Summary
- Both issued 3 Apr 2025. M-25-21 replaces M-24-10 and M-25-22 replaces M-24-18 from the previous administration.
- M-25-21 (use and governance): each agency names a Chief AI Officer within 60 days, sets up an AI governance board, publishes an AI strategy (CFO Act agencies, 180 days), a compliance plan, a generative AI policy (270 days) and an annual public AI use case inventory.
- High-impact AI: AI whose output is the main basis for a decision with a legal, material, binding or significant effect on rights or safety. Some categories (for example benefits, employment, law enforcement) are presumed high-impact.
- Minimum practices for high-impact AI (documented within 365 days): pre-deployment testing, an AI impact assessment with independent review and signed risk acceptance, ongoing monitoring, operator training, human oversight with fail-safes, human review and appeal for affected people, and public feedback. Non-compliant high-impact AI must be switched off. Chief AI Officers can grant time-limited waivers.
- M-25-22 (acquisition): applies to contracts from solicitations issued 180 days after issuance. Key contract terms: clear IP and data ownership, a ban on vendors using non-public agency data to train commercial models without consent, vendor lock-in protections (portability, knowledge transfer), M-25-21 compliance for high-impact uses, and agency rights to test and monitor performance. It also states a buy-American preference for AI.
- Neither memo covers National Security Systems; the Intelligence Community is excluded from M-25-22 and from the high-impact rules in M-25-21. A later memo, M-26-04 (11 Dec 2025), adds "unbiased AI" terms for buying large language models; no 2026 memo rescinding M-25-21 or M-25-22 was found.
Who it applies to
- Directly: US federal executive agencies.
- Indirectly: every vendor selling AI systems or services to those agencies, through solicitation and contract terms. Common commercial products with incidental embedded AI (for example spell-check in a word processor) are generally excluded from M-25-22.
- Not extraterritorial as law, but a foreign vendor bidding on a US federal contract will see these terms in its contract.
Key dates
- M-25-21 and M-25-22 issued; they rescind M-24-10 and M-24-18
- 60-day deadline for agencies to name a Chief AI Officer (computed)
- M-25-22 applies to solicitations issued 180 days after issuance (computed)
- OMB M-26-04 on Unbiased AI Principles adds LLM procurement terms
- 365-day deadline to document minimum practices for high-impact AI (computed)
Full date record
| Date | Event |
|---|---|
| 2025-04-03 | Both memos issued |
| 2025-06-02 | Chief AI Officer deadline (60 days, computed) |
| 2025-09-30 | M-25-22 starts applying to new solicitations (180 days, computed; some secondary sources say 1 Oct 2025) |
| 2025-12-29 | Generative AI policy and acquisition policy updates due (270 days, computed) |
| 2026-04-03 | Minimum practices for high-impact AI documented (365 days, computed) |
Penalties and enforcement
- No fines. OMB oversees through compliance plans, inventories and reporting.
- Agencies must stop using non-compliant high-impact AI.
- For vendors, breaches show up as contract non-performance, failed evaluations or lost bids.
What it means for an Indian company
- Indian IT services and SaaS firms bidding on US federal work (directly or as subcontractors to US primes) should expect these clauses. Prepare:
- Evidence for agency pre-deployment testing and impact assessments: model cards and test results (SC-AI-014 Model documentation (model cards, system cards), SC-AI-015 Pre-deployment testing and validation).
- A written commitment that customer data is never used to train your general models without consent (SC-AI-010 Training and input data governance (provenance, quality), SC-AI-012 Data minimisation and retention for AI).
- Data and model export paths to answer lock-in clauses.
- Monitoring hooks so the agency can run its own evaluations (SC-AI-020 Performance monitoring and drift detection) and support human review and appeals (SC-AI-026 Human oversight and override, SC-AI-027 Right to contest and human review for individuals).
- The buy-American preference is a policy statement "consistent with applicable law"; check each solicitation for domestic-preference terms.
- Even outside federal work, US state agencies and large enterprises often copy these terms, so aligning with them and with NIST AI RMF and GenAI Profile pays off.
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when OMB M-25-21 and M-25-22 is done.
Glossary
- OMB: Office of Management and Budget, the White House office that sets rules for federal agencies.
- Memorandum (M-xx-yy): an OMB instruction binding on executive agencies.
- Chief AI Officer (CAIO): the senior official responsible for AI in each agency.
- High-impact AI: AI that is the main basis for decisions with significant effects on people's rights or safety.
- AI use case inventory: a yearly public list of how an agency uses AI.
- CFO Act agencies: the 24 largest federal agencies.
- Vendor lock-in: when switching suppliers becomes too costly because of proprietary data or code.
- National Security System: a defined category of military and intelligence IT excluded from these memos.
Key takeaways
- Binding on federal agencies; reaches vendors through contracts.
- High-impact AI needs testing, impact assessment, monitoring, oversight and appeals, or it must be switched off.
- Contracts must protect agency data from vendor training and prevent lock-in.
- Deadlines are counted from 3 Apr 2025; the dates above are computed, not stated as calendar dates in the memos.
Official sources
- OMB M-25-21 (PDF), accessed 2026-10-19
- OMB M-25-22 (PDF), accessed 2026-10-19
- White House: New policies on federal agency AI use and procurement, accessed 2026-10-19
- OMB memoranda index (lists M-26-04), accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.