Memorandum 25-21 (Accelerating Federal Use of AI through Innovation, Governance, and Public Trust)

• Authority: Executive Office of the President
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. regulations, executive orders, and agency policies
• Most recent activity: Enacted
• Most recent activity date: 2025-04-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• AI system security vulnerabilities
• Overreliance and unsafe use
• Competitive dynamics
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unequal performance across groups
• Compromise of privacy
• False or misleading information
• Cyberattacks, weapon development or use
• Fraud, scams, and targeted manipulation
• Loss of human agency and autonomy
• AI possessing dangerous capabilities

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 10-12 subdomains, with strong focus on AI system security (2.2), governance failure (6.5), lack of robustness (7.3), lack of transparency (7.4), competitive dynamics (6.4), and various discrimination and safety risks. Coverage is concentrated in system safety, governance, and operational risk domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Health Care & Social Assistance
• Public Administration (excl. National Security)
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Agriculture, Mining, Construction & Manufacturing
• Trade, Transportation & Utilities
• Finance & Insurance
• Real Estate, Rental & Leasing
• Professional & Technical Services
• Scientific Research & Development Services
• Management, Administrative & Support Services
• Educational Services
• Accommodation, Food & Other Services

All other sectors had no coverage in this document.

Sectors Summary

This document governs AI use across all federal government operations, which spans multiple sectors including Public Administration (primary focus), National Security, Healthcare, Law Enforcement, Education, Transportation, and other government services. The governance applies to federal agencies as they develop, procure, and deploy AI systems for public services and government operations.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding executive memorandum from the Office of Management and Budget with mandatory requirements for federal agencies, enforcement mechanisms including compliance reporting, and consequences for non-compliance including discontinuation of AI use.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Office of Management and Budget (OMB); Executive Office of the President
• Summary: The memorandum is issued by the Office of Management and Budget under the authority of the Executive Office of the President, implementing Executive Order 14179 signed by President Trump.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer
• Entities: All Executive Branch departments and agencies; Independent regulatory agencies; CFO Act agencies; Federal agencies (excluding Intelligence Community for certain provisions)
• Summary: The memorandum is directed to heads of all Executive Branch departments and agencies, including independent regulatory agencies. These agencies are both developers and deployers of AI systems for government operations and public services.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Office of Management and Budget (OMB); Chief AI Officers (CAIOs); Agency heads; Chief AI Officer Council
• Summary: OMB has oversight authority and receives compliance reports. Agency heads and Chief AI Officers are responsible for implementing and enforcing requirements within their agencies. The Chief AI Officer Council coordinates enforcement across agencies.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Office of Management and Budget (OMB); Chief AI Officers (CAIOs); Chief AI Officer Council; Agency AI Governance Boards; Independent reviewers within agencies
• Summary: OMB monitors through periodic accountability reviews and reporting requirements. CAIOs are responsible for tracking high-impact use cases and ensuring ongoing monitoring. Independent reviewers assess AI impact assessments before deployment.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all AI lifecycle stages with particular emphasis on deployment, operation and monitoring. It addresses planning through AI strategy development, data governance, model development through procurement and custom development, verification through pre-deployment testing and impact assessments, deployment through risk acceptance processes, and ongoing monitoring through continuous performance evaluation.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Generative AI
• Open Weight / Open Source

Technical Scope Summary

The document explicitly mentions AI models and AI systems with detailed definitions. It does not specifically mention frontier AI, general purpose AI, task-specific AI, foundation models, generative AI (except in one policy requirement), predictive AI, or compute thresholds. It does address open source software and model weights in the context of code sharing requirements.