Common Intelligence Community Interim Guidance Regarding the Acquisition and Use of Foundation AI Models

• Authority: Federal government
• Jurisdiction: United States
• Collections: U.S. regulations, executive orders, and agency policies
• Most recent activity: Proposed
• Most recent activity date: 2024-10-24

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• Governance failure
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on privacy compromise (2.1), AI system security vulnerabilities (2.2), governance failure (6.5), lack of robustness (7.3), and lack of transparency (7.4). Coverage is concentrated in privacy/security, governance, and AI system safety domains, reflecting the document's focus on protecting U.S. person information while enabling IC use of foundation models.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document exclusively governs AI use within the National Security sector, specifically Intelligence Community elements. It does not regulate AI use in other economic sectors, though it addresses acquisition of commercially developed models from the Information sector.

Legislative Status

Soft Law

Legislative Status Summary

This is interim guidance providing interpretive framework for existing regulations (AG Guidelines, E.O. 12333) rather than creating new binding legal obligations. The document uses predominantly advisory language ('should') and explicitly states it is 'supplemental to and does not supersede any applicable law.'

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: The document explicitly states it is provided by 'interagency lawyers, in coordination with their policy counterparts' and requires consultation with specific government legal offices.

Target

• Entity Types: AI_Governance_Actor, AI_Deployer
• Summary: The guidance explicitly applies to IC elements that acquire, modify, or use foundation AI models in their intelligence operations.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The document establishes consultation and coordination requirements with specific legal offices and requires IC elements to ensure compliance through their General Counsel offices.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The document establishes a six-month review cycle by interagency lawyers and requires IC elements to consult with privacy officials and Chief AI Officers.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily covers the Deploy and Operate and Monitor stages of the AI lifecycle, with some coverage of Plan and Design. It focuses on acquisition decisions, deployment procedures, and ongoing monitoring of foundation models used by Intelligence Community elements, with particular emphasis on privacy safeguards and compliance requirements throughout operational use.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• Foundation Models
• Frontier AI
• AI Systems
• General Purpose AI

Technical Scope Summary

The document explicitly focuses on foundation models (FMs), with specific attention to frontier models and large language models (LLMs). It provides detailed definitions of these terms and addresses model weights, modification, and augmentation. There is no mention of general purpose AI, task-specific AI, generative AI, predictive AI, open-weight models, or compute thresholds.