On 24 October 2024 the White House issued its first National Security Memorandum on artificial intelligence, commonly referred to as NSM-25. It directs how AI is to be used for national security objectives and, at the same time, sets governance requirements for frontier AI development and deployment. The dual character is the point: the same instrument that accelerates government adoption also constrains the most capable models.
Two halves of one document
The first half is about capability. Federal agencies are directed to adopt AI for mission purposes, with the intelligence community, defence and cybersecurity functions as the lead users. The second half is about control. Frontier AI developers and the compute infrastructure they depend on are brought into a governance framework that includes safety testing, reporting and protection of model weights.
Reading the two halves together explains a pattern that has since become consistent in US policy: adoption and restriction are not opposing camps but instruments of the same strategy. The successor instruments are discussed in our notes on the US AI leadership executive order and on EO 14365 and the national AI policy framework.
What it changes for the private sector
Companies do not receive obligations directly from a national security memorandum in the way they would from a statute, but the memo moves the market. It signals which compute and model capabilities are treated as security-relevant, and that signal is then implemented through procurement conditions, export controls and contracts. The most direct channel is export control, as the later US AI diffusion rule illustrates, and the review mechanism for the most advanced models is described in our note on the US AI model review executive order.
Two further documents show where the frame settles: the US AI Action Plan sets the growth agenda, while the White House national AI framework addresses the regulatory architecture.
Practical reading for AI companies
For non-US companies the memo matters less as a rule and more as a boundary condition on supply. Compute access, model availability and cloud terms all move when frontier AI is classified as a security asset. Companies with cross-border training, inference or model distribution should therefore map their dependencies on US-origin compute and model capability now, and check whether any contract term allows a supplier to withdraw access on national security grounds.
This article is based on the White House National Security Memorandum on AI (NSM-25) and public information and is for reference only; it does not constitute legal advice.