Planisphere Download for Mac

Defense · OMB M-25-22

OMB M-25-22 for defense AI workflows

OMB M-25-22 in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Legal forceBinding on federal agencies; reaches vendors through contract terms
Applies from30 Sep 2025
SectorDefense
Checked21 Oct 2026

01 / The rule

What OMB M-25-22 requires

Federal agencies (44 U.S.C. 3502(1)) acquiring AI systems or services; excludes Intelligence Community elements and AI bought as part of a National Security System.

  1. 01Apply the memo to contracts under solicitations issued, and options exercised, 180 days or more after issuance.
  2. 02Update internal acquisition procedures within 270 days so acquired AI conforms to M-25-21.
  3. 03Permanently bar vendors from training public or commercial AI on non-public agency inputs and outputs without agency consent.
  4. 04Include vendor lock-in protections such as knowledge transfer, data and model portability, and licensing transparency.
  5. 05Give the agency contractual rights to regularly test and monitor performance, risks and effectiveness using its own data.
  6. 06Require vendor testing results detailed enough to be independently verified or reproduced, where vendors test.

02 / In this sector

In a defense AI workflow

It is the main federal rule shaping AI contract terms, so vendors selling AI to agencies meet its data, portability and testing clauses. It also encourages notice before vendors add new AI features.

Usually asked by

Program office leads and ATO-package owners.

Named alongside

NIST AI RMF · DoW RAI · OMB M-25-21.

Sector pagePlanisphere for defense

03 / Records

Records to keep

  1. 01Contract clauses on data use, IP rights and portability
  2. 02Agency-held validation and test datasets kept from the vendor
  3. 03Periodic (e.g. quarterly) performance and risk evaluation reports
  4. 04Vendor testing procedures and reproducible test results

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

PRIMARY
OMB Memoranda index

The White House

RELATED

Related: OMB M-25-22: the full guide · OMB M-25-22 for medicine · OMB M-25-22 for law · OMB M-25-22 for education