Question · OMB M-25-21/22
What's the difference between OMB M-25-21 and M-25-22?
Issued together on April 3, 2025, the pair replaced M-24-10 and M-24-18: M-25-21 governs how agencies use and govern AI, and M-25-22 governs how they buy it.
01 / The answer
The short answer
M-25-21 governs how federal agencies use and govern AI; M-25-22 governs how they buy it. M-25-21 sets up Chief AI Officers, use case inventories and seven minimum practices for high-impact AI, including pre-deployment testing, impact assessment, monitoring and human oversight. M-25-22 sets contract terms on government data, vendor lock-in, agency rights to test and monitor delivered AI, and compliance with M-25-21's practices. Both were issued April 3, 2025, replacing M-24-10 and M-24-18, and M-25-22 applies to solicitations issued from September 30, 2025.
02 / The rule
What OMB M-25-21/22 requires
Issued together on April 3, 2025, the pair replaced M-24-10 and M-24-18: M-25-21 governs how agencies use and govern AI, and M-25-22 governs how they buy it. M-25-22 requires contracts to ensure compliance with M-25-21's high-impact practices, so the two work as one regime from purchase to operation.
- 01Govern AI through a Chief AI Officer, governance board, compliance plan and annual use case inventory (M-25-21).
- 02Meet seven minimum practices for each high-impact AI use by 2026-04-03, or stop using it (M-25-21).
- 03Write contract terms that bind vendors to M-25-21 high-impact practices (M-25-22).
- 04Secure contractual rights to test and monitor delivered AI with agency-held data (M-25-22).
03 / Records
Records to keep
- 01AI use case inventory and high-impact determinations
- 02Impact assessments, pre-deployment tests and monitoring records
- 03AI contract clauses on data, portability, testing and M-25-21 compliance
- 04Independent evaluation results on agency-held datasets
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Office of Management and Budget
Office of Management and Budget
Federal Register via GovInfo
RELATED
Related: OMB M-25-21/22: the full guide