Advancing the Responsible Acquisition of Artificial Intelligence in Government

• Authority: Office of Management and Budget
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: Editors' Picks;U.S. regulations, executive orders, and agency policies
• Most recent activity: Defunct
• Most recent activity date: 2025-04-03

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Exposure to toxic content
• Unequal performance across groups
• Compromise of privacy
• AI system security vulnerabilities
• Competitive dynamics
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• False or misleading information
• Overreliance and unsafe use
• Environmental harm
• AI pursuing its own goals

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 10-12 subdomains, with strong focus on privacy compromise (2.1), AI system security vulnerabilities (2.2), false information (3.1), unfair discrimination (1.1), governance failure (6.5), competitive dynamics (6.4), lack of robustness (7.3), lack of transparency (7.4), and goal misalignment (7.1). Coverage is concentrated in privacy/security, discrimination, governance, and AI safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Professional & Technical Services
• Scientific Research & Development Services
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document governs AI acquisition across all federal government operations, primarily affecting the Public Administration sector. It establishes requirements for how federal agencies acquire AI systems and services, with implications for vendors across multiple sectors including Information (AI developers), Professional and Technical Services (consultants), and Scientific Research and Development Services (AI research organizations) that contract with the government.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding OMB memorandum issued under statutory authority that creates mandatory obligations for federal agencies with specific enforcement mechanisms, compliance deadlines, and reporting requirements.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Office of Management and Budget (OMB); Shalanda D. Young (OMB Director)
• Summary: The memorandum is issued by the Office of Management and Budget under the authority of the Advancing American AI Act and Executive Order 14110, as indicated by the header and signature.

Target

• Entity Types: AI_Governance_Actor, AI_Deployer
• Entities: Federal agencies defined in 44 U.S.C. § 3502(1); Chief Financial Officers Act (CFO Act) agencies; Executive departments and agencies
• Summary: The memorandum explicitly applies to federal agencies acquiring AI systems or services, with specific requirements for CFO Act agencies. It excludes Intelligence Community elements but covers all other executive branch agencies.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Office of Management and Budget (OMB); Agency Chief Artificial Intelligence Officers (CAIOs); Agency Chief Acquisition Officers (CAOs); Agency Chief Information Officers (CIOs); Senior Agency Officials for Privacy (SAOPs)
• Summary: OMB oversees implementation and receives compliance reports. Agency CAIOs, CAOs, CIOs, and SAOPs are responsible for implementing and enforcing requirements within their respective agencies.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Office of Management and Budget (OMB); CAIO Council; CIO Council; CAO Council; Federal Privacy Council (FPC); General Services Administration (GSA); Federal Acquisition Regulatory (FAR) Council
• Summary: OMB monitors implementation through required agency submissions. Multiple interagency councils monitor compliance and share best practices. GSA facilitates information sharing and monitoring across agencies.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all AI lifecycle stages with particular emphasis on deployment, operation and monitoring. It addresses planning and design through acquisition planning requirements, data collection and processing through data management requirements, model building through training and development requirements, verification and validation through extensive testing requirements, deployment through implementation requirements, and ongoing monitoring through continuous evaluation requirements.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Generative AI
• Open Weight / Open Source

Technical Scope Summary

The document explicitly mentions AI systems and AI models throughout, with detailed coverage of generative AI. It does not explicitly define or mention frontier AI, general purpose AI, task-specific AI, foundation models, predictive AI, or compute thresholds. It addresses open-source models in the context of interoperability and does not specify compute thresholds.