OMB memoranda M-25-21 and M-25-22: federal use and acquisition of AI
For AI whose output is a principal basis for decisions with significant effects on rights or safety, agencies must test before deployment, assess impact before and during use, provide human oversight and intervention, offer remedies or appeals, and stop or pause systems that fall short. Acquisition guidance requires contracts that allow ongoing monitoring, bar training on government data without consent, and consider disclosure of unanticipated vendor AI use.
Scope. Binds federal agencies; reaches US companies through federal contracts, which must carry the minimum practices for high-impact AI.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Pre-execution validation C-D1 | Required by the text | M-25-21: pre-deployment testing of high-impact AI in conditions matching intended use | high | 3 cases |
| Human takeover with a time window C-R3 | Implied | M-25-21: human oversight, intervention, and remedies or appeals for affected individuals | medium | 2 cases |
| Kill switch faster than the actor C-X2 | Implied | M-25-21: cease or pause high-impact AI that does not meet the minimum practices | medium | 2 cases |
| Mandate disclosed to supervisor C-M1 | Implied | M-25-22: disclosure of AI use by the vendor in performing the contract | medium | 1 case |