OMB Memorandum M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust
United States · Guideline · Office of Management and Budget
Our summary
This memorandum directs federal agencies to advance responsible AI adoption and innovation while maintaining safeguards for civil rights, privacy, and civil liberties. It applies to all executive branch departments and agencies, requiring them to develop AI strategies, designate Chief AI Officers, implement risk management practices for high-impact AI systems, and increase transparency about their use of AI. The guidance aims to reduce bureaucratic barriers, maximize taxpayer value, and ensure that federal AI deployment protects and serves the American public.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
12 sections
Jump to a chapter
FROM
Subject
Overview
This memorandum directs federal agencies to drive AI adoption that enhances public services while protecting civil rights, civil liberties, and privacy. It supports human flourishing, economic competitiveness and national security. The memorandum replaces the previous OMB guidance on federal AI use.
Scope
This guidance applies to all Executive Branch departments, agencies, and independent regulatory agencies.
Guidance on federal use of AI
Agencies must adopt a pro-innovation approach to AI deployment by removing unnecessary barriers, developing public AI strategies, maximizing taxpayer value through reduced duplication and resource sharing, and developing and retaining AI talent. Each agency must identify a Chief AI Officer and allocate resources while remaining accountable through annual AI use case inventories and compliance reporting. Agencies must deploy trustworthy AI for consequential decisions, implement minimum risk management practices for high-impact AI, and discontinue or cease use of AI that does not meet performance standards or cannot be properly mitigated.
Scope
The memorandum applies to federal agencies' development, adoption, and use of artificial intelligence systems while maintaining protections for privacy, civil rights, civil liberties, and preventing illegal discrimination as required by the AI in Government Act, with covered agencies complying with all applicable law and other OMB policies on AI while keeping existing authorities and responsibilities. The memorandum covers new and existing AI developed, used, or acquired by covered agencies, but excludes non-agency uses of AI, assessments of particular AI applications subject to regulatory or national security enforcement, metrics and standards for testing AI used by the public or government as a whole, and basic or applied research except when developed for agency use, with requirements applying to system functionality implementing AI rather than entire information systems and not covering AI in National Security Systems.
Driving AI innovation
Each CFO Act agency must develop a publicly available AI Strategy within 180 days addressing barriers to responsible AI use, using an OMB-provided template, and must assess AI maturity and develop plans for AI infrastructure across the lifecycle, data access and traceability, enterprise capacity, R&D tools, risk management, workforce development, and future AI investments. Agencies must proactively share custom-developed AI code, models, and weights across government and release them as open-source in public repositories unless restricted by law, creating identifiable risks to national security or privacy, prevented by contract, or risking agency mission or system integrity; data used must be included in comprehensive inventories under the OPEN Government Data Act. Federal policy maximizes use of AI products and services developed domestically, with agencies treating data and data improvements as critical assets in procurement, retaining government rights, preventing vendor lock-in, and tracking performance documentation.
Improving AI governance
Within 270 days, agencies must update policies on IT infrastructure, data, cybersecurity, and privacy to align with this memorandum and relevant orders, and should develop policies on acceptable use and safeguards for generative AI. All agencies except Defense and the Intelligence Community must annually inventory their AI use cases and submit to OMB, with public versions posted on agency websites and encouraged to be updated continuously. The OMB Director must convene and chair a Chief AI Officer Council within 90 days, including Chief AI Officers from CFO Act agencies and representatives from specified White House offices, to coordinate AI development across agencies, develop shared resources and templates, and sunset five years after issuance unless the OMB Director authorizes otherwise.
Fostering public trust in federal use of AI
Agencies must document and implement foundational safeguard procedures for high-impact AI uses within 365 days, report to OMB, and discontinue any high-impact AI that does not comply, with exemptions for limited-scale pilot programs certified by the Chief AI Officer where individuals can opt in and out. Chief AI Officers may waive specific requirements through written risk-based justifications if meeting them would create safety or rights risks or severely disrupt critical operations, must verify waivers annually and report changes to OMB within 30 days, and must publicly disclose summaries of active waivers. For high-impact cases, agencies must conduct pre-deployment testing and risk mitigation plans reflecting real-world outcomes, complete ongoing impact assessments covering intended purpose and benefits, data quality and appropriateness, privacy and civil rights impacts, reassessment scheduling, cost analysis, independent review findings, and risk acceptance signatures, and perform periodic testing and human review to detect adverse impacts on performance, security, privacy, or civil liberties compliance.
Definitions
AI encompasses machine learning, reinforcement learning, transfer learning, and generative AI but excludes robotic process automation and rule-based systems, and includes data systems, software, applications, tools, or utilities operating using machine learning algorithms or other AI forms whether developed for AI research or integrated into existing business processes, but excludes common commercial products with embedded AI like word processors or navigation systems. AI and AI-enabling roles include technical and non-technical positions from data scientists to program managers. The memorandum also defines AI maturity as federal organizations' capacity to adopt and manage AI responsibly, AI model as a system component using computational or machine-learning techniques to produce outputs, and the terms applied research, basic research, custom-developed code, customer experience, data asset, federal information, high-impact AI, information technology, model weight, national security system, open government data asset, open source software, and significant modification.
Purposes for which AI is presumed to be high-impact
Lists categories of AI uses presumed to be high-impact, including safety-critical functions in critical infrastructure or emergency services; physical movements of robots or vehicles with injury potential; kinetic or non-kinetic attack measures; hazardous chemical or biological agent transport or design; equipment or infrastructure design posing significant safety risks; healthcare medically relevant functions, patient diagnosis, care allocation, or insurance cost control; facility access control or security; adjudication of sanctions or export controls; blocking or limiting protected speech; and various law enforcement applications. Continues the list of presumed high-impact AI categories, including federal employment terms and conditions determinations such as hiring, termination, pay, promotion, or performance management; and language translation when responses are legally binding or directly inform agency decisions.
Methods of understanding AI risk management
AI risks from federal use span correctness, dependability, impartiality, clarity, oversight, and outcome validity regardless of automation level, human control, AI visibility, or stakeholder awareness, generated or intensified by inaccurate outputs, weak outputs, discriminatory outputs, harmful outcomes, unsuitable or misapplied AI, contexts requiring human-led decisions, and deliberate AI manipulation. Agencies must designate a Chief AI Officer within 60 days, convene an AI Governance Board within 90 days, develop an agency AI strategy within 180 days, develop generative AI policies within 270 days, implement minimum risk management practices for high-impact AI within 365 days, and publicly release an AI use case inventory annually. Public consultation approaches include any transparent process seeking input from affected groups in an accessible and effective manner.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 8 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 2 of 4
- Prohibited practices, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 4 of 6
- General purpose and foundation models, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 21 are shown.
Guidance on federal use of AI 7 controls
- ObligationApplies to: Public authorityDrafted by the Index
Agencies should adopt a forward-leaning approach that uses AI to improve public services, government efficiency and value to taxpayers.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must reduce bureaucratic obstacles and establish effective policies for timely deployment of AI systems.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must focus on three key priorities: removing barriers to innovation, establishing governance structures, and ensuring safeguards for civil rights and privacy.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must eliminate unnecessary restrictions that block responsible AI adoption and innovation.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must develop and release public AI strategies that make AI adoption a priority and increase transparency to the public, civil society and industry.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must maximize returns from existing AI investments to prevent wasted spending, including sharing data, models, code and performance assessments across government.
- ObligationApplies to: Public authorityDrafted by the Index
When purchasing AI systems, agencies should prioritize American-made AI products and services.
Driving AI innovation 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
Each CFO Act agency must create an AI strategy within 180 days that identifies obstacles to responsible AI use and plans enterprise-wide maturity improvements.
Applies when: CFO Act agency
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must use the OMB-provided AI Strategies template and make their strategies accessible to the public.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies should identify and remove barriers to responsible AI adoption while offering clear transparency into how the Federal Government uses AI.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies should improve AI maturity by building technical skills, strengthening workforce talent, and enhancing their capacity to develop and purchase AI systems.
Improving AI governance 3 controls
- ObligationApplies to: Public authorityDrafted by the Index
Within 60 days, agency heads must appoint or designate a Chief AI Officer to lead AI adoption and coordinate with other officials.
Applies when: all agencies
- ObligationApplies to: Public authorityDrafted by the Index
For agencies other than CFO Act agencies, the Chief AI Officer must be at Grade 14 of the General Schedule or equivalent.
Applies when: non-CFO Act agency
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must notify OMB within 30 days when the Chief AI Officer changes or the position becomes vacant.
Fostering public trust in federal use of AI 6 controls
- ObligationApplies to: Public authorityDrafted by the Index
Agencies should develop AI systems that provide public benefits such as better accessibility to government services, improved efficiency, stronger national security and increased American economic competitiveness.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must ensure that their AI systems are trustworthy, secure and accountable in line with Executive Order 13960.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must write AI risk management policies that establish minimum necessary requirements for trustworthy and responsible AI use while keeping those requirements clear and feasible to implement.
- ObligationApplies to: Public authorityDrafted by the Index
Agencies must classify AI systems as high-impact when their output substantially influences decisions or actions that have a binding or significant impact on people's rights or safety.
- ObligationApplies to: Public authorityDrafted by the Index
When evaluating whether an AI use case is high-impact, agencies should examine the system's specific output and its potential risks in the decision-making context.
- ObligationApplies to: Public authorityDrafted by the Index
For AI use cases in categories automatically presumed to be high-impact under Section 6, an agency official must submit written documentation to the Chief AI Officer explaining why a particular case does not meet the high-impact definition if the agency disputes that classification.
Applies when: AI use cases in categories automatically presumed high-impact
Methods of understanding AI risk management 1 control
- ObligationApplies to: Public authorityDrafted by the Index
Agencies should solicit public input on AI use through direct usability testing, general public comment solicitations in official registers, and transparent consultation processes to understand and address public concerns.
Change history
No changes recorded since we began monitoring this policy.