Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence

• Authority: Office of Management and Budget
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: Editors' Picks;U.S. regulations, executive orders, and agency policies
• Most recent activity: Defunct
• Most recent activity date: 2025-04-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• AI system security vulnerabilities
• Overreliance and unsafe use
• Loss of human agency and autonomy
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• False or misleading information
• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• Fraud, scams, and targeted manipulation
• Increased inequality and decline in employment
• Environmental harm

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 10-12 subdomains, with strong focus on AI system security (2.2), governance failure (6.5), lack of robustness (7.3), lack of transparency (7.4), unfair discrimination (1.1), privacy compromise (2.1), and false information (3.1). Coverage is concentrated in governance, system safety, discrimination prevention, and risk management domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Health Care & Social Assistance
• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Trade, Transportation & Utilities
• Information
• Finance & Insurance
• Real Estate, Rental & Leasing
• Scientific Research & Development Services
• Educational Services
• Accommodation, Food & Other Services
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document governs AI use across all federal government operations, which means it applies to AI systems used in Public Administration (excluding National Security for certain provisions) and National Security contexts. The document also indirectly governs AI use across multiple sectors through federal agency operations including Healthcare, Education, Law Enforcement (within Public Administration), Financial Services (federal programs), and Transportation (federal systems). The governance is sector-agnostic in its core requirements but includes sector-specific use cases in Appendix I.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding OMB memorandum with mandatory requirements, enforcement mechanisms, and legal authority under multiple federal statutes including the AI in Government Act of 2020 and Executive Order 14110. It uses mandatory language throughout and establishes specific compliance deadlines with consequences for non-compliance.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The memorandum is issued by OMB (Shalanda D. Young, Director) under authority of multiple federal statutes and executive orders. OMB is the primary proposer with coordination from OSTP.

Target

• Entity Types: AI_Governance_Actor, AI_Deployer
• Summary: The memorandum explicitly applies to federal agencies that develop, use, or procure AI. CFO Act agencies have additional requirements. Intelligence Community elements are excluded from certain sections.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: OMB has primary enforcement authority through reporting requirements, compliance reviews, and approval of extensions/waivers. CAIOs have delegated enforcement authority within their agencies. Authorizing officials enforce through Authorization to Operate processes.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: OMB monitors through annual inventories, certifications, and reporting requirements. CAIOs monitor agency AI use cases and compliance. AI Governance Boards provide internal oversight. An interagency council coordinates across agencies.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all AI lifecycle stages with particular emphasis on Verify and Validate, Deploy, and Operate and Monitor stages. It addresses planning through AI strategies, data collection and processing requirements, model development practices, extensive testing and validation requirements, deployment procedures, and ongoing monitoring obligations.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• Foundation Models
• AI Systems
• Generative AI
• Open Weight / Open Source

Technical Scope Summary

The document explicitly mentions AI models, AI systems, and generative AI with detailed definitions and requirements. It references dual-use foundation models and model weights. It does not explicitly define or distinguish frontier AI, general purpose AI, task-specific AI, predictive AI, or open-weight models, though it addresses concepts related to these categories. No specific compute thresholds are mentioned.