US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI)
The OMB memoranda that govern how US federal agencies adopt, govern, buy and oversee AI: agency AI strategies, Chief AI Officers and governance boards, compliance plans and inventories, the high-impact AI risk management practices, the AI acquisition lifecycle with its IP, privacy, lock-in and evaluation terms, the Unbiased AI Principles requirements for procured LLMs, and the principles agencies apply when regulating private sector AI.
US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) is a compliance framework from United States with 6 domains and 23 controls. The largest domains are M-25-22: Driving efficient acquisition of AI – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) (8 controls), M-25-21 section 2: Driving AI innovation – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) (4 controls), M-25-21 section 4: Fostering public trust (high-impact AI) – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
M-21-06: Guidance for regulation of AI applications (agencies as regulators) – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI)
| Code | Title |
|---|---|
| us-omb-ai-memoranda::21-06 | Agencies regulating private sector AI: apply the ten principles and keep the AI regulatory plan current |
M-25-21 section 2: Driving AI innovation – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI)
| Code | Title |
|---|---|
| us-omb-ai-memoranda::21-2a | Publish an agency AI Strategy within 180 days (CFO Act agencies) |
| us-omb-ai-memoranda::21-2b | Share AI code, models and data across government and release code as open source where practicable |
| us-omb-ai-memoranda::21-2d | Procure AI so that the agency keeps its data rights, can measure performance and sustains competition |
| us-omb-ai-memoranda::21-2e | Build an AI-ready workforce: upskill staff, recruit experienced AI talent, track talent needs |
M-25-21 section 3: Improving AI governance – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI)
| Code | Title |
|---|---|
| us-omb-ai-memoranda::21-3a1 | Designate a Chief AI Officer within 60 days with the stated authority and duties |
| us-omb-ai-memoranda::21-3a2 | Convene an agency AI Governance Board within 90 days (CFO Act agencies) |
| us-omb-ai-memoranda::21-3b | Governance responsibilities: empower AI leaders, submit compliance plans, update IT, data, cybersecurity and privacy policies, adopt a generative AI policy, inventory use cases annually |
M-25-21 section 4: Fostering public trust (high-impact AI) – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI)
| Code | Title |
|---|---|
| us-omb-ai-memoranda::21-4a | High-impact AI: determine and document high-impact use, implement the minimum practices within 365 days or discontinue, pilots, waivers and public reporting |
| us-omb-ai-memoranda::21-4b1 | High-impact AI: pre-deployment testing with risk mitigation plans |
| us-omb-ai-memoranda::21-4b2 | High-impact AI: a documented AI impact assessment before deployment, updated through the lifecycle |
| us-omb-ai-memoranda::21-4b3 | High-impact AI: ongoing monitoring, operator training, human oversight and fail-safes, remedies and appeals, and feedback from users and the public |
M-25-22: Driving efficient acquisition of AI – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI)
| Code | Title |
|---|---|
| us-omb-ai-memoranda::22-3b | Update acquisition procedures within 270 days: review planned AI acquisitions, convene cross-functional teams, use IP terms |
| us-omb-ai-memoranda::22-3cd | Maximise American-made AI and protect privacy in AI acquisition with early SAOP involvement |
| us-omb-ai-memoranda::22-3e | Protect IP rights and government data: scope licences, keep operating components available, limit vendor retention, ban training on agency data without consent |
| us-omb-ai-memoranda::22-3h | Decide when to require disclosure of AI used in contract performance |
| us-omb-ai-memoranda::22-4ab | Acquisition lifecycle: identify requirements with the cross-functional team, make an early high-impact determination, research the market and use performance-based techniques |
| us-omb-ai-memoranda::22-4c | Solicitation development: disclose high-impact use and documentation demands, build in anti-lock-in provisions and IP and data terms |
| us-omb-ai-memoranda::22-4d | Selection and award: test proposed solutions, re-evaluate risk, and include the required contract terms |
| us-omb-ai-memoranda::22-4e | Contract administration and closeout: monitor performance, manage new features and plan for transition |
M-26-04: Unbiased AI Principles in LLM procurement – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI)
| Code | Title |
|---|---|
| us-omb-ai-memoranda::26-04a | LLM procurement: contractual requirements on the Unbiased AI Principles in every new solicitation, existing contracts modified before option exercise |
| us-omb-ai-memoranda::26-04b | Update procurement policies by 11 March 2026 with a user reporting process for principle-violating outputs |
| us-omb-ai-memoranda::26-04c | LLM transparency: minimum vendor documentation, enhanced documentation where needed, and materiality for termination |
What is US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) and who does it apply to?
US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) is a compliance framework from United States with 6 domains and 23 controls. The OMB memoranda that govern how US federal agencies adopt, govern, buy and oversee AI: agency AI strategies, Chief AI Officers and governance boards, compliance plans and inventories, the high-impact AI risk management practices, the AI acquisition lifecycle with its IP, privacy, lock-in and evaluation terms, the Unbiased AI Principles requirements for procured LLMs, and the principles agencies apply when regulating private sector AI. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) actually require?
US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) has 23 controls organised across 6 domains. The largest domains are M-25-22: Driving efficient acquisition of AI – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) (8 controls), M-25-21 section 2: Driving AI innovation – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) (4 controls), M-25-21 section 4: Fostering public trust (high-impact AI) – US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) do I already cover?
US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI)?
Start your US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about US OMB AI Memoranda M-25-21 and M-25-22 (Federal Use and Acquisition of AI) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 23 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,159 frameworks.
Get Started Free →Free forever, no credit card required