United States - AI Governance and Risk Management (M-24-10)

Overview

OMB Memorandum M-24-10, published March 28, 2024, sets expectations for executive branch agencies to strengthen governance, promote responsible AI innovation, and manage risks tied to agency use of AI—especially where those uses may affect the rights and safety of the public. The memorandum requires agencies to designate a Chief AI Officer (CAIO), create internal governance mechanisms, maintain inventories of AI use cases, and adopt minimum risk-management practices for systems that are presumed to be rights-impacting or safety-impacting. The memo also instructs agencies to publish plans and public-facing inventories and to coordinate through OMB and interagency mechanisms. The full text and authoritative source are available from the White House and OMB: OMB Memorandum M-24-10 (PDF) and OMB policy channels. The policy complements Executive Order 14110 and related statutes by focusing on operational governance and minimum practices tailored to rights- and safety-impacting AI.

Definitions

M-24-10 defines or operationalizes core terms to align agency implementation. Key terms include "AI use cases" (applications that employ AI to inform, influence, or execute agency decisions or actions), "rights-impacting AI" (systems whose outputs have legal, material, binding, or similarly significant effects on individuals or communities), and "safety-impacting AI" (applications that could create or exacerbate physical or safety risks). The memorandum distinguishes these risks from enterprise IT, privacy, accessibility, or general cybersecurity requirements and clarifies that its risk focus is on outcomes tied to agency reliance on AI outputs. It also references the Chief Financial Officers (CFO) Act agencies for certain reporting thresholds and connects to existing definitions used in the AI in Government Act and related OMB guidance.

Governance and Institutional Framework

M-24-10 requires agencies to strengthen governance at the enterprise level. Each agency must designate a CAIO within 60 days of the memorandum and appoint or designate an AI governance board or coordination mechanism that includes senior leaders from relevant mission, legal, privacy, IT, procurement, and compliance functions. The CAIO's responsibilities include coordinating AI use, promoting innovation consistent with law and policy, managing AI-related risks, convening governance boards, and interfacing with OMB and the interagency CAIO council. Agencies must develop plans to achieve consistency with M-24-10 and post either those plans or a written determination of non-use on agency websites; initial plans are due to OMB within 180 days of the memorandum and every two years thereafter. OMB and the Office of Science and Technology Policy (OSTP) will coordinate government-wide activities and create shared templates, technical resources, and a consolidated federal AI use-case inventory (CIO Council / OSTP reference). Agencies are encouraged to recruit AI talent and to align enterprise processes to permit reuse of models, code, and data where lawful and appropriate.

Key Focus Areas

The memorandum centers on three policy pillars: strengthening governance, advancing responsible innovation, and managing risks. Strengthening governance includes CAIO designation, governance boards, integration with enterprise risk processes, and public transparency obligations (plans, inventories, and aggregate metrics). Advancing responsible innovation encourages reuse of agency code and models, development of testbeds and controlled environments, workforce development, and interagency sharing of best practices and templates. Managing risks is the memo's most prescriptive element: it identifies categories of AI that are presumed to be rights- or safety-impacting (for example, law enforcement systems, eligibility determinations for benefits, hiring/admissions, immigration and border adjudications, public health and medical determinations, and safety-critical infrastructure controls) and instructs agencies to apply minimum risk management practices before deployment. These minimum practices include pre-deployment testing under controlled conditions, documentation and risk assessments, legal review, data quality assessment, human oversight and escalation points, monitoring and measurement of performance, and mitigation plans. The memo also provides procurement guidance: procurements must align with law, encourage competition, require transparency, and promote supplier accountability and model provenance. To balance agility and safety, the memo permits controlled testing, pilot deployments, and limited waivers where justified.

Implementation Framework

Implementation is structured with concrete deliverables and timelines. Agencies must submit either a plan to achieve consistency with M-24-10 or a written determination that they do not use covered AI within 180 days of issuance (initially due Sept 24, 2024). Agencies must inventory AI use cases at least annually and post a public-facing inventory; CFO Act agencies and other higher-use agencies have additional reporting expectations. The CAIO and governance boards are responsible for internal policies and checklists for procurement, testing, documentation, privacy and civil rights review, and monitoring. Implementation guidance emphasizes reuse and interoperability of inventory formats and encourages agencies to post code, models, and data consistent with law. The memorandum allows limited extensions and waivers when agencies demonstrate appropriate mitigation and justification, and it defines procedures for escalating instances where risks exceed acceptable levels, including stopping use of an AI system pending remediation.

Monitoring and Evaluation

M-24-10 requires ongoing post-deployment monitoring focused on degradation of performance, changes in impact to rights and safety, and detection of AI-specific exploits or vulnerabilities. Agencies must scale feature rollouts incrementally when feasible, perform periodic human reviews at least annually for qualifying tools, and involve independent oversight not directly involved in development or operations. Monitoring must include metrics and thresholds to trigger mitigation actions, and agencies must re-evaluate whether minimum practices remain adequate as risks evolve. If monitoring reveals unacceptable risk, agencies are required to mitigate (by updating models, changing procedures, or halting deployment) and report actions to appropriate internal authorities and, in many cases, publicly.

Penalties, Liability, and Appeals

As a policy memorandum, M-24-10 does not create new criminal penalties but establishes administrative expectations and remedial pathways. Enforcement is administrative: OMB can require corrective actions, withhold approvals, require remediation plans, or direct suspension of an AI deployment that presents unacceptable risks. Agencies are expected to use existing disciplinary, procurement, and contract-remedy tools where vendor behavior or noncompliance is identified. The memorandum also signals that agencies must preserve individuals' existing rights to redress under applicable statutes; where AI outputs drive adverse agency actions, agencies must ensure procedures for appeal and due process consistent with law. Some agencies implement internal sanctions or procurement disqualifications for vendors that fail to meet risk-management requirements.

Relationship to Other Instruments

M-24-10 complements and builds on statutory authorities and prior executive actions: it implements aspects of the AI in Government Act of 2020, the Advancing American AI Act, and Executive Order 14110 (Safe, Secure, and Trustworthy Development and Use of AI). The memorandum is not a substitute for sector-specific laws (e.g., HIPAA, financial regulations, civil rights statutes) and does not override existing privacy, accessibility, or cybersecurity rules; rather, agencies must apply M-24-10 in conjunction with those obligations. The memorandum also references the NIST AI Risk Management Framework and other interagency guidance as supporting materials for technical standards and evaluation practices. Agencies should coordinate M-24-10 implementation with agency-specific statutes and regulator guidance.

International Alignment

OMB frames M-24-10 as consistent with U.S. commitments to democratic values and international law and encourages interoperability with international approaches to AI governance. The memorandum's emphasis on transparency, rights protection, and minimum risk-management practices aligns with global trends in responsible AI regulation and standards development led by bodies such as the OECD and standards organizations. OMB and OSTP will engage internationally to promote U.S. approaches and to harmonize where feasible while preserving lawful protections for classified and national-security information.

Implementation Timeline

Sources and References