M-25-21 vs M-24-10: What Actually Changed in Federal AI Governance

In March 2025, a federal health agency's Chief Information Officer signed off on a 47-page AI use case inventory --- cataloguing every AI system from the cafeteria chatbot to the claims-adjudication model --- and submitted it to OMB as required by M-24-10. Three weeks later, OMB rescinded M-24-10 entirely. That inventory, and the six months of cross-agency coordination behind it, was suddenly an artifact of a policy that no longer existed.

M-25-21, issued April 2025, is not a cosmetic revision. It restructures the federal government's approach to AI governance around risk proportionality and executive accountability rather than exhaustive cataloguing. Organizations still running M-24-10 playbooks are not merely outdated --- they are allocating resources to requirements that no longer exist while missing the ones that do.

Why Now: The Compliance Gap Is Already Generating Findings

M-25-21 has been live for over a year. Agencies have reported under it. Inspectors General are auditing against it. Yet a surprising number of contractors and software vendors are still building AI governance documentation to M-24-10 specifications --- comprehensive use case inventories, blanket impact assessments for every AI system regardless of risk level, governance structures that assume the old memo's architecture.

The problem is not that M-24-10 playbooks are wrong. Much of the underlying intent carries forward. The problem is that M-25-21 changes where the weight falls. If your AI governance program is spending 80% of its effort on inventorying low-risk AI systems (the chatbot, the spam filter, the meeting summarizer) and 20% on governing high-risk ones (the claims adjudicator, the threat detector, the hiring screener), you have the ratio exactly backwards under the new memo.

EO 14179 --- the current federal AI policy executive order --- establishes the policy foundation that M-25-21 operationalizes. Together, they represent the clearest articulation of what federal AI governance actually requires. And for contractors selling AI-enabled products into federal environments, what your customers are required to do will inevitably become what they require of you.

What M-24-10 Required (and What Is Now Gone)

Understanding what M-25-21 dropped is as important as understanding what it added. M-24-10, issued in March 2024, represented the first comprehensive attempt to operationalize federal AI governance. Its core requirements:

The comprehensive AI use case inventory. Every agency was required to identify, document, and publicly report all AI use cases. No risk threshold. No materiality filter. The cafeteria chatbot and the nuclear safety model received the same documentation requirement.

Blanket impact assessments. Every AI use case classified as "safety-impacting" or "rights-impacting" required a full impact assessment --- the same depth of analysis regardless of whether the system was a procurement recommendation engine or an autonomous targeting system.

Decentralized governance. M-24-10 designated CAIOs and governance boards, but the day-to-day accountability structure was diffuse. Multiple offices could share oversight without clear escalation paths.

Binary risk classification. A system was either safety/rights-impacting (full requirements apply) or it was not (minimal requirements). No middle ground. No proportionality.

The result was predictable: agencies buried in documentation obligations for low-risk systems while genuinely high-risk deployments received the same level of attention as everything else. When everything is equally important, nothing is prioritized.

What M-25-21 Actually Changed

1. Risk-Tiered Governance Replaces the Blanket Inventory

The most significant structural change: M-25-21 replaces the exhaustive inventory requirement with a risk-tiered governance model. AI systems are now classified into tiers that determine the depth of documentation, oversight, and review required.

High-risk systems --- those making consequential decisions about benefits, enforcement, safety, or rights --- receive intensive governance: full impact assessments, mandatory human oversight mechanisms, continuous monitoring, and incident response procedures. Low-risk systems --- the chatbots, the scheduling optimizers, the document summarizers --- receive proportional governance: documented existence, responsible owner, and periodic review.

This is not weaker governance. It is smarter governance. Resources flow to systems where failures cause real harm, not to systems where the worst outcome is a bad meeting summary.

2. The Chief AI Officer Accountability Model

M-24-10 created the Chief AI Officer (CAIO) role at every CFO Act agency --- 24 agencies. M-25-21 retains the CAIO and sharpens the role into explicit personal accountability for AI governance outcomes. This is not a figurehead role. The CAIO is responsible for:

Approving high-risk AI deployments before they go live
Reporting to OMB on governance compliance
Overseeing the agency's AI risk management program
Serving as the escalation point when AI systems produce adverse outcomes

The accountability model changes the dynamics entirely. Under M-24-10, AI governance was a distributed obligation. Under M-25-21, one person signs their name to it. That person has both the authority to block deployments and the exposure when things go wrong.

For contractors: your federal customer now has a specific individual whose career depends on AI governance working. That person needs tools, documentation, and evidence. They need to demonstrate that vendor-supplied AI systems are governed to the standard M-25-21 requires.

3. Proportional Review Replaces Blanket Impact Assessments

M-24-10 required the same impact assessment for every safety-impacting or rights-impacting AI system. M-25-21 introduces proportional review: the depth of assessment scales with the potential for harm.

A system that recommends (but does not execute) procurement decisions gets a lighter review than a system that adjudicates benefits claims. A system operating under continuous human oversight gets a lighter review than one operating autonomously. The assessment is proportional to the actual risk profile, not to the binary classification.

This aligns with NIST AI RMF 1.0, which has always advocated a graduated, context-sensitive approach to AI risk. M-25-21 brings the federal policy architecture into alignment with the framework that was supposed to guide it.

4. Alignment with EO 14179

M-24-10 was issued under the authority of EO 14110. When EO 14110 was rescinded and EO 14179 took its place, M-24-10 was left referencing an executive order that no longer existed. M-25-21 is architecturally aligned with EO 14179: it uses the same risk vocabulary, the same oversight expectations, and the same accountability structures.

This matters for compliance documentation. If your AI governance program references EO 14110 and M-24-10, it references two rescinded instruments. Assessors will notice.

5. Continuous Monitoring Over Point-in-Time Assessment

M-24-10 was largely oriented toward point-in-time documentation: inventory it, assess it, file it. M-25-21 introduces ongoing monitoring requirements for high-risk AI systems. Agencies must demonstrate not just that an AI system was assessed before deployment, but that it continues to perform as intended, that its risk profile has not changed, and that its oversight mechanisms remain effective.

This maps directly to the MANAGE function in NIST AI RMF 1.0 and to NIST AI 600-1's guidance on generative AI risk management. The policy now expects that AI governance is a continuous process, not a pre-deployment checkbox.

What Carries Over (the M-24-10 Foundations That Still Apply)

Not everything changed. Several M-24-10 principles survived, often with structural reinforcement:

Transparency requirements. Agencies must still disclose AI use to affected individuals. M-25-21 maintains and strengthens notification requirements, particularly for systems that influence decisions about rights, benefits, or safety.

Human oversight. The principle that AI recommends and humans approve remains foundational. M-25-21 does not relax the human-in-the-loop requirement for consequential decisions --- it strengthens accountability for that oversight.

Public reporting. Agencies still report AI use cases publicly. The difference: reporting focuses on high-risk systems and governance outcomes rather than exhaustive inventories of every AI tool in the agency.

NIST alignment. Both memos reference NIST AI RMF as the methodological foundation. M-25-21 makes this alignment more explicit by adopting NIST's risk-tiering vocabulary directly.

What Breaks If You Are Still Running M-24-10 Playbooks

Here is the contrarian take that M-24-10 loyalists need to hear: a comprehensive AI use case inventory is now a waste of your CAIO's time.

Under M-24-10, the inventory was the deliverable. Under M-25-21, the deliverable is demonstrable governance of high-risk systems. If your program is still spending months cataloguing every AI system in your environment --- including low-risk utilities that require only light-touch governance --- you are burning cycles on work that is no longer measured while the work that is measured goes undone.

Specifically, these M-24-10 artifacts need updating or retirement:

M-24-10 Artifact	M-25-21 Status	Action Required
Comprehensive AI use case inventory	Replaced by risk-tiered registry	Retain high-risk entries; deprioritize exhaustive cataloguing
Blanket impact assessments (all systems)	Replaced by proportional review	Scale assessment depth to risk tier
EO 14110 references in documentation	Rescinded	Update all references to EO 14179
Decentralized governance structure	Replaced by CAIO accountability	Establish clear CAIO reporting chain
Point-in-time assessment documentation	Supplemented by continuous monitoring	Implement ongoing monitoring for high-risk systems
Binary risk classification	Replaced by graduated risk tiers	Reclassify AI systems on a proportional scale

The Contractor Impact: What This Means for Federal Vendors

Federal contractors selling AI-enabled platforms face a specific set of implications:

Your customer's CAIO needs evidence. The CAIO must report on governance outcomes. That means your product must generate the documentation, audit trails, and oversight records that feed the CAIO's reporting. If your platform cannot produce an AI governance audit trail on demand, you are creating work for your customer's compliance team rather than reducing it.

Risk-tiering must be demonstrable. Your platform's AI capabilities must be classifiable within your customer's risk-tiering scheme. Can you articulate which of your AI features are high-risk (autonomous decisions) versus low-risk (assistive recommendations)? Can you document the human oversight mechanisms for each tier?

Continuous monitoring is now contractual. If your AI-enabled product is classified as high-risk in your customer's environment, you may need to provide ongoing performance monitoring data, drift detection, and incident reporting --- not just a pre-deployment assessment.

Provenance matters. M-25-21, aligned with EO 14179, expects transparency about AI system provenance. Where do the models come from? How were they trained? What data informs their outputs? A 12-provider BYOAI architecture that lets organizations control their AI supply chain is no longer a feature --- it is a governance enabler.

Key Takeaways

M-24-10 is rescinded. Any governance documentation referencing it needs updating. References to EO 14110 similarly need replacement with EO 14179.
Risk-tiered governance replaces exhaustive inventories. Focus governance resources proportionally on high-risk AI systems. Low-risk systems require light-touch oversight.
The CAIO is personally accountable. Federal AI governance now has a named individual responsible for outcomes at each CFO Act agency. Your products need to support their reporting requirements.
Proportional review replaces blanket assessments. The depth of governance scales with potential for harm, aligned with NIST AI RMF 1.0.
Continuous monitoring is required for high-risk systems. Point-in-time assessments are necessary but no longer sufficient. Ongoing performance validation is expected.
Contractors are downstream of all of this. What agencies must do, they will require their vendors to support.

Frequently Asked Questions

Is M-24-10 still enforceable in any context?

No. M-24-10 was formally rescinded when M-25-21 was issued in April 2025. However, work completed under M-24-10 --- particularly AI use case inventories and impact assessments --- remains valuable as input to M-25-21 compliance. You do not need to discard prior work; you need to reframe it within the new risk-tiered structure.

Does M-25-21 apply to contractors or only to federal agencies?

M-25-21 applies directly to CFO Act agencies. However, its requirements flow down to contractors through procurement requirements, contract clauses, and agency-specific AI governance policies. If your federal customer classifies your product's AI capabilities as high-risk, you will need to support their governance requirements --- continuous monitoring, provenance documentation, human oversight evidence.

What is the relationship between M-25-21 and NIST AI RMF?

M-25-21 operationalizes NIST AI RMF 1.0 as federal policy. The memo adopts AI RMF's vocabulary (GOVERN, MAP, MEASURE, MANAGE functions) and its risk-tiered approach. Organizations already implementing AI RMF will find M-25-21 requirements familiar. NIST AI 600-1 provides additional guidance specific to generative AI risk management within the same framework.

Do we still need an AI use case inventory?

Yes, but its scope and purpose have changed. M-25-21 requires agencies to maintain awareness of AI deployments and classify them by risk tier. The difference: you no longer need the same depth of documentation for a low-risk chatbot as for a high-risk adjudication system. Focus inventory effort on identification and classification; focus governance effort on high-risk systems.

How quickly should organizations transition from M-24-10 to M-25-21?

Immediately, if you have not already. M-25-21 has been in effect since April 2025. Agencies have already reported under it. IG audits are evaluating against it. Any organization still building AI governance documentation to M-24-10 specifications is producing artifacts that do not align with current policy --- and missing requirements that do.

How Advisedly Helps

Advisedly's AI governance module implements M-25-21's risk-tiered governance model natively --- AI systems are classified by risk tier, governance requirements scale proportionally, and the platform generates CAIO-ready reporting with full provenance chains and continuous monitoring evidence across 500+ compliance frameworks. AI recommends, humans approve --- the oversight model M-25-21 demands is how the platform works by default. begin@advisedly.ai