United StatesOMB Memorandum M-25-21, Accelerating Federal Use of Artificial Intelligence through Innovation, Governance, and Public Trust
In force since .
An AI governance rule binding government bodies.
- Obligation class
- Governance, Reporting, Disclosure, DPIA
As of .
What it requires
- This memorandum binds executive agencies and creates no rights or obligations for the public; a vendor meets it through the AI products and contract terms an agency uses to carry it out, and OMB Memorandum M-25-22 sets the contract terms (Section 1, footnote 4, Section 2(d)).
- If you are an executive agency, retain or designate a Chief AI Officer within 60 days of , and have each CFO Act agency convene an AI governance board within 90 days (Section 3(a)(i) and (ii)).
- If you are a CFO Act agency, develop an AI strategy for identifying and removing barriers to your responsible use of AI within 180 days of (Section 2(a)).
- Inventory your AI use cases at least annually, except for the Department of Defense and the Intelligence Community (Section 3(b)(v)).
- Submit to OMB and post publicly a plan to achieve consistency with the memorandum, or a written determination that you do not use and do not anticipate using covered AI, within 180 days of and every two years thereafter until 2036 (Section 3(b)(ii)).
- For each high-impact AI use case, document implementation of the minimum risk management practices within 365 days of , and safely discontinue use of the AI functionality where the use case does not comply (Section 4(a)(i)).
- Develop pre-deployment testing and risk mitigation plans for a high-impact use case that reflect expected real-world outcomes; where you lack access to the underlying AI source code, models or data, use alternative test methodologies such as querying the AI service and observing the outputs, or giving the vendor evaluation data and obtaining results (Section 4(b)(i)).
- Complete a documented AI impact assessment before deploying a high-impact use case, and update it periodically and throughout the AI's lifecycle (Section 4(b)(ii)).
- Conduct testing and periodic human review of each high-impact use case, where feasible, to identify adverse impacts to the performance and security of the AI functionality, and implement mitigations (Section 4(b)(iii)).
- Ensure sufficient and periodic training, assessment and oversight for the people who operate a high-impact AI so that they can interpret and act on its output and manage the associated risks (Section 4(b)(iv)).
- Ensure human oversight, intervention and accountability suitable for each high-impact use case, and, when practicable and consistent with agency practice, an appropriate fail-safe that minimizes the risk of significant harm (Section 4(b)(v)).
- Ensure that individuals affected by AI-enabled decisions have access to a timely human review and a chance to appeal any negative impacts, when appropriate (Section 4(b)(vi)).
- Provide an option for end users and the public to submit feedback on a high-impact use case, where appropriate, and use that feedback to inform your decision-making about the AI (Section 4(b)(vii)).
- A pilot program of limited scale and duration, certified by the Chief AI Officer and tracked centrally, is exempt from the minimum risk management practices; where possible, let individuals opt into and out of the pilot and apply the practices where practicable (Section 4(a)(i)).
- Where the Chief AI Officer waives a minimum practice, certify the waiver's ongoing validity each year, keep the waiver decision with the Chief AI Officer, track it centrally, report it to OMB within 30 days of granting or revoking it, and publicly release a summary of each determination and waiver (Section 4(a)(ii) to (iv)).
These lines are LexLint's reading of the law's text, as of .
What this law does
The memorandum, addressed to the heads of executive departments and agencies, is dated . The memorandum rescinds and replaces an earlier OMB memorandum. Except as specifically noted, the memorandum applies to all agencies defined in 44 U.S.C. 3502(1). Some requirements apply only to Chief Financial Officers Act agencies, and other requirements do not apply to elements of the Intelligence Community.
The memorandum does not cover AI when it is being used as a component of a National Security System. The memorandum states that it governs only agencies' own use of AI and does not create rights or obligations for the public. The memorandum's requirements and recommendations apply to new and existing AI that is developed, used, or acquired by or on behalf of covered agencies. Within 60 days of its issuance, the head of each agency must retain or designate a Chief AI Officer.
Within 90 days, each CFO Act agency must convene its relevant agency officials to coordinate and govern issues related to the use of AI within the Executive Branch, and may rely on an existing governance body to do so. Within 180 days, each CFO Act agency must develop an AI strategy for identifying and removing barriers to its responsible use of AI. Each agency, except the Department of Defense and the Intelligence Community, must inventory its AI use cases at least annually.
Within 180 days of the memorandum's issuance, and every two years thereafter until 2036, each agency must submit a compliance plan, or a written determination that it does not use and does not anticipate using covered AI, to OMB and post it publicly. Within 365 days of the memorandum's issuance, agencies must document implementation of the minimum practices in Section 4(b) for high-impact uses of AI.
If a high-impact use case does not comply with the minimum practices, the agency must safely discontinue use of the AI functionality.
High-impact AI is AI with an output that serves as a principal basis for decisions or actions with legal, material, binding, or significant effect on civil rights, civil liberties or privacy; access to education, housing, insurance, credit, employment and other programs; access to critical government resources or services; human health and safety; critical infrastructure or public safety; or strategic assets or resources.
Section 6 lists categories of agency uses of AI that are presumed to be high-impact. The presumed categories include safety-critical functions of critical infrastructure or government facilities, emergency services, fire and life safety systems within structures, food safety mechanisms, and traffic control systems. The presumed categories also include risk assessments about individuals, the identification of criminal suspects and the forecast of crime in law enforcement contexts.
The presumed categories also include the preparation or adjudication of risk assessments related to foreign nationals seeking temporary or permanent access to the United States, including for immigration, asylum, detention or travel approval. The presumed categories also include the ability to apply for, or the adjudication of, requests for critical federal services, processes and benefits, including loans and access to public housing.
The presumed categories also include the determination of the terms or conditions of Federal employment. For a use case in those categories, an appropriate agency official must submit written documentation to notify the Chief AI Officer when determining that the use case does not meet the definition of high-impact. Agencies must develop pre-deployment testing and prepare risk mitigation plans that reflect expected real-world outcomes and identify expected benefits to the AI use.
If an agency does not have access to the underlying AI source code, models, or data, it must use alternative test methodologies, such as querying the AI service and observing the outputs or providing evaluation data to the vendor and obtaining results. Agencies must complete an AI impact assessment before deploying any high-impact AI use case.
The AI impact assessment must be documented and updated periodically throughout the AI's lifecycle, and must address at a minimum the intended purpose and expected benefit, the quality and appropriateness of the data and model capability, the potential impacts on privacy, civil rights and civil liberties, reassessment scheduling, related costs, the results of independent review, and risk acceptance supported by a signature.
Agencies must conduct testing and periodic human review of AI use cases, where feasible, to identify adverse impacts to the performance and security of AI functionality, including those that may violate laws governing privacy, civil rights, or civil liberties. Agencies must ensure there is sufficient and periodic training, assessment, and oversight for operators of AI to interpret and act on the AI's output and manage associated risks.
Agencies must ensure human oversight, intervention, and accountability suitable for high-impact use cases. Agencies must ensure that individuals affected by AI-enabled decisions have access to a timely human review and a chance to appeal any negative impacts, when appropriate. Agencies must provide an option for end users and the public to submit feedback on the use case, where appropriate, and use that feedback to inform agency decision-making regarding the AI.
A pilot program for a proposed AI use case is exempt from the minimum risk management practices if the program is of limited scale and duration and the agency Chief AI Officer has certified that the pilot may go forward, with that certification tracked centrally. The pilot must also, when possible, let individuals who may interact with the AI opt into and out of participating, with sufficient notice to make an informed decision, and apply the minimum risk management practices where practicable.
An agency Chief AI Officer may waive one or more of the Section 4 requirements for a specific covered AI application or component after a written determination, based on a system-specific and context-specific risk assessment, that fulfilling the requirement would increase risks to safety or rights overall or would create an unacceptable impediment to critical agency operations.
The Chief AI Officer must certify the ongoing validity of each waiver annually, may revoke a waiver at any time, and may not delegate that responsibility to other officials. Chief AI Officers must centrally track waivers, reassess them if there are significant changes to the conditions or context in which the AI is used, and within 30 days of granting or revoking a waiver report its scope, justification and supporting evidence to OMB.
To the extent consistent with law and governmentwide policy, each agency must publicly release a summary describing each individual determination and waiver and its justification, or publicly indicate that it has no active determinations or waivers. Contract terms should protect agency data from unauthorized disclosure or use, and from being used to train or improve the functionality of a vendor's commercial offerings without express permission from the agency.
A footnote states that its requirements are consistent with the AI in Government Act of 2020, the Advancing American AI Act, Executive Order 13960 and Executive Order 14179.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or distributes a software product.