Framework to Advance AI Governance and Risk Management in National Security

• Authority: Executive Office of the President
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: Editors' Picks;U.S. regulations, executive orders, and agency policies
• Most recent activity: Enacted
• Most recent activity date: 2024-10-24

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Compromise of privacy
• AI system security vulnerabilities
• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• Overreliance and unsafe use
• Loss of human agency and autonomy
• AI pursuing its own goals
• AI possessing dangerous capabilities
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• False or misleading information
• Fraud, scams, and targeted manipulation
• Competitive dynamics

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 12-14 subdomains, with strong focus on discrimination and bias (1.1, 1.3), privacy and security (2.1, 2.2), misinformation (3.1), malicious actors (4.1, 4.2, 4.3), human-computer interaction (5.1, 5.2), governance (6.5), and AI safety failures (7.1, 7.2, 7.3, 7.4). Coverage is concentrated in security, misuse prevention, governance oversight, and AI safety domains relevant to national security contexts.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Scientific Research & Development Services
• Health Care & Social Assistance

All other sectors had no coverage in this document.

Sectors Summary

This framework primarily governs the National Security sector, with explicit coverage of military, intelligence, and defense operations. It also has significant coverage of Public Administration (excluding National Security) through its application to federal agencies, and touches on Immigration services within government operations.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding executive framework issued by the Executive Office of the President with mandatory requirements, enforcement mechanisms, and clear accountability structures for federal agencies in national security contexts.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document is issued by the Executive Office of the President and references NSC Deputies Committee approval processes for updates, indicating these are the proposing authorities.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer
• Summary: The framework explicitly applies to federal agencies using AI in national security contexts, including both developers and deployers of AI systems within these agencies.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The document establishes multiple enforcement roles including Chief AI Officers with waiver authority, AI Governance Boards for oversight, and reporting requirements to APNSA and Department Heads.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The framework establishes comprehensive monitoring through Chief AI Officers maintaining inventories, privacy and civil liberties officers conducting annual reviews, and reporting to APNSA.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all AI lifecycle stages with particular emphasis on Verify and Validate, Deploy, and Operate and Monitor stages. It addresses planning through risk assessments, data collection and processing through data management policies, model building through development requirements, extensive validation and testing requirements, deployment notification and approval processes, and ongoing monitoring and evaluation mechanisms.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document explicitly mentions AI systems and AI models throughout, with particular focus on high-impact AI use cases in national security contexts. It does not explicitly define or distinguish between frontier AI, general purpose AI, task-specific AI, foundation models, generative AI, or predictive AI. There is no mention of compute thresholds or open-weight/open-source models. The framework applies broadly to AI as a component of National Security Systems without technical categorization by model type.