RELATED

Related: OMB M-25-21/22: the full guide · OMB M-25-21/22 for defense · OMB M-25-21/22 for law · OMB M-25-21/22 for education