OMB Memorandum M-24-10: Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence
United States · Regulation · Office of Management and Budget
Our summary
This memorandum establishes requirements for federal agencies to manage artificial intelligence governance, innovation, and risk. It mandates that agencies designate Chief AI Officers, develop strategies for responsible AI adoption, and implement minimum practices for managing risks when using AI systems that affect public rights and safety.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
6 sections
Jump to a chapter
1 Overview
The memorandum establishes requirements for federal agencies on governance, innovation, and risk management for AI, including designating a Chief AI Officer within 60 days and developing enterprise strategies for responsible AI adoption while removing infrastructure, data, security, and workforce barriers. Agencies must implement minimum practices for safety-impacting and rights-impacting AI and manage risks from specific categories of AI presumed to impact rights and safety. The memorandum also provides recommendations for managing AI risks in federal procurement contexts.
2 Scope
This memorandum addresses a limited set of AI risks and governance issues related to how agencies depend on AI for decisions or actions that could harm effectiveness, safety, fairness, transparency, accountability, or lawfulness, with some requirements limited to CFO Act agencies and some exclusions for Intelligence Community elements. It covers new and existing AI developed, used, or procured by covered agencies, but excludes agencies' regulatory actions prescribing policy on non-agency AI uses, evaluations of AI providers subject to enforcement actions, development of public testing standards and metrics, and research activities except where intended to develop particular agency AI applications. It does not apply to AI used as a component of National Security Systems, which are governed through other policy.
3 Strengthening artificial intelligence governance
Agency heads are responsible for AI innovation and compliance, with each agency designating a Chief AI Officer within 60 days and CFO Act agencies convening senior officials within the same deadline. All agencies except DoD and Intelligence Community must submit compliance plans to OMB within 180 days and every two years until 2036, and annually inventory safety-impacting and rights-impacting AI uses with associated risks. Chief AI Officers at CFO Act agencies must hold Senior Executive Service or equivalent positions with authority to coordinate AI governance, conduct risk assessments, manage enterprise-wide AI risk mitigation especially for safety and rights-impacting AI, establish performance monitoring processes, ensure inventory and release of custom-developed AI code and data, develop agency guidance with privacy and civil rights officials, and waive individual applications from requirements; at other agencies, positions must be at least GS-15 or equivalent.
4 Advancing responsible artificial intelligence innovation
CFO Act agencies (except DoD and Intelligence Community) must develop and publish an AI strategy within 365 days covering current and planned AI uses, maturity assessment, governance including Chief AI Officer and AI Governance Boards, infrastructure and capacity, and equitable outcomes and civil rights; remove obstacles to responsible AI while preserving safeguards; share adequate IT infrastructure, develop capacity for quality-assessed data sharing, update cybersecurity processes, establish generative AI safeguards, and recruit AI talent including an AI Talent Lead. Agencies must share custom-developed AI code, models, and weights as open source unless restricted by law, security or privacy risks, contractual obligations, or mission or system stability risks, prioritizing code with greatest reuse potential, and release AI development and testing data as open government data when required by the OPEN Government Data Act; where some elements cannot be publicly released, agencies should share remaining elements where practicable, including through controlled access via federal infrastructure, and structure contracts to allow sharing and public release.
5 Managing risks from the use of artificial intelligence
Agencies must implement minimum risk management practices for safety-impacting and rights-impacting AI by December 1, 2024, or discontinue non-compliant systems, with exceptions for Intelligence Community elements and procurement/testing uses; they must assess AI against definitions in Appendix I, apply documented practices addressing safety, security, civil rights, privacy and worker well-being, conduct impact assessments, test in real-world contexts, and arrange independent review. For rights-impacting AI, agencies must by December 1, 2024 identify and mitigate discrimination and disparities across demographic groups through testing, provide accessible documentation and notification to affected individuals, consult affected communities, enable appeal or alternative oversight, and offer opt-out options where practicable unless used for fraud prevention, cybersecurity or criminal investigation. Agencies may request one-year non-renewable extensions or seek waivers from their Chief AI Officer based on documented risk assessment; they should ensure procured AI complies with law, obtain adequate documentation and test in deployment environments, use competitive procurement to prevent vendor lock-in, secure data rights, and include risk management requirements in generative AI contracts covering testing and evaluation.
6 Definitions
This section defines artificial intelligence as systems that perform tasks under varying conditions with minimal human oversight, learn from data, or demonstrate human-like abilities, encompassing machine learning, deep learning, reinforcement learning, and generative approaches while excluding robotic process automation and fixed-rule systems. Safety-impacting AI encompasses systems whose output drives action or supports principal decisions potentially affecting human life or well-being, climate or environment, critical infrastructure, or strategic assets, with 14 presumed categories including controlling critical infrastructure, applying force, detecting weapons, and medical functions. Rights-impacting AI affects people who reasonably expect human responsibility for outcomes, with presumed categories including blocking protected speech, law enforcement assessments, biometric identification, surveillance, immigration and detention decisions, emotion or deception detection, voice or likeness replication without consent, education and admissions decisions, housing and employment determinations, financial decisions such as loan and credit allocation, resource access and fraud detection, translation without interpreters, and child protective recommendations.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 3 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 1 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 2 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 6 are shown.
1 4 controls
- ObligationApplies to: Public authorityDrafted by the Index
Each federal agency must designate a Chief AI Officer within 60 days to oversee AI governance and coordinate with other responsible officials.
- ObligationApplies to: Public authorityDrafted by the Index
Federal agencies must manage AI risks to prevent harm to decision quality, safety, fairness, and lawfulness when AI informs or executes agency decisions.
- ObligationApplies to: Public authorityDrafted by the Index
Each CFO Act agency must develop an enterprise strategy for how it will responsibly adopt and use AI, including generative AI.
Applies when: CFO Act agency
- Applies to: Public authorityDrafted by the Index
Agencies should reduce barriers to responsible AI use by removing obstacles in information technology, procurement, and related domains.
4 2 controls
- Applies to: Public authorityDrafted by the Index
Agencies should prioritize AI development and adoption for applications that serve the public good and address societal challenges such as accessibility, food insecurity, climate, health, and equity.
- ObligationApplies to: Public authorityDrafted by the Index
Within 365 days, each CFO Act agency must develop and publicly release a strategy covering its current and planned AI uses, maturity assessment, governance plans, enterprise capacity for innovation, and risk management.
Applies when: CFO Act agency
Change history
No changes recorded since we began monitoring this policy.