Question · OMB M-25-21
How do I prove pre-deployment testing for a federal AI system?
M-25-21 is OMB's governing policy for how federal agencies adopt, govern and manage the risk of AI; it rescinded and replaced M-24-10.
01 / The answer
The short answer
Keep a documented, repeatable test record that matches what M-25-21 asks for: pre-deployment tests and a risk mitigation plan reflecting expected real-world outcomes and benefits. If the agency has no access to the source code, model or data, the memo allows testing by querying the AI service and observing outputs, or by giving evaluation data to the vendor and obtaining results. Record the test data, metrics, conditions and results so the run can be repeated, and keep them with the AI impact assessment. Agencies had to document these practices for high-impact uses by April 3, 2026.
02 / The rule
What OMB M-25-21 requires
M-25-21 is OMB's governing policy for how federal agencies adopt, govern and manage the risk of AI; it rescinded and replaced M-24-10. It sets up Chief AI Officers and governance boards, an annual use case inventory, and minimum risk practices that every high-impact AI use must meet or be shut off.
- 01Designate a Chief AI Officer within 60 days; CFO Act agencies convene an AI Governance Board within 90 days.
- 02Publish a compliance plan within 180 days and every two years until 2036; CFO Act agencies publish an AI strategy.
- 03Update IT, data, cybersecurity and privacy policies and issue a generative AI policy within 270 days.
- 04Publish an AI use case inventory annually, consistent with OMB instructions.
03 / Records
Records to keep
- 01CAIO designation and AI Governance Board charter
- 02Published compliance plan and AI strategy
- 03AI use case inventory entries with high-impact determinations
- 04Per-use-case impact assessments, test results, waivers and risk acceptance signatures
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Office of Management and Budget
The White House
Nextgov/FCW
RELATED
Related: OMB M-25-21: the full guide