OMB Memorandum M-25-21 establishes a binding AI governance mandate for federal civilian agencies. Issued in April 2025 to implement Executive Order 14179, the memo means vendors selling into these accounts will inherit its compliance checkpoints.

The memo directs agencies to designate or retain a Chief AI Officer, convene AI governance bodies, update internal AI policies, develop generative-AI acceptable-use policies, maintain AI use-case inventories, apply risk-management controls to “high-impact AI,” and document governance decisions. Compliance teams must map the per-requirement deadlines directly from the memo text.

M-25-21 defines “high-impact AI” as systems whose output is the principal basis for a decision with a legal, material, binding, or significant effect on rights or safety. That status can attach even when humans remain in the loop, which makes the definition a likely reference point for other regulators and enterprise compliance teams.

HHS has already published an agency-specific M-25-21 compliance plan, demonstrating that agencies are already operationalizing these requirements. Security leaders at vendors should expect CAIO sign-off, inventory entries, and high-impact AI controls to become prerequisites in civilian RFPs.

Source: Zscaler