Is Your Federal AI Project
Actually Compliant?

What Is OMB M-25-21?

Memorandum M-25-21, Accelerating Federal Use of AI through Streamlined Governance and Increased Transparency, was issued by the White House Office of Management and Budget in April 2025. It replaced M-24-10 and establishes requirements for how federal agencies must govern, document, and oversee AI systems — including appointing a Chief AI Officer (CAIO), maintaining an AI use-case inventory, and applying heightened controls to rights- and safety-impacting AI.

The NIST AI Risk Management Framework (AI RMF 1.0) provides the technical structure for managing AI risks. Federal agencies are increasingly expected to map their AI systems to its four functions.

Key M-25-21 Milestones

• Apr 2025
  M-25-21 issued. Replaces M-24-10. 60-day implementation clock starts for many requirements.
• Jun 2025
  CAIO designation deadline. Each agency must designate or confirm a Chief AI Officer under 40 U.S.C. § 11319.
• Quarterly
  AI use-case inventory updates. Agencies must maintain and update their public AI inventories each quarter.
• Ongoing
  Rights- and safety-impacting AI. Any AI that affects individual rights, benefits, or safety must meet heightened documentation, human review, and oversight controls before deployment.
• FedRAMP
  Cloud AI must be FedRAMP authorized. AI services deployed on federal infrastructure must meet FedRAMP Moderate or High baseline unless on-prem or air-gapped.
• Continuous
  Annual AI impact assessments. Rights-impacting and safety-impacting AI must be reassessed at least annually and after major changes.