Whether artificial intelligence is unethical depends on the specific system, the decision it influences, and the safeguards around it, and the most concrete test in U.S. law today is the federal government's own rulebook for its AI. Office of Management and Budget (OMB) memorandum M-25-21, issued April 3, 2025, requires agencies to apply seven minimum practices to "high-impact" AI, meaning AI whose output is a principal basis for decisions with legal, material, binding, or significant effects on rights or safety. The memo binds executive-branch agencies, not private companies, but it shows what a working definition of responsible use looks like on paper.
Key takeaways
- M-25-21 replaced the earlier OMB memo M-24-10 and sets seven minimum practices for high-impact federal AI, from pre-deployment testing to appeals.
- Uses such as biometric identification in law enforcement, medical diagnosis, and hiring decisions are presumed high-impact.
- Agencies had 365 days from April 3, 2025 to document compliance, and non-compliant high-impact use must be safely discontinued.
- A Chief AI Officer can waive a practice in writing, and waivers must be certified yearly and summarized publicly.
- The memo covers federal agencies only. Private-sector AI falls under other laws, and some of those are covered in related articles on this site.
Why a yes or no answer does not work
Ethical judgments attach to uses, not to a technology as a whole. A spelling checker and a system that scores benefit claims both involve machine learning, but a wrong output from one costs a typo and from the other can cost a household its income. Public debate often skips this point and argues about AI in general.
Governments that want to act on the question have to turn it into something checkable. The U.S. approach in M-25-21 is to sort uses by consequence first, then require evidence, oversight, and a way to challenge results for the uses that matter most. That is a useful template for readers evaluating any organization's claims about responsible AI, whether or not the organization is a federal agency.
What counts as high-impact
The memo defines high-impact AI as AI whose output serves as a principal basis for decisions or actions with legal, material, binding, or significant effect on civil rights, civil liberties, or privacy; access to education, housing, insurance, credit, employment, or other programs; access to critical government services; human health and safety; critical infrastructure or public safety; or strategic assets. A high-impact finding is possible whether or not a human oversees the decision.
Some categories are presumed high-impact. They include medically relevant functions of devices, patient diagnosis and treatment, risk assessments about individuals in law enforcement, identification of criminal suspects, biometric identification such as facial matching, one-to-many biometric identification in public spaces, determinations about benefits eligibility, and federal hiring, pay, and termination decisions. An agency official who believes a presumed case is not high-impact must document that reasoning for the Chief AI Officer (CAIO).
The seven minimum practices
| Practice | What the memo requires |
|---|---|
| Pre-deployment testing | Testing and risk mitigation plans reflecting expected real-world outcomes; if the agency cannot see the model, it must query the service and check outputs or get vendor results |
| AI impact assessment | Documented purpose and benefit, data quality, effects on privacy and civil rights, reassessment schedule, cost analysis, independent internal review, and a signed risk acceptance |
| Ongoing monitoring | Testing and periodic human review designed to catch performance problems, post-deployment changes, and legal violations |
| Human training and assessment | Periodic, system-specific training for operators who interpret and act on outputs |
| Human oversight and accountability | Oversight suited to the use case and, where practicable, a fail-safe that limits significant harm |
| Remedies and appeals | Timely human review and a chance to appeal negative impacts, when appropriate |
| Public and user feedback | A way for end users and the public to comment on the use case, where appropriate |
The independent review in the impact assessment is worth noting. The reviewer must be inside the agency but not involved in building the system, and any concerns are shared with the person who signs off on the risk.
Exceptions, waivers, and limits
The rulebook is not absolute. Limited pilot programs are exempt from the minimum practices if the CAIO certifies the pilot, people can opt out where possible, and the practices are applied where practicable. A CAIO may also waive a practice after a written, system-specific risk assessment concluding that meeting it would increase overall risk to safety or rights or would create an unacceptable impediment to critical operations. The CAIO must recertify each waiver yearly and report to OMB within 30 days of granting or revoking one, and agencies must publish a summary of each determination and waiver or state that they have none.
The memo's text also excludes elements of the Intelligence Community from these requirements, though it encourages them to follow along. Readers should treat the memo as a statement of federal policy, which can change with a new memorandum. At the last check in October 2026, OMB's memoranda page did not list M-25-21 as rescinded or superseded. A later memo, M-26-04, issued December 11, 2025, addresses unbiased AI principles in government purchases of language models and does not replace it.
Using the template outside government
A reader assessing an employer, school, vendor, or app can borrow the memo's questions even though they carry no legal force there:
- What decision does the system influence, and who bears the consequences of an error?
- Was it tested before launch on conditions like real use?
- Is anyone trained and accountable for acting on its output?
- Can an affected person reach a human reviewer and appeal?
- Does anyone independent of the builders review the risks?
Canadian federal institutions work under a separate Treasury Board directive, which the related article on Canadian AI regulation covers.
This article gives general information about a federal policy document as of October 2026. It is not legal advice and does not address any specific organization's obligations. Questions about compliance belong with qualified counsel or the primary text of the memo.
FAQ
Is M-25-21 a law?
No. It is an OMB memorandum directing executive-branch agencies, issued under the authority of the executive branch and referring to Executive Orders 13960 and 14179. Congress did not pass it, and it does not bind private companies.
Does the memo ban any kind of AI?
It does not ban technologies. It requires safeguards for high-impact uses and says that a non-compliant high-impact use must be safely discontinued by the agency.
Who decides that a use is high-impact?
The agency, with its Chief AI Officer overseeing the determination. Presumed categories require written documentation to rebut, and the CAIO can revisit any determination at any time.
Can an individual appeal a decision made with AI help?
The memo requires agencies to provide timely human review and a chance to appeal negative impacts from high-impact AI-enabled decisions, when appropriate. Whether a specific benefit program has such a process depends on that program's own rules.
Related reading
- Canada's AI regulation status
- Threat or tool: the debate
- Who owns AI systems
- Ethics of AI-generated art
More in AI Policy and Ethics.
Last verified: October 2026
Sources
- Accelerating Federal Use of AI through Innovation, Governance, and Public Trust (M-25-21), Office of Management and Budget, April 3, 2025
- Memoranda for the heads of executive departments and agencies, Office of Management and Budget, White House, 2026
- Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles (M-26-04), Office of Management and Budget, December 11, 2025