Compare
OMB M-25-21/22 vs NIST AI RMF: how they differ, side by side
How OMB M-25-21/22 and NIST AI RMF differ: what each is, who owes it, when it applies and who enforces it.
01 / Side by side
OMB M-25-21/22 and NIST AI RMF, side by side
| OMB M-25-21/22 | NIST AI RMF | |
|---|---|---|
| What it is | OMB memorandum | voluntary framework |
| Jurisdiction | United States (federal) | United States (federal) |
| Legal force | Binding on federal agencies; M-25-22 reaches vendors through contract terms | Voluntary framework |
| Status | In force | Published standard |
| Applies from | 3 Apr 2025 | 26 Jan 2023 |
| Who owes it | Federal agencies using (M-25-21) or buying (M-25-22) AI, and through contracts the vendors that supply it; National Security Systems are excluded from both. | Any organization that designs, develops, deploys, evaluates or uses AI systems and chooses to adopt it; no one is required to by the framework itself. |
| Enforcement | OMB oversight and agency contracting; non-compliant high-impact AI must be discontinued. No monetary penalties. | None; voluntary. Contracts, agency policies or other laws may reference it. |
02 / OMB M-25-21/22
What OMB M-25-21/22 requires
Together they cover the federal AI lifecycle: choosing and contracting for AI, then testing, assessing and monitoring it in use. Vendors feel M-25-21 indirectly through M-25-22 clauses.
- 01Govern AI through a Chief AI Officer, governance board, compliance plan and annual use case inventory (M-25-21).
- 02Meet seven minimum practices for each high-impact AI use by 2026-04-03, or stop using it (M-25-21).
- 03Write contract terms that bind vendors to M-25-21 high-impact practices (M-25-22).
- 04Secure contractual rights to test and monitor delivered AI with agency-held data (M-25-22).
- 05Bar vendors from training on non-public agency data and protect against vendor lock-in (M-25-22).
03 / NIST AI RMF
What NIST AI RMF requires
AI-specific. It addresses risks such as validity, reliability, safety, security, accountability, explainability, privacy and harmful bias in AI systems across their lifecycle.
- 01GOVERN: set policies, accountability, culture and third-party controls for AI risk across the organization.
- 02MAP: establish each AI system's context, purpose, categorization, benefits, costs and impacts.
- 03MEASURE: select metrics and test, evaluate, verify and validate AI systems for trustworthiness characteristics; track risks over time.
- 04MANAGE: prioritize and treat AI risks, manage third-party risk, and monitor deployed systems with response and recovery plans.
- 05Optionally build use-case or sector profiles that select and tailor the subcategories that matter.
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Office of Management and Budget
Office of Management and Budget
Federal Register via GovInfo
National Institute of Standards and Technology
National Institute of Standards and Technology
NIST Trustworthy and Responsible AI Resource Center
RELATED
Related: OMB M-25-21/22: the full guide · NIST AI RMF: the full guide · NIST AI RMF vs OMB M-25-21/22 · All comparisons