Easy to grant, hard to defend: M-24-10 put every federal AI exception on the record

The week

On March 28, 2024, the White House budget office told federal agencies, in effect, that if an AI tool touched people’s rights or safety, they had to prove it was being run responsibly by a fixed date, or stop using it. Many of the tools in question are unglamorous: a computer model in a benefits office, say, that helps decide which applications get a closer look. Nobody in the building thinks of it as “artificial intelligence.” It is just the system.

The memo was M-24-10, issued by the Office of Management and Budget under the title Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence. OMB is the part of the Executive Office of the President that sets management rules for federal agencies. Vice President Kamala Harris announced the memo, and it finalized a draft OMB had released for public comment in November 2023.

The memo had a lineage. President Biden’s executive order on AI, signed on October 30, 2023, directed OMB to issue this guidance. Before that, a December 2020 executive order and the Advancing American AI Act of 2022 had already required agencies to inventory their AI use cases. Those earlier inventories were uneven. Some agencies listed dozens of uses, others very few, and outside researchers had questioned how complete they were. M-24-10 tied new obligations to the inventory, which gave agencies a reason to make it accurate.

The first instructions were about people. Each agency had to designate a Chief AI Officer within 60 days: a single senior official accountable for how the agency uses AI. The larger agencies covered by the CFO Act, the law that set up chief financial officers across the big departments, also had to convene AI governance boards, so that decisions would not rest with one technical team. Those agencies also had to publish AI strategies within a year.

The memo then listed purposes it presumed to be “rights-impacting” or “safety-impacting.” These ran from deciding who is eligible for benefits, to biometric identification (recognizing people by their face, fingerprints or other physical traits), to credit decisions. Safety-impacting examples included controlling critical infrastructure, operating vehicles and making medical decisions. For any AI used for those purposes, agencies had to apply a set of minimum risk management practices by December 1, 2024. If they could not, they had to stop using the AI.

The practices were specific. Before relying on such a system, an agency had to complete an AI impact assessment covering its purpose, expected benefits, risks and the quality of its data. It had to test the system in conditions resembling real use and have it evaluated independently. Once the system was running, the agency had to monitor it, train and oversee the people using it, and give public notice and plain-language documentation. Rights-impacting uses carried further duties: assessing effects on equity, consulting affected communities, notifying people harmed by an AI-assisted decision, offering human review and remedy, and allowing an opt-out where practicable.

The calendar was tight. Chief AI Officers were due by late May, compliance plans by late September, extension requests by October 15 and the practices themselves by December 1. Agencies had about eight months to find their systems, gather evidence and choose a path for each one. For a large department with many components, that meant coordinating dozens of program offices at once.

The draft had already contained that comply-or-stop deadline. What the final text added was a precise description of the ways out. It set out three formal exceptions. The first was a determination by the Chief AI Officer that a presumed use did not actually meet the definition. The second was a Chief AI Officer waiver of specific practices. The third was a one-year extension granted by OMB itself.

Agencies also had to publish compliance plans within 180 days, and update them every two years. The memo’s reach had limits. It did not cover national security systems, and some of its requirements did not apply to elements of the intelligence community. It also did not bind the state agencies that run many federal benefit programs with federal money.

The memo also pushed agencies forward. It told agencies not to impose blanket bans on generative AI and encouraged them to share code and models across government. OMB also asked the public for input on how agencies should buy AI, a step toward the acquisition guidance it issued later that year.

Taken together, the week’s news was less about AI technology than about accountability: who signs, on what evidence, and who gets to read the result.

The November 2023 draft had already set the comply-or-stop deadline, with its work of finding systems in scope, retrofitting the minimum practices and planning for a shutdown. The final memo kept all of that and spelled out the exits in detail.

It defined three distinct exceptions and attached the same discipline to each: a named official, evidence written down before the decision, and a record that OMB or the public would see. That turned every exception into something an agency would later have to defend. The three exceptions are a determination that a use is out of scope, a waiver of a specific practice, and an extension of time.

Leaders outside government have reason to study it closely. It is one of the clearest examples yet of how a regulator thinks about AI risk, and the same logic of named owners, evidence and published records is turning up in banking, insurance and healthcare oversight.

The sections below start with what AI looks like inside an agency, then take the three exceptions in turn. A further section follows how the choice among them is made inside an agency. The last three apply the same pattern outside government, set out what a defensible exception portfolio contains, and give a test for telling a defensible exception from a convenient one.

What “AI” usually means inside an agency

When most executives hear “artificial intelligence,” they picture a chatbot. Inside a government agency, most of the AI that matters looks far more ordinary. It is a model: a piece of software that has learned patterns from past records and uses them to make a prediction or a recommendation about a new case.

A fraud model, for example, looks at thousands of past claims, some later found to be fraudulent, and learns which features tend to go with fraud. When a new claim arrives, it produces a score. A high score might send the claim to an investigator. A facial recognition system compares a photo against stored images and reports a likely match. A triage model might rank applications so that staff see the most urgent ones first.

These systems do not “decide” anything in a legal sense, but they shape what people see, in what order and with what label attached. The person nominally in charge often follows the route they are given. That is why M-24-10 focused on purposes rather than technologies. What mattered was not whether a system used a neural network or a simpler statistical method, but whether its output could affect someone’s benefits, liberty, safety or access to credit.

The “minimum practices” the memo required were the guardrails it expected around such systems. They covered assessing a system’s impact before relying on it, testing it in conditions like real use, monitoring it once it was running, making sure the people using it were trained and could overrule it, and telling affected people when AI played a part and how they could seek a remedy. For a system already in daily use, adding all of that by December 2024 was real work.

What each practice demands in evidence

Each minimum practice turns into a document or a dataset someone has to produce. The impact assessment needs a written purpose, a statement of expected benefit, a list of foreseeable harms and an account of where the training data came from. Real-world testing needs results from conditions resembling actual use, which is harder than it sounds when the outcome takes months to observe. A benefits denial may not be appealed, and so confirmed or reversed, for a long time.

Independent evaluation needs someone outside the development team, such as an internal review office or an external assessor, with enough access to check the work. Ongoing monitoring needs a baseline, a measure of drift and a person who reads the reports. Human oversight needs training records and evidence that operators can and do overrule the system. Public notice needs plain-language text that a non-specialist can follow.

The rights-impacting practices added the hardest pieces. Assessing effects on equity requires demographic data that agencies often do not collect or are wary of using. Consulting affected communities takes time and a channel for doing it. An opt-out requires a non-AI path that still works, with staff to run it. Few of these could be bolted on in a week, and several depended on information held by vendors.

Where inventories miss systems

The minimum practices applied only to systems the agency knew about. Three kinds of use tend to escape inventories. The first is AI embedded in commercial software, such as a scoring feature in a case management product. The second is a model built years ago by a contractor, still running, whose original owner has left. The third is a tool a single office adopted on its own, such as a document classifier that routes correspondence.

A practical way to find them is to work from purposes rather than technology. Ask each program office which of its steps rank, score, flag or match people, and how. Then check procurement records for products with those features. Asking “do you use AI” misses most of them.

General-purpose generative AI tools raised a separate problem. The memo judged risk by purpose, so a chatbot drafting internal memos was not presumed rights-impacting. The same tool used to summarize benefit applications for caseworkers could be. The inventory therefore had to record uses, not products. An agency that approved a generative AI tool for broad internal use needed a way to learn when an office started using it for a presumed purpose. The classification changed with the task rather than the software.

Determinations: saying a presumed use is out of scope

Appendix I presumed many uses to be rights- or safety-impacting. The Chief AI Officer could decide that a particular application did not in fact meet the definition. The memo made that power non-delegable, meaning the Chief AI Officer could not hand it to a deputy or a program office. It also required a documented, system-specific risk assessment, central tracking, a report to OMB within 30 days, annual recertification, and a public summary of each determination and its justification.

Those conditions change the calculation. A determination is the cheapest exit in effort, because no minimum practices follow. It is also the most exposed. The public summary describes how the system is used, and that description can be tested by an inspector general, a court in a benefits dispute, or a journalist who obtains case files. If staff rely on the model more than the summary says, the agency has published an inaccurate statement over its Chief AI Officer’s name.

Suppose a county housing assistance office uses a model to flag applications that may contain errors. The office argues that a caseworker reviews every flagged file and makes the real decision, so the model is not rights-impacting. On paper that sounds reasonable. But suppose caseworkers each handle hundreds of files a week, and almost every flagged application ends up denied or delayed. In practice, the flag is the decision. A summary claiming otherwise would not survive a careful reader.

A defensible determination therefore rests on operational evidence: a process map showing where people decide, records showing they do, and a trigger for reassessment when the workflow changes. The memo required reassessment after significant changes. Agencies needed a way to notice those changes, such as a review step in the change-management process for the systems concerned.

Change management is the routine by which an organization approves updates to its systems: a new version of the software, a new data feed, a changed threshold. Adding one question to that routine (“does this change how much people rely on the model?”) is cheap. Discovering the change from an outside complaint is not.

Evidence that holds up

The strongest evidence for a determination is measured behavior. Useful measures include how often staff change or override the model’s output, how long they spend on flagged versus unflagged cases, and whether outcomes differ sharply by flag. A sample of case files reviewed by someone outside the program adds weight.

These measures need careful reading. A low override rate can mean the model is accurate, or that staff have stopped questioning it. Time spent per case helps tell the two apart. Two minutes on a complex file suggests the flag is doing the deciding. The agency should record its interpretation along with the numbers, so a later reader sees the reasoning as well as the data.

Determinations also interact with vendor updates. A supplier that retrains a model or changes its threshold can shift how much staff rely on it without anyone in the agency deciding anything. A contract term requiring notice of material model changes gives the agency a chance to reassess before a published summary goes stale.

Patterns matter as much as individual cases. If one program office files several determinations while comparable programs comply, the board should ask why. Either that office has found a defensible distinction, which others might use, or it is defining its way out of the work. A determination is easiest to defend when it reflects a real difference in how a system is used, and hardest when it is the only option a program considered.

Waivers: setting aside a specific practice

A waiver covered a use that stayed in scope but could not or should not meet one practice. The test was narrow. The Chief AI Officer had to base it on a system-specific risk assessment. The written finding had to show that meeting the requirement would increase overall risks to safety or rights, or create an unacceptable impediment to critical operations. Waivers were also non-delegable, tracked, reported to OMB within 30 days, recertified annually and summarized publicly.

The first ground is the more principled. Offering an opt-out from a fraud model, for example, could make the model easy to evade. If anyone suspected of fraud could ask not to be screened, the screening would catch only the honest. In that case, following the rule to the letter would make things worse, and the memo allowed the agency to say so.

The second ground is the one programs reach for under deadline pressure, and it is harder to defend publicly. “Critical operations” needs a concrete description of what would stop and who would be affected. A waiver justified only by cost or schedule reads badly once it is published.

Compensating controls make the difference. A compensating control is a safeguard that partly stands in for the one you are not applying. If a practice is waived, something should fill part of the gap: more frequent monitoring, a narrower deployment, a second human check on adverse outcomes, or a shorter review cycle. A waiver that names its compensating controls tells a reader the agency weighed the risk. One that does not suggests the agency simply ran out of time.

Waivers also outlive the people who sign them. Each one is a standing statement that a known gap is acceptable, and annual recertification puts it back on the Chief AI Officer’s desk. An agency should keep a waiver register showing the practice waived, the compensating controls, the next review date and the evidence that conditions have not changed.

Which practices invite waivers

Some practices are structurally harder to meet in certain programs, and those are where waiver requests cluster. Opt-outs are difficult wherever the AI exists to detect misconduct or screen for threats. Advance notice to individuals can compromise an investigation. Real-world testing is hard where the system’s purpose is to catch rare events, because there are too few confirmed cases to measure against. Consultation with affected communities is hard when the affected group is defined by suspicion, such as people flagged for possible fraud.

For each of these, a careful agency would describe the specific conflict, explain why the practice would make outcomes worse, and set out what it does instead. A fraud program that cannot offer an opt-out can still offer prompt human review of any adverse action, and can publish aggregate error rates. A waiver that shows that thinking is defensible. One that cites the category alone is not.

The cost of a waiver over time

A waiver does not end the work. Each year the Chief AI Officer must recertify it, which means checking whether the conditions that justified it still hold. Technology changes, staffing changes and new legal requirements can all undermine the original reasoning. An agency with many waivers carries a growing review burden, and one with old waivers it no longer understands carries risk it cannot describe. Setting a sunset date for each waiver, after which it lapses unless renewed with fresh evidence, keeps the portfolio honest.

Who reads a waiver

The likely readers of a published waiver summary are not casual. Inspectors general look for gaps between stated and actual controls. The Government Accountability Office reviews how agencies implement government-wide guidance. Congressional committees ask about programs that affect constituents. Advocacy groups track systems used on the people they represent. Lawyers in benefits or immigration disputes may cite a waiver to argue that a decision lacked required safeguards. Each reader brings a different question, and a waiver written with all of them in mind tends to hold up. Drafting it with a lawyer and a program analyst in the room, rather than a lawyer alone, keeps it both accurate and readable.

Extensions: asking OMB for more time

The third exception was granted outside the agency. Requests had to reach OMB before October 15, 2024. Each needed a detailed justification, a description of the mitigations in place, and a plan to reach full compliance. OMB could grant up to one year and said it would not renew.

An extension looks like relief, and it is a commitment. The plan submitted to OMB sets a date by which the use must comply or stop, with no second extension available. It also shows OMB which agencies understood their systems and which did not. A credible request needed the same retrofit analysis the draft had demanded: what the vendor would supply, what testing was feasible, what notice and appeal changes were needed.

That vendor point deserves emphasis. Many agency AI tools are bought, not built. The agency may not have the information needed to test a model, explain its outputs or monitor its accuracy, because that information sits with the supplier. An extension plan that assumes the vendor will cooperate, without a contract change or a written commitment, is a hope rather than a plan.

The extension deadline also set the year’s calendar. With requests due in mid-October, agencies had roughly six months from the memo to decide which exit each presumed use would take. Choosing late meant defaulting to an extension, and an extension that failed would end in shutdown.

What a credible extension plan contains

A useful extension request reads like a project plan. It lists each missing practice, the work needed to meet it, the owner, the dependency on any vendor and a target date well before the year runs out. It describes interim mitigations, such as added human review of adverse outcomes or a narrower rollout, that reduce risk while the work continues. It also says what the agency will do if a milestone slips, including the point at which it would stop using the system.

That last element is the one programs most often omit, because nobody wants to plan a shutdown. It matters because the memo made shutdown the default for a use that is neither compliant nor excepted. A program that has not planned how to run without the AI, such as reverting to manual review with temporary staff, has no real choice when the deadline arrives.

Vendor terms that make the plan real

For bought systems, the plan depends on contract terms. The agency needs rights to the documentation and test data required for an impact assessment. It needs access for an independent evaluator, notice of material changes to the model, and cooperation with monitoring and incident review. If the current contract lacks these, the extension plan should include a modification, with the contracting officer as a named owner. A plan that leaves vendor cooperation to goodwill puts the agency’s deadline in someone else’s hands.

How the choice plays out inside an agency

The process usually starts with an inventory: a list of every system that uses AI, gathered by asking program offices and the technology team what they run. That sounds simple. In practice, AI is often buried inside larger products, such as a case management system with a built-in scoring feature, and the people using it may not know it is there.

Once a system is on the list and falls under one of the presumed purposes, someone has to propose a path. There are really four options: comply with all the minimum practices, argue the use is out of scope, waive a specific practice, or ask OMB for time. Each has a different cost and a different kind of exposure.

• Full compliance costs the most effort up front but leaves nothing to defend later.
• A determination costs the least effort but puts a public claim about how the system is used on the record.
• A waiver sits in between and invites the question of what replaced the practice set aside.
• An extension buys time but commits the agency to a date with no second chance.

The proposal then goes to the Chief AI Officer, who cannot delegate the signature for a determination or a waiver. In a well-run agency, the governance board sees the overall pattern: how many systems are taking each path, which program offices keep asking for exceptions, and where the evidence is thin. That portfolio view is what lets leaders spot trouble before an outside reader does.

Hospitals handle exceptions to clinical protocols in a similar way. A doctor may depart from the standard approach for good reason, but the departure is documented, someone accountable signs off, and patterns of departures are reviewed. Nobody objects to the exception itself. What draws scrutiny is an exception nobody can explain.

Who does what, and in what order

Several offices take part, and the order matters. Program offices identify uses and supply evidence of how they work. The chief information officer’s team confirms what is deployed and how it connects to other systems. The privacy office checks personal data handling, and the civil rights office reviews equity and access issues. General counsel looks at legal exposure, and the contracting officer handles vendor terms. The Chief AI Officer decides, and the governance board reviews the pattern.

For a deadline of December 1, 2024 and extension requests due by October 15, a workable sequence ran roughly as follows. Inventory and classification came first, through the spring. Evidence gathering and vendor engagement followed in summer. Exit decisions were due by early autumn, and extension requests went in before mid-October. Agencies that started evidence gathering after the summer could rarely support anything but an extension.

What the exercise cost

The work drew on people agencies already had: program analysts, privacy and civil rights staff, lawyers and contracting officers. Many supplemented them with contractor support for inventories and assessments. The opportunity cost was real. Time spent documenting existing systems was time not spent on new ones, and some programs paused planned AI projects until the rules settled. Vendors felt it too, as agencies began asking for documentation and testing access that commercial contracts had never offered. Those requests were an early sign of the contract terms that later became standard in federal AI acquisition.

How it differed by agency

The burden was uneven. A large department with many components might have hundreds of inventoried uses, a governance board and dedicated staff. A small independent agency might have a handful of uses and a Chief AI Officer who also served as chief information officer or chief data officer. Benefits agencies faced the rights-impacting duties most directly, because eligibility and fraud screening sit at the heart of their work. Law enforcement components faced the hardest questions about notice and opt-out. Agencies with safety missions, such as transportation or health, faced the testing and monitoring practices most acutely.

The same pattern outside government

Any company that grants itself an exception for a high-risk automated system may one day have to show its reasoning to an examiner or a court. The memo is a model of how oversight bodies increasingly approach automated decisions, and the pattern applies to any organization whose systems affect customers, patients or citizens.

The pattern has three parts. First, risk is defined by what a system is used for, not by how clever it is. A simple scoring rule that decides who gets credit can matter more than a sophisticated tool that drafts internal memos. Second, exceptions are allowed, but each one needs an owner who cannot delegate it. Third, the reasoning is written down in a form an outsider will eventually read.

For a company, the outsider might be a bank examiner, a state insurance regulator, a plaintiff’s lawyer in discovery or a reporter. The costs of getting this wrong are familiar: remediation work under a deadline, a damaged relationship with a supervisor, customer complaints that become a story, and senior people explaining a document they never read closely. The costs of getting it right are mostly time and attention spent early, when they are cheapest.

There is also a staff dimension. The people who run these systems day to day often know exactly where the model is trusted too much and where the human check is a formality. An exception process that invites their evidence, rather than just a manager’s signature, produces documents that hold up.

Banks and credit unions

Banks already worked under model risk management guidance from the Federal Reserve and the OCC, known as SR 11-7, issued in 2011 and later adopted by the FDIC. It expects validation of models, an inventory, and documented exceptions when a model is used before validation is complete. Examiners routinely ask to see that exception log. Lenders also face fair lending law. The Consumer Financial Protection Bureau said in 2022 that creditors using complex algorithms must still give specific reasons when they deny credit. A bank’s answer to “why was this applicant declined” has to survive that test whatever model produced it.

Credit unions answer to a different examiner, the National Credit Union Administration, and SR 11-7 does not bind them. Fair lending law applies to them all the same. A credit union with a vendor-supplied credit score faces the same evidence question as a federal agency with a bought fraud model. It has to show how the model works and how staff use it.

Health systems and insurers

Health care moved in a similar direction in 2024. The Department of Health and Human Services finalized a rule under Section 1557 of the Affordable Care Act that May. It required covered health programs to make reasonable efforts to identify and reduce discrimination risks from patient care decision support tools. Those duties took effect in May 2025. Separately, certification rules for electronic health records had added transparency requirements for decision support features. Many state insurance regulators adopted a model bulletin from the National Association of Insurance Commissioners on insurers’ use of AI. Each asks a version of the federal question: what is the tool used for, who owns it, and what evidence shows it is under control.

State and local government

States and counties were not bound by M-24-10, but many run federally funded programs where the same tools appear. A state unemployment agency using an identity verification service, or a county child welfare office using a risk screening tool, faces rights questions as sharp as any federal agency’s. Without a federal memo forcing the issue, those decisions often rest with program managers and vendors. Borrowing the federal structure, with a named owner, written evidence and a register, costs a state little and gives it a defensible record if a decision is challenged.

Exceptions are documents with readers

For agency program directors, the final memo’s message was that exceptions are documents with readers. Each needed an owner, evidence and a review date. Agencies that treated determinations, waivers and extensions as a single portfolio could see where the exposure sat. Those that handled them case by case found out when the summaries were published.

In practice that meant five things:

• One inventory, one register. A single list of every presumed use, which exit (if any) it is taking, who owns it and when it is next reviewed.
• Evidence before signature. Process maps, decision records and test results gathered before the Chief AI Officer signs, not assembled afterward to support a decision already made.
• Readable summaries. Public descriptions written as if a skeptical reader will compare them with how the system is actually used, because one eventually might.
• Named compensating controls. Every waiver paired with the safeguards that partly replace the practice set aside.
• Vendor commitments in writing. Extension plans backed by contract terms, not assumptions.

The failures were the mirror image. Some programs chose the cheapest exit first and looked for evidence later. Some wrote summaries that described the system as designed rather than as used. Some treated an extension as breathing room rather than a fixed deadline with no renewal. And some left the choice of exit until the autumn, when the only option still open was the one that could not be repeated.

A regional bank offers a parallel. Say its credit team uses a model to set initial loan limits and says a human underwriter reviews every file. When an examiner asks how often underwriters change the model’s number, nobody knows. The bank has, in effect, made a determination that its model is advisory, without the evidence to support it. The fix is the same as in the federal case: measure how people actually use the tool, write it down, and revisit it when the process changes.

The case that this was paperwork

Critics raised fair objections. One was that documentation crowds out real safety work: staff writing summaries are not testing models. Another was that strict rules would push agencies to define systems out of scope, or to avoid useful AI altogether. A third was that public summaries of fraud and security systems could teach bad actors how to evade them.

Each has some force. The answer is that the documents were the cheapest part of a well-run process. An agency that actually knew how its systems were used could write the summary in an afternoon. The documents were hard only where that knowledge was missing, and that missing knowledge was the risk. On evasion, a careful summary of a fraud model can explain its role and safeguards without publishing its features or thresholds.

Measures for the portfolio

A governance board can track a few figures to see how the exception portfolio is behaving. The share of in-scope uses on each path shows whether the agency is complying or deferring. The age of each waiver, and the number past their review date, shows whether recertification is real. The count of determinations reassessed after a workflow change shows whether the change trigger works. Repeat requests from the same program office show where help or scrutiny is needed.

The register should also keep the uses that were reviewed and found out of scope without a formal determination, because they matched no presumed purpose. Those decisions draw less attention, but they are the first place an auditor looks for systems that should have been flagged. A one-line rationale for each, with the date and the reviewer’s name, costs little and closes an obvious gap.

How to tell a defensible exception from a convenient one

Whether you run an agency program or a private company, these apply directly:

1. Which of our systems use automated scoring or prediction to affect a person’s money, access, safety or rights, and do we have a single list of them?
2. Where we say a person makes the real decision, what evidence shows how often they disagree with the system?
3. Have we set aside any of our own safeguards for any system? If so, what replaced them, and when were they last reviewed?
4. If a regulator or reporter read our written description of a system tomorrow, would it match what our staff actually do?
5. Which of our AI tools depend on a vendor for testing or explanation, and does the contract require them to provide it?

Asking them takes no technical expertise. It does take someone senior to keep asking until the answers are specific, which is the habit M-24-10 tried to build in every agency.

The same questions work as an audit plan. An internal auditor can take each one, pick a sample of systems, and test whether the evidence exists, is current and matches what staff do. A board or agency head can ask for the results once a year. The point of the exercise is less to grade the program than to find, before an outsider does, the places where the written record and the daily practice have drifted apart.

With hindsight

The exits were not used evenly. When the December 2024 inventory was published, the federal CIO site reported 227 uses flagged as rights- or safety-impacting, and 206 of them had received extensions of up to a year. Extension was the dominant exit by a wide margin, which suggests few programs had compliance evidence ready in time. OMB’s consolidated inventory, updated in January 2025, listed 2,133 use cases from 41 agency submissions, with 351 flagged.

Those numbers tell a story about readiness. When the clock ran out, most programs with sensitive AI could not yet show that the minimum practices were in place, and they reached for the option that bought time rather than the ones that required evidence. That is a very human response to a deadline, and it is the same one many companies make when a new regulation arrives. It also confirms the article’s central point: the hard part was never the paperwork itself, but knowing your systems well enough to fill it in honestly.

The inventory itself improved. Tying obligations to it gave agencies reason to search harder, and the late-2024 count was larger than the first public inventories had been. The result was modest but real. Agencies now had a list against which later rules could be applied.

The same figures showed how ordinary most federal AI was. Fewer than one in five inventoried uses in the consolidated list were flagged as rights- or safety-impacting. The rest were internal tools for documents, analysis and operations. The governance burden, and the exception structure, fell on a small and identifiable set of systems.

Acquisition guidance followed. In September 2024, OMB issued M-24-18 on the responsible acquisition of AI. It asked agencies to address in contracts many of the vendor issues an extension plan depended on, such as access to documentation, testing and notice of changes. For agencies that had found their exits blocked by missing vendor information, it came late for the 2024 deadline but early enough for the next contract cycle.

The political frame then changed. On his first day in office in January 2025, President Trump revoked the October 2023 executive order on which M-24-10 rested. A new executive order days later called for AI policy focused on removing barriers to American leadership in AI.

In April 2025, OMB rescinded M-24-10 and issued M-25-21 and M-25-22. M-25-21 merged the two categories into high-impact AI and gave agencies 365 days to document minimum practices. It kept the essentials of the exception structure: Chief AI Officer waivers in writing, tracking and reporting to OMB, and the duty to stop using non-compliant systems. M-25-22 replaced the acquisition guidance. The one-year extensions granted in late 2024 were overtaken by that transition, since the memo they were granted under no longer applied.

So the specific deadlines changed, but the shape of the rules did not. A named official still signs. Reasons are still written down and reported. A system that cannot meet the bar still has to stop. This structure has survived a change of administration, which makes it a reasonable guide to what oversight of automated decisions will look like for some time.

The new memos changed the tone more than the mechanics. They emphasized speed of adoption and removing bureaucratic barriers, and the Chief AI Officer role was recast to promote AI use as well as manage its risks. Generative AI tools spread quickly across agencies in 2025. The high-impact category still caught the benefit, biometric and safety uses that M-24-10 had targeted. By this point in 2026, the 365-day clock has run out, and the question is the same one agencies faced in 2024: which path each sensitive system took, and on what evidence.

What did not hold up was the expectation that a firm deadline alone would produce compliance. The deadline produced extensions, and the extensions were then overtaken by a policy change. Agencies that had done the work were ready for either regime. Those that had relied on time running out found that it simply reset.

The practical advice holds up as well. Organizations that built a single register of their sensitive systems, with owners, evidence and review dates, were in a far better position when the rules were rewritten than those that had treated each exception as a one-off. The register outlasted the memo that prompted it.