How OMB’s first AI memo reached AI systems agencies already ran

The week

The last week of October 2023 was a busy one for anyone thinking about artificial intelligence and government. In Washington, the White House set out the most sweeping federal policy on AI to date. Across the Atlantic, world leaders gathered to discuss the risks of the most powerful AI systems. And amid the headlines, a less noticed document landed that would matter more to many agency program managers than either.

On October 30, 2023, President Biden signed Executive Order 14110 on the safe, secure and trustworthy development and use of artificial intelligence. An executive order is a directive from the President to federal agencies. It carries the force of law within the executive branch but can be revoked by a later President. This one was among the longest executive orders in years, and it directed work across many agencies.

That work included reporting by developers of the most powerful models under the Defense Production Act, a Cold War-era law that gives the government powers over industries important to national defense. It asked NIST, the National Institute of Standards and Technology, the federal agency that develops technical standards, to work on standards and red-teaming guidance. Red-teaming means deliberately attacking or probing a system to find its weaknesses before others do. The order also included measures on AI in critical infrastructure, health care, housing and employment.

The reporting duty had a precise trigger. Developers had to report on models trained with more than 10 to the 26th power integer or floating-point operations, a level of computing beyond any model then publicly known. Owners of very large computing clusters able to train such models had to report as well. The order also told the Commerce Department to develop guidance on authenticating and labeling AI-generated content. On November 1, Commerce announced a U.S. AI Safety Institute, housed at NIST, to carry much of the technical work.

It also addressed the government’s own use of AI, and this is where the less noticed document came in. On November 1, the Office of Management and Budget, the White House office that oversees how agencies manage budgets, technology and operations, released a draft memorandum on agency AI governance and risk management for public comment.

Vice President Harris announced the draft in a speech in London that day, timed ahead of the UK summit. OMB set a public comment deadline of December 5, 2023. The draft had a legal basis older than the executive order. The AI in Government Act of 2020 had required OMB to issue guidance on agency use of AI, and the Advancing American AI Act of December 2022 had written agency AI inventories into statute. An earlier executive order, 13960, signed in December 2020, had first asked agencies to list their AI uses.

The draft proposed that every agency appoint a chief AI officer and set up a governance board. It proposed minimum practices for uses of AI that affect people’s rights or safety. And it set a deadline after which uses that did not comply would have to stop.

The draft listed the purposes for which AI would be presumed to affect rights or safety. They covered health, education, employment, housing, federal benefits, law enforcement, immigration, child welfare, transportation, critical infrastructure, and safety and environmental controls. Large agencies would set up AI governance boards chaired by the deputy secretary or equivalent, with the chief AI officer as vice chair. The minimum practices ran from impact assessments, independent evaluation and real-world testing to monitoring, operator training, public notice and avenues for remedy.

Each of these ideas had appeared before. NIST had published its voluntary AI Risk Management Framework in January 2023. The White House Office of Science and Technology Policy had issued a Blueprint for an AI Bill of Rights in October 2022. The draft memo differed in one respect. It turned principles into obligations with a date attached, for every agency’s existing systems as well as new ones.

The same week, the United Kingdom hosted an international AI safety summit at Bletchley Park, the country house where Allied codebreakers worked during the Second World War.

Twenty-eight countries and the European Union signed the Bletchley Declaration there on November 1, committing to cooperate on the risks of frontier AI. Earlier in the week, on October 30, G7 leaders had published guiding principles and a voluntary code of conduct for organizations developing advanced AI systems, under what they called the Hiroshima AI Process.

Most attention went to frontier models and geopolitics. The officials who actually run benefits programs, inspections and grants had more reason to read the OMB draft closely.

Most coverage of the order dwelt on frontier models and national security. The consequential document for agency program directors was the OMB draft released two days later, and its most consequential feature was easy to miss. Its reach extended past new AI projects.

It defined categories of AI presumed to affect rights or safety, such as uses that inform eligibility for benefits, flag people for investigation, or control physical systems. It then said that any such use, including ones already running, must meet minimum practices by a set date or be discontinued. The draft proposed August 2024.

Agencies that read the memo closely saw a retrofit program with an off switch. Retrofitting is what happens when new safety standards apply to old buildings: the structure is already standing and occupied, and the improvements must be made around the people living in it. The program had three parts, which follow the order of the work: finding the systems in scope, retrofitting the practices, and preparing for the stop. Some definitions come first.

Scores, rankings and training data

“Artificial intelligence” in government rarely looks like the chatbots that fill the news. Much more often it is a model: a piece of software that has learned patterns from past data and uses them to produce a score, a ranking or a recommendation about a new case. A fraud model looks at an application and estimates how likely it is to be fraudulent. A risk model looks at a grantee and estimates how likely it is to misuse funds. A prioritization model decides which restaurant, workplace or building an inspector should visit first.

These models are built by feeding them training data, historical examples with known outcomes, so they learn which features tend to go with which results. That is also where problems can creep in. If the history reflects past mistakes or unequal treatment, the model can learn and repeat them, faithfully and at scale.

Some systems involve facial matching, comparing a photo taken now, such as a selfie, against an identity document or a stored image to decide whether the person is who they claim to be. Others are simple rules dressed up in software. The boundary between a “model” and an ordinary business rule is not always sharp, which is one reason finding AI inside an agency is harder than it sounds.

Where the boundary falls

The draft relied on the statutory definition of artificial intelligence from the 2019 defense authorization act, which is broad. OMB’s 2025 guidance later spelled out a useful exclusion: robotic process automation, and systems whose behavior is defined only by rules that people wrote, are not AI for its purposes. A workable test follows from that. If the logic was learned from data, it is probably in scope. If a person can read every rule that produces the output, it probably is not.

The test has hard cases. A vendor may describe a scoring feature as a rules engine when its weights were tuned on historical data. Another may market a product as AI-powered when the feature is a fixed checklist. Neither label settles anything. The agency needs to know how the output is produced, and only the vendor’s technical documentation, or a direct answer in writing, can tell it.

A use case inventory is a list of where an organization uses AI and for what. An impact assessment is a structured look at what a system does, whom it affects, what could go wrong and how the risks are managed. Human review means a person checks the system’s output before it becomes a decision about someone. All three sound straightforward. The draft memo showed how much work each involves when applied to systems that have been running for years.

AI that nobody called AI

Agencies had been required to inventory AI use cases under an earlier executive order, and compliance had been uneven. The new draft raised the stakes, because being in scope now carried a deadline.

The Government Accountability Office documented the weakness a few weeks later. In a December 2023 report, it found that 20 of 23 large civilian agencies had reported about 1,200 current and planned AI use cases. Only five had provided complete information for every use case. Two agencies had listed uses that were later determined not to be AI. GAO made 35 recommendations to 19 agencies. An inventory that incomplete was a weak foundation for a program with an off switch.

The difficulty was that many presumed-impacting uses were not labeled as AI. A fraud-scoring module in a benefits system, a risk model in a grants management platform, a prioritization score in an inspection scheduling tool, or identity verification with facial matching might all qualify. Many came from vendors, embedded in products the agency bought for other reasons. An agency that bought a case management system to replace paper files might not know, or remember, that one of its features ranks cases using a model.

Finding them meant reading systems, not surveys. A survey asking program offices “do you use AI?” invites the answer “no” from people who think of their system as a case management tool. An agency could instead start from the presumption categories and work backward: list every decision process that affects eligibility, enforcement, safety or access to services, then ask which systems supply a score, ranking or recommendation to that decision.

Contracting officers could query vendors on active contracts about model-based features, with a deadline for written answers. Program offices, not the CIO alone, had to confirm the results, because they know which outputs staff actually rely on. A score that appears on a screen but that everyone ignores is very different, in practice, from one that decides which cases get worked first.

Questions that get real answers from vendors

Vague questions draw vague answers. A vendor asked whether its product uses AI will often reply with marketing language. Better questions name the feature and ask how it works. What inputs does it use, and was it trained on this agency’s data or on data pooled across customers? How often does it change, and can the agency switch it off? Others ask what testing the vendor has done, including results for different groups of people, and what documentation the agency may share with an inspector general.

The answers belong in the contract file, signed by someone at the vendor with authority to give them. A written answer turns a sales conversation into a representation the agency can rely on. It also creates a record when the vendor later changes the feature.

How the hunt differs by agency

The work looks different across government. A cabinet department with many components may find in-scope systems scattered across bureaus that buy their own software, and the chief AI officer must work through component chief information officers. A small independent agency may have one or two candidate systems, but no staff with the background to assess them. Benefits and enforcement agencies tend to have the most presumed-impacting uses, because their core decisions sit squarely in the draft’s categories.

State and local governments were outside the memo altogether. OMB guidance binds federal agencies, not a state department that administers a federally funded program. Many states adopted AI policies of their own in the same period, and federal partners’ expectations tend to travel through grants and shared systems. A state agency that adopted the memo’s method voluntarily would still gain from it, even without a federal deadline.

Generative AI complicated the list

The draft arrived a year after public chatbots had reached every office. Staff were already experimenting with generative tools to draft letters, summarize case files and search policy manuals. Most such uses do not decide anything about a person. Some come close. A summary of an applicant’s file that a caseworker reads instead of the file itself shapes the decision as surely as a score. An inventory built from decisions catches that use, because it asks what the caseworker relied on, not which product produced it.

Retrofitting systems already in use

The draft’s minimum practices for rights- and safety-impacting uses began with an impact assessment, real-world testing and independent evaluation. They continued with ongoing monitoring, adequate human review, notice to affected people, and ways to appeal or opt out. Applied to a new project, these are design requirements. Applied to a system that has run for years, each becomes a retrofit with its own obstacles.

An impact assessment needs documentation of training data and model behavior that a vendor may regard as proprietary. Real-world testing needs outcome data that the program may never have collected, such as whether flagged cases turned out to be fraud. Without that, nobody can say whether the model is any good. Notice and appeal require changes to letters, call center scripts and hearing procedures, and in some programs to regulations. Monitoring requires someone to own a performance report each quarter.

Monitoring that someone reads

Monitoring fails most often because nobody reads the report. A useful quarterly report for a scoring model is short. It shows how many cases were flagged, and how flag rates vary by region and by group where the law allows that analysis. It shows how often staff overrode the score, and how often flagged cases turned out to warrant action. It also records any change the vendor made to the model. Each measure should have a threshold that triggers a review, agreed before the first report.

Models drift. The population applying for a benefit changes with the economy, fraud schemes adapt, and vendors retrain models without much notice. A model that tested well at launch can degrade within a year. The report is how an agency notices before a complaint, an audit or a court does.

Testing without outcome data

Programs that never recorded outcomes can still begin testing. One method is retrospective review: draw a sample of past cases the model flagged and a sample it did not, and have experienced staff determine what the right answer was. Another is a holdout, where a small share of new cases is worked without the score so that results can be compared. Both take staff time, and both produce the first honest evidence of whether the model helps.

Vendors that refuse to share model internals are a common obstacle. OMB’s 2025 guidance acknowledged this and allowed alternative methods, such as querying the service and observing its outputs, or giving the vendor evaluation data and obtaining its results. An agency can apply the same approach under any version of the rules. It can test the system as a black box, using cases whose answers it already knows.

Notice and appeal run through existing law

Notice and appeal are not blank slates. Benefit programs already operate under due process requirements, including the Supreme Court’s 1970 decision in Goldberg v. Kelly requiring a hearing before welfare benefits are terminated. Adverse action notices, fair hearing procedures and Privacy Act obligations already exist. The retrofit task is to make them reflect the role the model played. A notice should say when a score contributed to a decision, and the hearing officer needs a way to examine the score as evidence.

Why human review needs particular care

Human review deserves particular care, because it is the practice most easily satisfied on paper. A caseworker who approves nine hundred flagged cases a week is not reviewing the model. They are rubber-stamping it, through no fault of their own, because they lack the time to do anything else.

A meaningful retrofit measures how often staff disagree with the score, gives them the information and time to do so, and records the reasons. If the override rate is near zero, the agency has learned something important about how the system really works, whatever the procedure manual says. Either the model is nearly always right, which should be demonstrated, or staff are deferring to it, which means the model is effectively making the decision.

The presence of a human does not take a system out of scope. OMB’s 2025 guidance said so directly: a high-impact determination is possible whether or not there is human oversight, and risk can arise whether AI merely informs a decision or fully automates it. An agency that points to a caseworker’s signature as proof that the model does not decide anything is answering the wrong question. The question is how much weight the signature actually carries.

Two moves that made the work tractable

Two moves made the retrofit tractable. The first was triage: rank in-scope systems by how directly their output drives decisions about people, and start with those where staff rarely override the score. The second was contract modification: add clauses requiring vendors to supply model documentation, testing access and notice of model changes, using the modification process rather than waiting for re-competition, which can be years away. Both needed budget, and the deadline fell inside a fiscal year whose appropriations had not anticipated it.

Planning for the off switch

The draft’s off switch was its sharpest feature. If an agency could not bring a use into compliance by the deadline, it would have to stop using it, unless it obtained a waiver through the chief AI officer for a documented reason. For a program that has woven a model into daily casework, stopping is not trivial. Caseloads rise when a triage score disappears. Fraud controls weaken. Processing times lengthen.

A responsible plan therefore included a fallback for every in-scope system: the manual or rules-based process that would replace the model, the staffing it would need, and the service effects residents would see. Writing that fallback had a second benefit. It forced program leaders to state what the model actually contributed, which is the core of any honest impact assessment. If switching the model off would change little, the agency learns something; if it would double processing times, it learns something more.

Where the fallback looked unacceptable, the agency had a documented basis for prioritizing that system’s retrofit or for a reasoned waiver request, rather than an argument made at the deadline.

Waivers as a documented decision

The waiver route needed the same discipline as the retrofit. The final memo allowed a chief AI officer to waive a requirement only on a written finding. Meeting the requirement had to increase risks to rights or safety overall, or create an unacceptable impediment to critical operations. Waivers had to be reported to OMB and disclosed publicly. A waiver written in a hurry, without the fallback analysis, would be hard to defend in that light.

The strongest criticism of the off switch was about incentives. If being in scope means a deadline and possible shutdown, program offices have a reason to argue their systems out of scope. A fraud score can be described as advisory, or a ranking as one input among many. The memo anticipated part of this by requiring documented determinations when a use in a presumed category was found not to qualify. Those determinations are where an inspector general will look first, and they deserve the same rigor as the inventory.

The chief AI officer role, which the same draft created, was where these decisions met. An officer with authority over the inventory, the retrofit queue and waiver recommendations could make the trade-offs visible to agency leadership. One without that authority would end up reporting the deadline rather than managing it.

What a fallback plan contains

A fallback plan can fit on two pages. It names the trigger, such as a failed assessment or an expired waiver. It describes the replacement process step by step, estimates the staff hours it needs, and projects the effect on backlogs and processing times. It sets out what applicants and the public will be told, and who decides to switch back once the model is fixed.

The best test of a fallback is to run it. An agency can work one office or one week of cases without the score and measure the result. That small trial answers the question every program director will ask, which is how bad the switch-off would really be. It also gives the agency a measured baseline against which to judge the model itself.

Two chatbots on the list, three systems off it

Suppose a state human services department reads the draft in November 2023. Its leadership believes it has two AI projects, both pilots of chatbots on its website. Neither makes decisions about anyone.

Working backward from decisions, the picture changes. The agency’s eligibility system, bought from a vendor several years earlier, includes a fraud-risk score that routes high-scoring applications to an investigations unit. The identity verification step in its online application uses a contractor’s facial matching service. And its child care licensing inspections are scheduled using a risk ranking built into the inspection software. Not one of these was on the agency’s AI list. All three plausibly fall into the presumed categories.

The retrofit begins. For the fraud score, the agency asks the vendor for model documentation and discovers it has never collected whether flagged applications turned out to be fraudulent, so it cannot test the model. It starts recording outcomes. It also finds that investigators send almost every flagged case for further review, so it ranks this system first. For the facial matching, the question is what happens to applicants who fail the match, and whether they have a way to prove their identity another route. For the inspection ranking, the agency writes a fallback, a simple rotation schedule, and finds it would be workable at modest cost.

The chief AI officer brings all three to the governance board with a plan: retrofit the fraud score first, improve the alternative route for identity verification, and accept the inspection fallback if the vendor cannot supply documentation in time. Leadership sees the trade-offs before the deadline instead of on it.

One caveat applies to this hypothetical. The OMB memo binds federal agencies, so a state department would be using it as a template rather than meeting a federal requirement. The same pattern holds for a federal agency, with higher stakes. A federal benefits program running a vendor fraud score would face the deadline directly, and its inspector general would be checking the inventory against the systems it actually runs.

Later federal guidance bore out the hypothetical’s instincts. OMB’s 2025 list of purposes presumed to be high-impact named eligibility for benefits and the determination of continued eligibility. It also named the use of biometrics or other means to control access to the IT systems people use to apply for benefits. The fraud score and the facial matching step would both have been squarely in view under either administration’s rules.

Technical sophistication did not make the difference. The agency did not need data scientists to find these systems. It needed program managers who could describe how decisions were really made, contracting officers willing to put pointed questions to vendors, and a leadership team prepared to hear that its list of two harmless pilots had been the wrong list. The real inventory was hiding in plain sight, inside software the agency had bought years earlier to do something else entirely.

Harm in the pattern, cost in the switch-off

The memo mattered beyond compliance because these systems shape real outcomes for real people: who gets benefits promptly, who is investigated, which workplaces are inspected first. A model that delays eligible applicants or concentrates investigations on particular groups can do harm at scale, and create legal and political exposure, long before anyone notices. The harm is hard to see from the inside because each individual decision looks reasonable. It only shows up in the pattern.

Equally, switching off a model that works well has costs. Waits lengthen, backlogs grow, fraud controls weaken, and staff who had come to depend on a triage score find their workload rising overnight. Both mistakes, keeping a harmful system and dropping a useful one, cost money and public trust.

The case that the memo went too far

Critics raised fair objections. Applying the same minimum practices to every presumed category risked treating a low-stakes scheduling tool like a benefits denial engine. Agencies might stop experimenting with useful tools to avoid the paperwork. And the requirement for human review could produce exactly the rubber-stamping it was meant to prevent, if staff were added to the loop without time or authority.

Those objections argue for proportion, not for leaving existing systems alone. A scheduling tool can carry a short assessment and a simple fallback. A model that routes applicants to fraud investigators needs the full treatment. The draft’s structure allowed that distinction through its presumption categories and determinations. The retrofit approach in this article is built on the same idea: start where the model drives outcomes most directly, and spend less where it does not.

The vendor side

The memo also reached the vendor side of the market. Suppliers to federal agencies could expect requests for documentation, testing access and change notices. A vendor that had kept good records could answer quickly. One that had built features without the records an impact assessment needs could not. For agencies, the useful signal was how quickly each vendor answered, since a supplier that cannot describe its own model is a risk at any deadline.

A vendor may respond by offering to disable a scoring feature rather than document it. That option deserves care. Removing a feature the agency relies on is a switch-off by another name, and it needs the same fallback analysis. Agencies were better served by asking for both: the documentation, and a clear statement of what turning the feature off would involve. Either path could then be planned before the deadline forced a choice.

There is also a budget dimension that is easy to underestimate. Retrofits require staff time from program offices, legal, contracting and IT, all of them already stretched. Collecting outcome data, rewriting notices and modifying contracts all cost money that was not in the plan. An agency that understood the scope early could make its case for resources in good time. One that discovered the scope late faced the deadline with neither the money nor the people to meet it.

Budget timing made it harder

The draft arrived at an awkward point in the budget cycle. Fiscal year 2024 had begun on October 1, 2023, under a continuing resolution, and full-year appropriations were not enacted until March 2024. Continuing resolutions generally fund agencies at prior-year levels and restrict new activities. Retrofit work that needed new money, such as outcome data collection or a vendor contract modification, had to be found within existing budgets or wait.

Agencies that started early could do the low-cost work first. Inventory by decision, vendor letters, override measurement and fallback plans mostly need staff time, not new contracts. Those steps also produced the evidence needed to justify money in the next budget request.

What testing reveals about past decisions

A retrofit has an uncomfortable second-order effect. Testing a model that has run for years may show that it treated some group of applicants unfairly or simply performed badly. That finding raises questions about decisions already made. Applicants denied or delayed on the strength of a flawed score may have grounds to seek review, and the agency may need to reopen cases.

That risk is a reason some offices hesitate to test at all. It is a poor reason. A problem found by the agency, with a remediation plan attached, is far easier to manage than the same problem found by litigants or auditors. Agencies should involve counsel early, decide in advance how they will handle adverse findings, and budget for the possibility of reopening cases.

Finally, the memo changed who is accountable. Before it, a model embedded in a vendor product could sit in a kind of ownership limbo, bought by one office, run by another and relied on by a third. The draft’s structure, with a chief AI officer, a governance board and a hard deadline, pulled those systems into the light and made someone answerable for each of them. The change was uncomfortable but useful: it is far better to learn what your systems are doing from your own inventory than from an inspector general, a court or a newspaper.

Inventories built from decisions

The stronger agencies built their inventory from decisions rather than self-reporting, so that systems were found because of what they did rather than what they were called. Vendors were asked in writing, with a deadline, and their answers were kept on file. Retrofits were ranked by how much the model drives outcomes for people, with the low-override systems first. Human review was measured rather than assumed. Every in-scope system had a written fallback, with staffing and service effects spelled out. Contracts were modified rather than left until re-competition. And a chief AI officer had real authority to set priorities and recommend waivers, with a governance board that actually met and decided things.

The weaker ones did the reverse. They relied on surveys and accepted “no AI here” from offices whose case management systems were scoring cases all along. They assumed vendor products were the vendor’s problem, when the obligation sat with the agency using them. They treated human review as a box to tick, pointing to a procedure manual while caseworkers approved flagged cases in bulk. They waited for contract re-competition to obtain documentation they needed within months. They did not collect outcome data, so they could never show whether a model worked. And they discovered what a model contributed only when it had to be switched off, at the worst possible moment.

A subtler error was to treat the exercise as a one-time compliance project. Models change when vendors update them. New features arrive in routine software releases. A system that was out of scope last year can drift into scope this year. The agencies that handled the memo best built a standing process rather than a one-off sweep.

Keeping the inventory current

A standing process needs triggers. Procurement intake can ask, for every new purchase or renewal, whether the product scores, ranks or recommends anything about people. Release notes from major vendors can be routed to the chief AI officer’s team for a short review. Program owners can attest each year that their entry is accurate, naming any new feature staff have started to rely on. And any contract modification touching a scored workflow can prompt a fresh look at the impact assessment.

Each of these triggers costs little on its own. Together they keep the inventory from decaying between annual reporting cycles. They also spread the work, so the chief AI officer’s office reviews changes instead of rediscovering systems.

Who owns which part

Clear roles keep the standing process alive. The chief AI officer owns the inventory method, the retrofit queue and waiver recommendations. Program owners confirm which outputs staff rely on and own the fallback plans. The chief information officer and chief data officer supply system and data documentation. The privacy officer connects the work to privacy impact assessments, which the E-Government Act of 2002 already requires for systems handling personal information. The civil rights office reviews testing results by group. Contracting officers own vendor questions and contract changes.

An inspector general or GAO auditor would ask for evidence in a predictable order. First comes the inventory method and how it found systems. Then come the vendor responses, the impact assessments with the names of those who accepted the risk, override rates and monitoring reports, and any waivers with their justifications. An agency that can produce those documents in a day is in control of its AI. One that has to assemble them after the request arrives is not.

A few metrics show progress. Useful ones are the number of in-scope systems with a completed assessment, the share with measured override rates, the number of vendor responses outstanding past their deadline, and the share with a written fallback. Each can be reported to the governance board monthly as the deadline approaches.

Before the deadline arrives

• Which of our decisions about eligibility, enforcement, safety or access to services draw on a score, ranking or recommendation from software?
• Which of those come from vendor products, and have we asked each vendor in writing what models their features use?
• For each system, how often do staff disagree with its output, and do they have the time and information to do so?
• If we had to switch each system off, what would replace it, what staff would that take, and what would residents notice?
• Does our chief AI officer have authority over the inventory, the order of retrofits and waiver recommendations, or only a reporting role?

With hindsight

OMB finalized the guidance as memorandum M-24-10 in March 2024 and moved the deadline for minimum practices on rights- and safety-impacting uses to December 1, 2024. That gave agencies several more months than the draft’s August date, a recognition of how much retrofit work the requirements implied.

The final memo kept the draft’s architecture and sharpened parts of it. Every CFO Act agency had to establish an AI governance board by May 27, 2024. The accompanying White House fact sheet gave examples of what the safeguards meant. Travelers would be able to opt out of TSA facial recognition without delay or losing their place in line. AI used to detect fraud in government services would require human oversight of impactful decisions and a route to remedy. Waivers had to be disclosed publicly with their justifications. In September 2024 OMB followed with a companion memo, M-24-18, on the responsible acquisition of AI.

Agencies published expanded use-case inventories that December, and some issued extensions or waivers for specific uses. The waivers and extensions were themselves telling: they showed where the off switch would have bitten hardest, and where agencies judged that stopping a system would do more harm than continuing it while work went on.

Then the political ground shifted. President Trump revoked Executive Order 14110 on January 20, 2025. In April 2025, OMB replaced the 2024 memoranda with M-25-21 and a companion memo on acquisition, the rules for how agencies buy AI. The new guidance put more weight on adoption, encouraging agencies to use AI more widely.

But it kept chief AI officers, inventories and a category of high-impact AI. It again told agencies to document minimum practices for those uses within about a year or safely discontinue non-compliant functionality, subject to waivers.

The details of M-25-21, issued on April 3, 2025, show what changed and what did not. It defined high-impact AI as AI whose output serves as a principal basis for decisions or actions with a legal, material, binding or significant effect on rights or safety. Chief AI officers had to be designated within 60 days, and waivers had to be certified annually and reported publicly. The minimum practices still included pre-deployment testing, an impact assessment with independent review, ongoing monitoring, human oversight and a chance to appeal. National security systems remained outside its scope.

The phrase “principal basis” mattered for systems already running. A score that is one input among many may fall outside the definition, while one that effectively decides the outcome falls inside. That puts the override rate, and the evidence of how staff actually use a score, at the center of the scoping decision. The companion acquisition memo, M-25-22, applied to contracts awarded from solicitations issued 180 days after it was released, and to options exercised after that date. Its clauses therefore reached existing vendors at renewal rather than immediately.

The comply-or-stop structure, and the retrofit work on systems already in production, outlasted the order that started it. The two categories of rights-impacting and safety-impacting AI were merged into a single high-impact category, but the list of presumed purposes still pointed at benefits, enforcement, health and safety. That counts for something in a field where policy can swing sharply with each administration. The specific deadlines moved and the emphasis changed, but the core idea survived a change of President: if an AI system makes consequential decisions about people, the agency must be able to show it is managed responsibly, or stop using it.

The preparation was never wasted. An agency that found its hidden models, measured how much staff relied on them, wrote down what would replace them and fixed its vendor contracts was ready for the 2024 memo, the 2025 memo, and whatever comes next.