Planisphere Download for Mac

Defense · OMB M-25-21

OMB M-25-21 for defense AI workflows

OMB M-25-21 in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Legal forceBinding on federal agencies
Applies from3 Apr 2025
SectorDefense
Checked21 Oct 2026

01 / The rule

What OMB M-25-21 requires

Heads of all executive branch departments and agencies, including independent regulatory agencies; AI used as a component of a National Security System is excluded.

  1. 01Designate a Chief AI Officer within 60 days; CFO Act agencies convene an AI Governance Board within 90 days.
  2. 02Publish a compliance plan within 180 days and every two years until 2036; CFO Act agencies publish an AI strategy.
  3. 03Update IT, data, cybersecurity and privacy policies and issue a generative AI policy within 270 days.
  4. 04Publish an AI use case inventory annually, consistent with OMB instructions.
  5. 05Within 365 days, document the minimum practices for each high-impact AI use, or safely stop using it.
  6. 06Track, report to OMB within 30 days, and publicly summarize high-impact determinations and waivers.

02 / In this sector

In a defense AI workflow

It applies directly to AI the agency builds or buys, including generative AI. Its testing, impact assessment and monitoring practices are the main federal evidence duties for AI behaviour.

Usually asked by

Program office leads and ATO-package owners.

Named alongside

NIST AI RMF · DoW RAI · OMB M-25-21.

Sector pagePlanisphere for defense

03 / Records

Records to keep

  1. 01CAIO designation and AI Governance Board charter
  2. 02Published compliance plan and AI strategy
  3. 03AI use case inventory entries with high-impact determinations
  4. 04Per-use-case impact assessments, test results, waivers and risk acceptance signatures

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

PRIMARY
OMB Memoranda index

The White House

RELATED

Related: OMB M-25-21: the full guide · OMB M-25-21 for medicine · OMB M-25-21 for law · OMB M-25-21 for education