United States - Federal AI Governance (M-25-21)

Overview

OMB Memorandum M-25-21, "Accelerating Federal Use of AI through Innovation, Governance, and Public Trust," was issued on April 3, 2025 and rescinds M-24-10. The memorandum directs Heads of Executive Departments and Agencies to accelerate AI adoption across the Federal Government by focusing on three priorities: innovation, governance, and public trust. It requires agency-level leadership (Chief AI Officers), enterprise AI strategies, public AI use-case inventories, and mandatory minimum risk management practices for "high-impact AI". The full text and official PDF can be found on the Office of Management and Budget site and the White House document repository: OMB M-25-21 (PDF) and the memoranda index at Memoranda – OMB.

Definitions

The memorandum defines scope and terms for applicability. "Agency" follows the definition in 44 U.S.C. § 3502(1). "Covered AI" applies to AI developed, used, or acquired by or on behalf of agencies; the memo applies to system functionality that is AI-dependent rather than to entire IT systems. "High-impact AI" is a single consolidated risk category for AI uses that could have significant consequences for rights, safety, civil liberties, or critical mission outcomes; designation as "high-impact" triggers mandatory minimum risk management practices. The memorandum excludes National Security Systems and certain intelligence activities that are governed by other policy frameworks.

Governance and Institutional Framework

M-25-21 requires agencies to appoint a Chief AI Officer (CAIO) who will champion AI adoption, advise on AI investments, and support enterprise governance. Agencies must establish AI Governance Boards composed of senior leaders to coordinate policy, risk acceptance, and deployment decisions. The memo directs OMB to convene an interagency council to harmonize approaches, share templates, and maximize cross-agency reuse of data, models, and code. Agencies must integrate AI governance with existing enterprise IT, privacy, and civil rights compliance structures. For background and the OMB role, see the memoranda index and the memorandum PDF: OMB Memoranda and M-25-21 PDF.

Key Focus Areas

The memorandum highlights several focal areas: (1) Innovation and procurement — reduce unnecessary barriers to buy and deploy AI, emphasize U.S.-developed solutions, and maximize reuse of government assets; (2) Governance and accountability — CAIO roles and governance boards to accept and manage risk with clear delegation; (3) Transparency and public trust — publish AI strategies and maintain public-facing use-case inventories; (4) Risk management — identify "high-impact AI" and apply proportionate mandatory practices (testing, monitoring, access controls, documentation, and contingency/discontinuation plans); (5) Workforce and capacity — invest in AI talent and enabling infrastructure; and (6) Interagency coordination — OMB-led council and shared technical resources to avoid duplication. The White House fact sheet summarizes these priorities and the administration’s pro-innovation orientation: Fact Sheet (PDF).

Implementation Framework

Implementation includes specific, time-bound deliverables: CFO Act agencies must develop public AI Strategies within 180 days using an OMB-provided template; agencies must maintain annual AI use-case inventories and submit compliance plans (and biennial updates where required by statute). Agencies must allocate resources to scale AI adoption (data governance, IT infrastructure, workforce development). The memorandum requires agencies to proportionately apply minimum risk management practices to high-impact AI (including independent testing where appropriate) and to maintain an ability to pause or discontinue systems failing to meet performance or safety thresholds. OMB will provide template materials, convene the interagency council, and coordinate reporting requirements.

Monitoring and Evaluation

M-25-21 institutes ongoing monitoring through annual inventories, agency AI maturity assessments, and compliance reporting to OMB. Agencies are required to document testing results, monitoring logs, and mitigation actions for high-impact AI. OMB’s interagency council and reporting processes aim to surface systemic issues, share lessons learned, and provide centralized resources and templates. Performance indicators include timely delivery of AI strategies, inventory completeness, remediation of identified risks, and documented discontinuation of noncompliant systems where mitigation is infeasible.

Penalties, Liability, and Appeals

The memorandum does not create new criminal sanctions but establishes binding administrative obligations. Agencies are required to discontinue use of AI that cannot be made compliant; persistent failure to meet requirements may trigger OMB-directed corrective action, restrictions on continued funding or procurement of specific AI systems, and agency-level administrative consequences. Existing legal safeguards for civil rights, privacy, and statutory enforcement remain operative; agencies must continue to coordinate with legal counsel and inspectors general as appropriate. The memorandum relies on existing accountability mechanisms rather than prescribing novel penalties.

Relationship to Other Instruments

M-25-21 expressly rescinds and replaces OMB Memorandum M-24-10. It implements portions of the AI in Government Act and aligns with Executive Order 14179 while referencing relevant NIST and other technical guidance for risk management. Agencies must comply with M-25-21 in concert with other legal and policy obligations (privacy, civil rights statutes, procurement law). For cross-references, consult the memorandum appendix and OMB memoranda index: OMB Memoranda.

International Alignment

While focused on domestic Federal operations, M-25-21 encourages alignment with recognized technical standards and cross-government frameworks (e.g., NIST AI RMF) and promotes U.S. competitiveness in AI markets. Agencies are directed to prefer U.S.-developed solutions where appropriate and to ensure that adoption preserves national security, supply chain integrity, and interoperability. The policy underscores the importance of international engagement but leaves specific treaty- or foreign-affairs-level coordination to relevant agencies.

Implementation Timeline

Sources and References