[{"id": 520548, "type": "GenericWebPage", "mime_type": "text/html", "url": "https://www.iso.org/standard/77304.html", "slug": "iso", "title": "ISO/IEC 23894:2023 - AI \u2014 Guidance on risk management", "snippet": "It moreover describes processes for the effective implementation and integration of AI risk management. The application of this guidance can be customized to any organization and its context. ... Enhance your organization's AI management and information security with this comprehensive standards ...", "image": null, "date_published": null, "media": [], "products": [], "source": {"id": 520548, "website_id": 14922, "url": "https://www.iso.org/standard/77304.html", "title": "ISO/IEC 23894:2023 - AI \u2014 Guidance on risk management", "snippet": "It moreover describes processes for the effective implementation and integration of AI risk management. The application of this guidance can be customized to any organization and its context. ... Enhance your organization's AI management and information security with this comprehensive standards ...", "cleaned_text": null, "cleaned_text_custom_parser": "It moreover describes processes for the effective implementation and integration of AI risk management. The application of this guidance can be customized to any organization and its context. ... Enhance your organization's AI management and information security with this comprehensive standards ...", "cleaned_text_custom_parser_2": null, "best_field": "cleaned_text_custom_parser", "enhanced": false, "date_published": null, "image": null, "num_tokens_oai_tokenizer": null, "num_tokens_gemini_tokenizer": null}, "favicon": "https://www.iso.org/modules/isoorg-template/img/iso/favicon/red/apple-touch-icon-152x152-precomposed.png", "state": "candidate", "enhanced": false, "answer": null, "valid_answer": false, "source_citation_index": 1, "user_web_page_id": null, "status": "not_processed", "reader": false, "rank": 1, "reason": "The source is highly relevant to the query because it provides a comprehensive overview of the ISO AI risk management standard and guidance for implementation."}, {"id": 494038, "type": "GenericWebPage", "mime_type": "text/html", "url": "https://www.iso.org/standard/42001", "slug": "iso", "title": "ISO/IEC 42001:2023 - AI management systems", "snippet": "What are the main benefits of implementing ISO/IEC 42001? Responsible AI: ensures ethical and responsible use of artificial intelligence. AI governance: supports compliance with legal and regulatory standards. Identifying opportunities: Encourages innovation within a structured framework.", "image": null, "date_published": null, "media": [], "products": [], "source": {"id": 494038, "website_id": 14922, "url": "https://www.iso.org/standard/42001", "title": "ISO/IEC 42001:2023 - AI management systems", "snippet": "What are the main benefits of implementing ISO/IEC 42001? Responsible AI: ensures ethical and responsible use of artificial intelligence. AI governance: supports compliance with legal and regulatory standards. Identifying opportunities: Encourages innovation within a structured framework.", "cleaned_text": null, "cleaned_text_custom_parser": "What are the main benefits of implementing ISO/IEC 42001? Responsible AI: ensures ethical and responsible use of artificial intelligence. AI governance: supports compliance with legal and regulatory standards. Identifying opportunities: Encourages innovation within a structured framework.", "cleaned_text_custom_parser_2": null, "best_field": "cleaned_text_custom_parser", "enhanced": false, "date_published": null, "image": null, "num_tokens_oai_tokenizer": null, "num_tokens_gemini_tokenizer": null}, "favicon": "https://www.iso.org/modules/isoorg-template/img/iso/favicon/red/apple-touch-icon-152x152-precomposed.png", "state": "candidate", "enhanced": false, "answer": null, "valid_answer": false, "source_citation_index": 2, "user_web_page_id": null, "status": "not_processed", "reader": false, "rank": 1, "reason": "The source offers relevant information on AI governance and compliance frameworks aligned with ISO standards, making it useful for compliance officers."}, {"id": 598036, "type": "GenericWebPage", "mime_type": "text/html", "url": "https://www.ganintegrity.com/resources/blog/ai-governance-mitigating-ai-risk-in-corporate-compliance-programs/", "slug": "ganintegrity", "title": "AI Governance: Mitigating AI Risk in Corporate Compliance Programs", "snippet": "That\u2019s why, going forward and wherever applicable, our prosecutors will assess a company\u2019s ability to manage AI-related risks as part of its overall compliance efforts.\u201d \u00b7 Compliance officers can expect to see updates to the DOJ\u2019s guidance on Evaluation of Corporate Compliance Programs to include assessment of disruptive technology risks \u2014 including risks associated with AI.", "image": null, "date_published": null, "media": [], "products": [], "source": {"id": 598036, "website_id": 132143, "url": "https://www.ganintegrity.com/resources/blog/ai-governance-mitigating-ai-risk-in-corporate-compliance-programs/", "title": "AI Governance: Mitigating AI Risk in Corporate Compliance Programs", "snippet": "That\u2019s why, going forward and wherever applicable, our prosecutors will assess a company\u2019s ability to manage AI-related risks as part of its overall compliance efforts.\u201d \u00b7 Compliance officers can expect to see updates to the DOJ\u2019s guidance on Evaluation of Corporate Compliance Programs to include assessment of disruptive technology risks \u2014 including risks associated with AI.", "cleaned_text": null, "cleaned_text_custom_parser": null, "cleaned_text_custom_parser_2": null, "best_field": null, "enhanced": false, "date_published": null, "image": null, "num_tokens_oai_tokenizer": null, "num_tokens_gemini_tokenizer": null}, "favicon": null, "state": "candidate", "enhanced": false, "answer": null, "valid_answer": false, "source_citation_index": 3, "user_web_page_id": null, "status": "not_processed", "reader": false, "rank": 1, "reason": "This source discusses specific strategies that comply with AI risk management practices, which is essential for compliance officers."}, {"id": 598057, "type": "GenericWebPage", "mime_type": "text/html", "url": "https://digital.nemko.com/standards/iso-iec-23894", "slug": "nemko", "title": "ISO/IEC 23894: Complete Guide to AI Risk Management", "snippet": "The ISO/IEC 23894:2023 standard offers a comprehensive framework for identifying, assessing, and managing these risks, enabling organizations to implement AI technologies responsibly while ...", "image": null, "date_published": null, "media": [], "products": [], "source": {"id": 598057, "website_id": 106952, "url": "https://digital.nemko.com/standards/iso-iec-23894", "title": "ISO/IEC 23894: Complete Guide to AI Risk Management", "snippet": "The ISO/IEC 23894:2023 standard offers a comprehensive framework for identifying, assessing, and managing these risks, enabling organizations to implement AI technologies responsibly while ...", "cleaned_text": null, "cleaned_text_custom_parser": null, "cleaned_text_custom_parser_2": null, "best_field": null, "enhanced": false, "date_published": null, "image": null, "num_tokens_oai_tokenizer": null, "num_tokens_gemini_tokenizer": null}, "favicon": null, "state": "candidate", "enhanced": false, "answer": null, "valid_answer": false, "source_citation_index": 4, "user_web_page_id": null, "status": "not_processed", "reader": false, "rank": 1, "reason": "The source explains the AI risk management standard ISO/IEC 23894, which is directly related to managing AI-related risks."}, {"id": 598050, "type": "GenericWebPage", "mime_type": "text/html", "url": "https://sprinto.com/blog/iso-42001-for-ai-risk-management/", "slug": "sprinto", "title": "ISO 42001 for AI Risk Management: Framework for AI Governance", "snippet": "Risk-based Lifecycle Controls: ISO 42001 enforces a structured risk management process\u2014spanning AI design, development, deployment, and decommissioning\u2014to identify, assess, and mitigate potential harm or bias.", "image": null, "date_published": null, "media": [], "products": [], "source": {"id": 598050, "website_id": 117470, "url": "https://sprinto.com/blog/iso-42001-for-ai-risk-management/", "title": "ISO 42001 for AI Risk Management: Framework for AI Governance", "snippet": "Risk-based Lifecycle Controls: ISO 42001 enforces a structured risk management process\u2014spanning AI design, development, deployment, and decommissioning\u2014to identify, assess, and mitigate potential harm or bias.", "cleaned_text": null, "cleaned_text_custom_parser": null, "cleaned_text_custom_parser_2": null, "best_field": null, "enhanced": false, "date_published": null, "image": null, "num_tokens_oai_tokenizer": null, "num_tokens_gemini_tokenizer": null}, "favicon": "https://sprinto.com/wp-content/uploads/2021/10/favicon.ico", "state": "candidate", "enhanced": false, "answer": null, "valid_answer": false, "source_citation_index": 5, "user_web_page_id": null, "status": "not_processed", "reader": false, "rank": 1, "reason": "The source focuses on the ISO 42001 standard and its role in AI risk management and compliance, pertinent for compliance officers."}, {"id": 598043, "type": "GenericWebPage", "mime_type": "text/html", "url": "https://iso-docs.com/blogs/iso-42001-artificial-intelligence-management-system-aims/ai-risk-assessments-under-iso-iec-42001-a-practical-guide", "slug": "iso-docs", "title": "AI Risk Assessments Under ISO/IEC 42001: A Practical Guide \u2013 ISO Templates and Documents Download", "snippet": "Conduct a Gap Analysis: Assess your current AI practices and capabilities against the requirements of ISO/IEC 42001. Identify any gaps or areas of improvement that need to be addressed. Develop an AI Governance Framework: Define the roles, responsibilities, and decision-making processes related to AI within your organization. This framework should include mechanisms for ensuring ethical considerations, risk management, data governance, and accountability.", "image": null, "date_published": null, "media": [], "products": [], "source": {"id": 598043, "website_id": 68509, "url": "https://iso-docs.com/blogs/iso-42001-artificial-intelligence-management-system-aims/ai-risk-assessments-under-iso-iec-42001-a-practical-guide", "title": "AI Risk Assessments Under ISO/IEC 42001: A Practical Guide \u2013 ISO Templates and Documents Download", "snippet": "Conduct a Gap Analysis: Assess your current AI practices and capabilities against the requirements of ISO/IEC 42001. Identify any gaps or areas of improvement that need to be addressed. Develop an AI Governance Framework: Define the roles, responsibilities, and decision-making processes related to AI within your organization. This framework should include mechanisms for ensuring ethical considerations, risk management, data governance, and accountability.", "cleaned_text": null, "cleaned_text_custom_parser": null, "cleaned_text_custom_parser_2": null, "best_field": null, "enhanced": false, "date_published": null, "image": null, "num_tokens_oai_tokenizer": null, "num_tokens_gemini_tokenizer": null}, "favicon": null, "state": "candidate", "enhanced": false, "answer": null, "valid_answer": false, "source_citation_index": 6, "user_web_page_id": null, "status": "not_processed", "reader": false, "rank": 2, "reason": "This source covers AI risk assessments and guidance linked with the ISO standards needed for compliance."}, {"id": 585798, "type": "GenericWebPage", "mime_type": "text/html", "url": "https://www.gsa.gov/technology/government-it-initiatives/artificial-intelligence/ai-guidance-and-resources/ai-compliance-plan", "slug": "gsa", "title": "Artificial intelligence compliance plan", "snippet": "AI Strategy and Governance: GSA has established a robust framework to guide Federal agencies in the ethical and effective use of artificial intelligence. This includes developing strategic use cases aligned with agency missions, offering governance models to ensure compliance with Federal standards, and providing procurement guidance to mitigate risks.", "image": null, "date_published": null, "media": [], "products": [], "source": {"id": 585798, "website_id": 16162, "url": "https://www.gsa.gov/technology/government-it-initiatives/artificial-intelligence/ai-guidance-and-resources/ai-compliance-plan", "title": "Artificial intelligence compliance plan", "snippet": "AI Strategy and Governance: GSA has established a robust framework to guide Federal agencies in the ethical and effective use of artificial intelligence. This includes developing strategic use cases aligned with agency missions, offering governance models to ensure compliance with Federal standards, and providing procurement guidance to mitigate risks.", "cleaned_text": "Traveler reimbursement is based on the location of the work activities and not the accommodations, unless lodging is not available at the work activity, then the agency may authorize the rate where lodging is obtained.\n\nUnless otherwise specified, the per diem locality is defined as 'all locations within, or entirely surrounded by, the corporate limits of the key city, including independent entities located within those boundaries.'\n\nPer diem localities with county definitions shall include'all locations within, or entirely surrounded by, the corporate limits of the key city as well as the boundaries of the listed counties, including independent entities located within the boundaries of the key city and the listed counties (unless otherwise listed separately).'\n\nWhen a military installation or Government - related facility(whether or not specifically named) is located partially within more than one city or county boundary, the applicable per diem rate for the entire installation or facility is the higher of the rates which apply to the cities and / or counties, even though part(s) of such activities may be located outside the defined per diem locality.", "cleaned_text_custom_parser": "Official websites use .govA.govwebsite belongs to an official government organization in the United States.\nSecure .gov websites use HTTPSAlock()\n orhttps://means you\u2019ve safely connected to the .gov website. Share sensitive information only on official, secure websites.\nFeatured Topics\nFeatured Topics\nFeatured Topics - Real Estate\nFeatured Topics\nFeatured Topics\nFeatured Topics\nFeatured Topics\nFeatured Topics\nArtificial intelligence compliance plan\nOur AI compliance plan is our response to comply with the Office of Management and Budget, or OMB, Memorandums M-25-21 and M-25-22.\nGeneral\nDescribe any planned or current efforts within your agency to update any existing internal AI principles, guidelines, or policy to ensure consistency with M-25-21 and M-25-22.\nBy December 29, 2025, GSA plans to release 2185.2 CIO, Accelerating Responsible Use of Artificial Intelligence at GSA. This directive will be based on the mandates and guidance set forth in OMB M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust; OMB M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government; and other Federal mandates. GSA\u2019s directive will outline policies for the responsible, efficient, and accelerated adoption of AI technologies at GSA. It will address key issues related to AI adoption within the GSA network, including establishing policies for controlled access and responsible, efficient AI use, as well as outlining procedures for the assessment, procurement, use, monitoring, and governance of AI systems. A critical focus will be ensuring compliance with existing security, privacy, ethics, and legal frameworks, while also accelerating Federal AI use in line with directives for innovation, governance, and public trust. The directive will also aim to remove barriers to AI adoption, empower AI leaders, and safeguard individual rights and liberties, especially concerning high-impact AI. Furthermore, it will address risk management through regular assessments, prioritize appropriate AI uses to improve agency missions, ensure adequate data infrastructure and curation, assess and plan for AI workforce needs, and promote interagency coordination and efficient AI acquisition practices.\nGSA currently has in place 2185.1A CIO, Use of Artificial Intelligence (AI) at GSA, which established governing policies for the controlled access and responsible use of AI technologies and platforms within GSA. This policy replaced CIO IL-23-01, which focused on generative AI, and expanded its scope to cover broader AI governance. The 2185.1A CIO directive refines and updates the previous directive to reflect evolving guidance and to accelerate the responsible adoption of AI within GSA, with a particular emphasis on classifying and managing different levels of AI impact.\nGSA will conduct annual reviews and assessments of 2185.2 CIO to ensure the mandates set forth in OMB M-25-21 and M-25-22 are maintained as AI capabilities continue to evolve. The Chief Artificial Intelligence Officer (CAIO) will lead these reviews with the support of the Evidence-Based Data Governance Executive (EDGE) Board and AI Safety Team. Updates to 2185.2 CIO and other relevant policies will be released as-needed and are not restricted to an annual update.\nAI Governance Bodies\nGSA\u2019s AI governance structure is composed of two bodies: the EDGE Board and the AI Safety Team.\nTheEDGE Boardserves as a decisional body to oversee and coordinate GSA\u2019s activities related to AI and data governance. It is responsible for overseeing and coordinating GSA\u2019s activities related to AI and data governance. This includes setting the overall vision and goals for AI development and use within the agency, emphasizing risk management, ethical guidelines, compliance with legal standards, and alignment with GSA\u2019s mission and values, particularly with Executive Order 14179, OMB M-25-21 and M-25-22. The EDGE Board also sets, updates, and funds GSA\u2019s data priorities, making sure the agency fully uses data as a key asset and enforces data governance laws, policies, and regulations as mandated by the Foundations for Evidence-Based Policymaking Act.\nThe EDGE Board, which is chaired by GSA\u2019s Deputy Administrator and co-chaired by the Chief Data Officer (CDO)/CAIO, reports to the GSA Administrator. The Board comprises executive leadership from GSA\u2019s Services and Staff Offices, as follows:\nThe EDGE Board oversees theAI Safety Team, a cross-functional working group established to facilitate the effective integration and utilization of AI technologies across the organization. Its purpose is to ensure that AI initiatives align with organizational goals, promote accessibility, enhance content quality, leverage research and data effectively, provide adequate training, optimize design and user experience, and are supported by robust technology and infrastructure. The team identifies opportunities for AI integration, develops public AI strategies, and establishes guidelines for ethical and responsible AI use, including evaluating AI technologies, reusing existing AI resources, investing in American-developed AI products, and fostering AI talent within GSA. Additionally, the team provides AI training, collaborates with stakeholders, sets expectations for workforce AI use, monitors AI project implementation and impact, and ensures compliance with relevant laws and regulations, while regularly reporting progress to GSA leadership.\nThe AI Safety Team comprises representatives from key GSA offices, providing expertise and ensuring comprehensive consideration of AI integration across various aspects of GSA\u2019s operations. These offices include:\nDescribe how, if at all, your agency\u2019s AI governance body plans to consult with external experts as appropriate and consistent with applicable law.\nGSA has and will continue to collaborate with external experts, including academic institutions, State governments, and other Federal agencies to develop training programs and benchmark its updated AI policies against best practices in the field. Members of the EDGE Board and AI Safety Team regularly engage with interagency groups and councils, including the CDO council, the CAIO council, the CHCO council, the U.S. Office of Personnel Management, the AI Talent Task Force, and the three interagency working groups coordinated by the CAIO council on generative AI, AI-related acquisitions, and AI risk management.\nExternal consultation will continue to play a critical role in both governance and safety efforts. The EDGE Board plans to consult with external experts as appropriate and consistent with applicable law. This consultation may include input from Federally Funded Research and Development Centers, academic institutions, think tanks, and industry experts to stay informed about AI\u2019s latest trends, risks, and best practices. Civil society organizations, labor unions, and similar groups may also be consulted to ensure that AI systems meet public interest standards and consider workforce impacts.\nAI Use Case Inventories\nDescribe your agency\u2019s process for soliciting and collecting AI use cases across all sub- agencies, components, or bureaus for the inventory. In particular, address how your agency plans to ensure your inventory is comprehensive, complete, and encompasses updates to existing use cases.\nGSA\u2019s process for soliciting and collecting AI use cases across the organization is led by the CAIO. The CAIO is responsible for ensuring that the AI use case inventory is comprehensive and up to date, with the support of the AI Safety Team, various program offices, and the Office of the Chief Information Officer (OCIO).\nThe process begins with the issuance of an annual request to all offices, requiring them to submit information on current and planned AI systems. Each office must identify all AI applications, regardless of the size or scope of the system. The CAIO provides and maintains standardized guidelines and templates for reporting in compliance with OMB standards. This centralized submission process is used to collect and manage AI use cases, allowing offices to submit their entries in a consistent and structured manner. All offices participate in this process and regularly update their entries to reflect any changes, such as new AI capabilities, updates to existing systems, or the decommissioning of older technologies.\nThe CAIO oversees periodic reviews and audits to maintain the inventory\u2019s accuracy and completeness. The CAIO also coordinates within the OCIO so that existing processes like Authorizations To Operate, Federal Information Technology Acquisition Reform Act reviews, and new software requests can identify AI instances across the enterprise. This process ensures that GSA\u2019s AI inventory remains accurate and fully reflects the agency\u2019s ongoing use of AI technology. This approach, led by the CAIO, provides a comprehensive and complete inventory of AI use cases that support the agency\u2019s governance and decision-making processes regarding AI deployment.\nReporting on AI Use Cases Not Subject to Inventory\nDescribe your agency\u2019s process for soliciting and collecting AI use cases that meet the criteria for exclusion from being individually inventoried.\nRemoving Barriers to the Responsible Use of AI\nDescribe any barriers to the responsible use of AI that your agency has identified, as well as any steps your agency has taken (or plans to take) to mitigate or remove these identified barriers.\nGSA has identified several potential barriers to the responsible use of AI, including the procurement of AI solutions, access to high-quality data products with scalable infrastructure, and AI models and libraries. GSA has established an enterprise data platform (i.e., Enterprise Data Solution or EDS), which includes an enterprise data catalog, scalable compute infrastructure, analytical tooling, and AI/ML systems and services. This platform allows for programs to store, curate, and productize their data holdings for analytical purposes, as well as disseminate the information products generated via hosted services. EDS also allows for sandbox capabilities where AI tools can be safely tested and where rapid prototyping may occur.\nGSA supports several pilot projects that assess the capabilities and viability of AI products for specific use cases, including the ease with which AI infrastructure and products may be set up, and how AI tools and services can be leveraged to improve mission outcomes for agencies. These pilot projects are designed to help GSA better understand, manage, and provide guidance for internal and other agency use regarding AI technologies for future implementation.\nGSA has leveraged sandboxes to test AI capabilities of AI chatbots, IT security enhancements, custom application development, and general productivity assessments, allowing staff to evaluate AI\u2019s potential while ensuring security and compliance.\nTo support the availability of AI tooling and infrastructure, theFedRAMPprogram has established a framework for prioritizing emerging technologies (ETs) for FedRAMP authorization, which covers technologies listed in the Office of Science and Technology Policy\u2019s Critical and Emerging Technologies. This framework enables routine and consistent prioritization of the most critical cloud-relevant ETs needed for use by Federal agencies. This prioritization controls how FedRAMP prioritizes its own work and review processes, and will not address how sponsoring agencies manage their own internal priorities.\nIdentify whether your agency has developed (or is in the process of developing) internal guidance for the use of generative AI.\nGSA has developed internal guidance for the use of generative AI and has made it available to employees on an internal website. This guidance includes the safeguards and oversight mechanisms necessary for responsible use without posing undue risk. The EDGE Board and AI Safety Team provide oversight by reviewing and dispositioning AI use cases, ensuring compliance with ethical standards, data privacy, and security protocols. The guidance also requires that generative AI tools be used under controlled conditions set forth by the guidance and standards established in OMB M-25-21 and M-25-22 and enforced and overseen by the AI Safety Team. GSA is evaluating continuous monitoring and evaluation processes and tools for generative AI.\nAI Talent\nDescribe any planned or in-progress initiatives from your agency to increase AI talent. In particular, reference any hiring authorities that your agency is leveraging, describe any AI focused teams that your agency is establishing or expanding, and identify the skillsets or skill levels that your agency is looking to attract. If your agency has designated an AI Talent Lead, identify which office they are assigned to.\nGSA is taking a multi-pronged approach to strengthen its AI workforce and infrastructure. Through targeted hiring strategies, the formation of specialized teams, and the development of centralized platforms, GSA is positioning itself as a leader in responsible AI adoption across the Federal Government. These efforts are designed to attract top-tier talent, ensure ethical, and secure AI deployment, and support other agencies in scaling their AI capabilities.\nIf applicable, describe your agency\u2019s plans to provide any resources or training to develop AI talent internally and increase AI training opportunities for Federal employees.\nGSA has made AI-related training available through online learning platforms to develop AI talent internally. The agency supports the AI Community of Excellence (CoE), which serves as a collaborative space for sharing knowledge and best practices, and is leading the AI Talent Surge effort to attract and retain skilled professionals to advance AI capabilities across the agency.\nGSA also leverages sandboxes to test AI capabilities, including enhancements, custom development, and general productivity assessments, allowing staff to evaluate AI\u2019s potential while ensuring security and compliance. GSA is committed to developing AI talent internally and increasing AI training opportunities for Federal employees. Role-based AI training tracks are accessible through online learning platforms, providing employees at various levels the opportunity to gain relevant skills. These tracks include foundational courses for employees, intermediate training for technical roles, and advanced courses for AI practitioners focusing on development, deployment, and ethical considerations.\nAdditionally, GSA leads a Government-wide initiative, called the AI Training Series, through its CoE and the Artificial Intelligence Community of Practice (AI CoP). It is designed to equip Federal employees with the knowledge and skills needed to responsibly and effectively engage with AI technologies in their roles. The program supports compliance with the AI Training Act and relevant Executive Orders, offering structured learning across three specialized tracks: Technical Track, Acquisition Track, and Leadership and Policy Track. All sessions are designed to be accessible to Federal employees regardless of technical background. Recordings and materials are made available through platforms like USA Learning and the Federal Acquisition Institute. Through this initiative, GSA plays a central role in modernizing Federal workforce capabilities, fostering cross-agency collaboration, and promoting responsible AI adoption across Government.\nAI Sharing and Collaboration\nDescribe your agency\u2019s process for ensuring that custom-developed AI code\u2014including models and model weights\u2014for AI applications in active use is shared consistent with Section 2.b of M-25-21.\nAll custom-developed AI code, including models and model weights for AI applications in active use, is shared in compliance with OMB M-25-21, Section 2.b (Sharing of Agency Data and AI Assets) by adhering to established processes for transparency and open access. This includes reviewing AI use case applications through the AI Safety Team and other relevant offices to ensure that code and models meet data security, privacy, and ethical standards before being shared. This content is disseminated via sharing platforms such as open.gsa.gov and data.gov.\nElaborate on your agency\u2019s efforts to encourage or incentivize the sharing of code, models, and data with the public. Include a description of the relevant offices that are responsible for coordinating this work.\nTo advance the responsible and effective use of AI across the Federal Government, GSA has launched a suite of initiatives designed to foster collaboration, streamline adoption, and ensure ethical governance. These efforts reflect GSA\u2019s commitment to building a unified, secure, and scalable AI ecosystem that supports agency missions while promoting transparency and innovation. From strategic frameworks and interagency communities to shared platforms and internal tools, GSA is positioning itself as a central enabler of AI transformation in the public sector.\nTo support the Federal Government\u2019s growing interest in AI, GSA is actively organizing and participating in a range of events that promote collaboration, innovation, and responsible AI adoption. These gatherings\u2014ranging from monthly community meetings and national expos to policy symposia and hackathons\u2014offer valuable opportunities for agencies, industry leaders, and academic partners to share knowledge, explore ETs, and shape the future of AI in Government.\nHarmonization of Artificial Intelligence Requirements\nExplain any steps your agency has taken to document and share best practices regarding AI governance, innovation, or risk management. Identify how these resources are shared and maintained across the agency.\nGSA\u2019s approach to AI is grounded in a commitment to transparency and institutional learning. To support this, the agency has prioritized the development of mechanisms that capture insights from AI initiatives and make them accessible across teams and stakeholders. These efforts reflect a broader strategy to ensure AI implementations are not only effective but also informed by evidence, experience, and evolving standards.\nGSA has responded to the need for infrastructure, collaboration, and sustained support by building a network of resources and communities that enable safe experimentation, scalable deployment, and cross-functional engagement. These foundational elements help ensure that AI efforts are aligned with agency goals while remaining adaptable to technological and regulatory change.\nTogether, these resources create a cohesive framework for innovation, governance, and risk management, enabling GSA to lead by example in the responsible use of artificial intelligence.\nDetermining Which Artificial Intelligence Is Presumed to Be Safety-Impacting or Rights Impacting\nExplain the process by which your agency determines which AI use cases are high-impact. In particular, describe how your agency is reviewing or planning to review each current and planned use of AI to assess whether it matches the definition of high-impact AI, as defined in Section 4.a of M-25-21. Identify whether your agency has created additional criteria for when an AI use is high-impact and describe such supplementary criteria.\nGSA handles high-impact AI use cases with additional requirements due to their potential risks to individuals or businesses, establishing transparent governance and compliance processes. The CAIO is responsible for measuring, monitoring, and evaluating the ongoing performance and effectiveness of these applications, and centrally tracking them. System owners and their designees are responsible for enacting these minimum requirements.\nCertain high-impact AI use cases are exempt from the outlined requirements, specifically when evaluating a potential vendor, commercial capability, or freely available AI capability not currently used in agency operations, solely for procurement or acquisition decisions; when evaluating an AI application because its provider is the target or potential target of a regulatory enforcement action; or for research and development purposes.\nThe CAIO may waive one or more stated requirements for specific covered AI applications, with conditions, if the requirements would increase overall risks to safety or rights, or create an unacceptable impediment to critical agency operations. Waiver appeals are submitted with written justifications to the CAIO and the EDGE Board, are centrally tracked, subject to publication, and reassessed annually.\nThe EDGE Board is responsible for establishing the enterprise\u2019s AI risk tolerance, prioritization, and strategic approach to risk management, in alignment with GSA\u2019s Enterprise Risk Management Policy, which encompasses defining likelihood and impact ranking criteria and thresholds, outlining factors for the use case risk rubric, and establishing risk management practices and processes for AI systems; subsequently, the AI Safety Team assesses use cases based on this guidance, and individual system owners are accountable for implementing the defined risk management processes.\nIf your agency has developed its own distinct criteria to guide a decision to waive one or more of the minimum risk management practices for a particular use case, describe the criteria.\nGSA has not developed a distinct criteria in guiding the decision to waive minimum risk management practices.\nFor the issuance of waivers, the CAIO, in coordination with other relevant officials, may waive one or more of the required minimum practices for high-impact use cases involving a specific AI application or component, following a written determination. The waiver process involves submitting a formal request to the CAIO and the EDGE Board, which includes a risk assessment and review of the specific system and context. The waiver will be considered for approval should the assessment find that meeting the requirement would increase overall risks to safety or rights or impose an unacceptable barrier to critical agency operations. If the board and the CAIO approve, waivers will be reported to OMB within 30 days of issuance, tracked, and routinely reviewed to ensure compliance with agency standards. GSA maintains a certification process to confirm that AI systems granted waivers continue to meet risk management requirements, and the CAIO may revoke waivers if any noncompliance or unforeseen risks emerge. GSA has not issued a waiver at the time of this compliance plan\u2019s publication.\nImplementation of Risk Management Practices and Termination of Non-Compliant AI\nElaborate on the controls your agency has put in place to prevent non-compliant safety impacting or rights-impacting AI from being deployed to the public. Describe your agency\u2019s intended process to terminate, and effectuate that termination of, any non-compliant AI.\nGSA has implemented several controls to prevent non-compliant, high-impact AI from being deployed to the public. Safeguards include the review of AI use cases by the AI Safety Team, confirming all AI systems meet ethical, legal, and technical standards before deployment. The AI Safety Team evaluates risks related to public safety, privacy, civil liberties, and potential biases, with specific attention to AI systems that may have significant impacts on rights or safety.\nTo prevent non-compliant, high-impact AI from being deployed to the public, GSA has established continuous monitoring protocols that track AI system interactions at the network level. GSA is developing a strategy to increase its capacity to monitor AI system behaviors and performance. Automated alerts and reporting systems are in place to detect deviations from compliance standards, triggering an immediate review by relevant oversight bodies.\nIf a high-impact AI system is found to be non-compliant after deployment, GSA has developed a defined process for termination. The EDGE Board, in collaboration with the OCIO, will issue a termination order. The termination process involves revoking system access, ceasing operations, and ensuring that data processed by the AI system is secured, maintained, or destroyed as required. An incident response team coordinates the shutdown and conducts a post-termination review to assess the impact and identify corrective actions. Additionally, communications will be made regarding use-case terminations, the reasons for the action, and any steps being taken to prevent future issues.\nMinimum Risk Management Practices\nIdentify how your agency plans to document and validate implementation of the minimum risk management practices. In addition, discuss how your agency assigns responsibility for the implementation and oversight of these requirements.\nGSA policy mandates that AI use cases document and validate the implementation of minimum risk management practices as defined in OMB M-25-210 for AI systems through a comprehensive framework managed by the EDGE Board. This process includes detailed documentation at each stage of the AI life cycle, from development and testing to deployment and monitoring. AI use cases are required to maintain thorough records of risk assessments, compliance checklists, data usage audits, real-world testing, and ethical impact evaluations. These documents will be stored in a centralized repository that is accessible to the AI Safety Team and the EDGE Board.\nGSA will conduct periodic audits and performance reviews of AI systems to validate that the minimum risk management practices are being followed. These audits assess compliance with Federal guidelines, including data privacy, bias mitigation, and ethical considerations. Additionally, GSA employs automated monitoring tools to track ongoing compliance, and discrepancies trigger immediate reviews by oversight teams.\nResponsibility for implementing and overseeing these risk management practices is clearly assigned to multiple levels within the organization. The EDGE Board provides strategic oversight and policy guidance, and supports the AI Safety Team in ensuring all AI initiatives comply with legal and ethical standards. The OCIO is responsible for the technical implementation and monitoring of AI systems. Individual project managers and teams are tasked with day-to-day compliance, including adhering to risk management protocols, conducting regular risk assessments, and reporting any issues to the EDGE Board.\nPER DIEM LOOK-UP\n1Choose a location\nRates for Alaska, Hawaii, and U.S. territories and possessions are set by theDepartment of Defense.\n2Choose a date\nTraveler reimbursement is based on the location of the work activities and not the accommodations,\n unless lodging is not available at the work activity, then the agency may authorize the rate where\n lodging is obtained.\nUnless otherwise specified, the per diem locality is defined as\"all locations within, or entirely\n surrounded by, the corporate limits of the key city, including independent entities located within\n those boundaries.\"\nPer diem localities with county definitions shall include\"all locations within, or entirely\n surrounded by, the corporate limits of the key city as well as the boundaries of the listed counties,\n including independent entities located within the boundaries of the key city and the listed counties\n (unless otherwise listed separately).\"\nWhen a military installation or Government - related facility(whether or not specifically named) is\n located partially within more than one city or county boundary, the applicable per diem rate for the\n entire installation or facility is the higher of the rates which apply to the cities and / or counties,\n even though part(s) of such activities may be located outside the defined per diem locality.", "cleaned_text_custom_parser_2": "\n\n \n \n Skip to main content\n \n

\n $\"\"$ \n

\n \n Official websites use .gov\n \n
\n A\n \n .gov\n \n website belongs to an official government organization in the United States.\n

\n $\"\"$ \n

\n \n Secure .gov websites use HTTPS\n \n
\n A\n \n lock\n \n (\n )\n or\n \n https://\n \n means you\u2019ve safely connected to the .gov website. Share sensitive information only on official, secure websites.\n

\n Artificial intelligence compliance plan\n

\n Our AI compliance plan is our response to comply with the Office of Management and Budget, or OMB, Memorandums M-25-21 and M-25-22.\n

\n \n September 2025\n \n

\n \n 1. Strengthening AI governance\n \n

\n \n General\n \n
\n \n AI Governance Bodies\n \n
\n \n AI Use Case Inventories\n \n
\n \n Reporting on AI Use Cases Not Subject to Inventory\n \n

\n General\n

\n \n Describe any planned or current efforts within your agency to update any existing internal AI principles, guidelines, or policy to ensure consistency with M-25-21 and M-25-22.\n \n

\n By December 29, 2025, GSA plans to release 2185.2 CIO, Accelerating Responsible Use of Artificial Intelligence at GSA. This directive will be based on the mandates and guidance set forth in OMB M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust; OMB M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government; and other Federal mandates. GSA\u2019s directive will outline policies for the responsible, efficient, and accelerated adoption of AI technologies at GSA. It will address key issues related to AI adoption within the GSA network, including establishing policies for controlled access and responsible, efficient AI use, as well as outlining procedures for the assessment, procurement, use, monitoring, and governance of AI systems. A critical focus will be ensuring compliance with existing security, privacy, ethics, and legal frameworks, while also accelerating Federal AI use in line with directives for innovation, governance, and public trust. The directive will also aim to remove barriers to AI adoption, empower AI leaders, and safeguard individual rights and liberties, especially concerning high-impact AI. Furthermore, it will address risk management through regular assessments, prioritize appropriate AI uses to improve agency missions, ensure adequate data infrastructure and curation, assess and plan for AI workforce needs, and promote interagency coordination and efficient AI acquisition practices.\n

\n GSA currently has in place 2185.1A CIO, Use of Artificial Intelligence (AI) at GSA, which established governing policies for the controlled access and responsible use of AI technologies and platforms within GSA. This policy replaced CIO IL-23-01, which focused on generative AI, and expanded its scope to cover broader AI governance. The 2185.1A CIO directive refines and updates the previous directive to reflect evolving guidance and to accelerate the responsible adoption of AI within GSA, with a particular emphasis on classifying and managing different levels of AI impact.\n

\n GSA will conduct annual reviews and assessments of 2185.2 CIO to ensure the mandates set forth in OMB M-25-21 and M-25-22 are maintained as AI capabilities continue to evolve. The Chief Artificial Intelligence Officer (CAIO) will lead these reviews with the support of the Evidence-Based Data Governance Executive (EDGE) Board and AI Safety Team. Updates to 2185.2 CIO and other relevant policies will be released as-needed and are not restricted to an annual update.\n

\n AI Governance Bodies\n

\n \n Identify the offices that are represented on your agency\u2019s AI governance body.\n \n

\n GSA\u2019s AI governance structure is composed of two bodies: the EDGE Board and the AI Safety Team.\n

\n The\n \n EDGE Board\n \n serves as a decisional body to oversee and coordinate GSA\u2019s activities related to AI and data governance. It is responsible for overseeing and coordinating GSA\u2019s activities related to AI and data governance. This includes setting the overall vision and goals for AI development and use within the agency, emphasizing risk management, ethical guidelines, compliance with legal standards, and alignment with GSA\u2019s mission and values, particularly with Executive Order 14179, OMB M-25-21 and M-25-22. The EDGE Board also sets, updates, and funds GSA\u2019s data priorities, making sure the agency fully uses data as a key asset and enforces data governance laws, policies, and regulations as mandated by the Foundations for Evidence-Based Policymaking Act.\n

\n The EDGE Board, which is chaired by GSA\u2019s Deputy Administrator and co-chaired by the Chief Data Officer (CDO)/CAIO, reports to the GSA Administrator. The Board comprises executive leadership from GSA\u2019s Services and Staff Offices, as follows:\n

\n Chief Administrative Services Officer\n
\n Chief Acquisition Officer\n
\n Office of Civil Rights (OCR) Associate Administrator\n
\n Chief Financial Officer\n
\n Chief Information Officer\n
\n Chief Information Security Officer\n
\n Chief Privacy Officer\n
\n Chief Technology Officer\n
\n Chief Human Capital Officer (CHCO)\n
\n Evaluation Officer\n
\n Federal Acquisition Service (FAS) Commissioner or Deputy Commissioner\n
\n General Counsel\n
\n Office of Government-wide Policy (OGP) Associate Administrator\n
\n Office of Mission Assurance Associate Administrator\n
\n Office of Small and Disadvantaged Business Utilization Associate Administrator\n
\n Office of Strategic Communication (OSC) Associate Administrator\n
\n Performance Improvement Officer\n
\n Public Buildings Service (PBS) Deputy Commissioner\n
\n Statistical Official\n
\n Technology Transformation Services (TTS) Director\n

\n The EDGE Board oversees the\n \n AI Safety Team\n \n , a cross-functional working group established to facilitate the effective integration and utilization of AI technologies across the organization. Its purpose is to ensure that AI initiatives align with organizational goals, promote accessibility, enhance content quality, leverage research and data effectively, provide adequate training, optimize design and user experience, and are supported by robust technology and infrastructure. The team identifies opportunities for AI integration, develops public AI strategies, and establishes guidelines for ethical and responsible AI use, including evaluating AI technologies, reusing existing AI resources, investing in American-developed AI products, and fostering AI talent within GSA. Additionally, the team provides AI training, collaborates with stakeholders, sets expectations for workforce AI use, monitors AI project implementation and impact, and ensures compliance with relevant laws and regulations, while regularly reporting progress to GSA leadership.\n

\n The AI Safety Team comprises representatives from key GSA offices, providing expertise and ensuring comprehensive consideration of AI integration across various aspects of GSA\u2019s operations. These offices include:\n

\n Office of GSA IT\n
\n FAS\n
\n OCR\n
\n OGP\n
\n Office of Human Resources Management (OHRM)\n
\n OSDBU\n
\n OSC\n
\n Office of the Chief Financial Officer (OCFO)\n
\n Office of the General Counsel (OGC)\n
\n PBS\n

\n \n Describe how, if at all, your agency\u2019s AI governance body plans to consult with external experts as appropriate and consistent with applicable law.\n \n

\n GSA has and will continue to collaborate with external experts, including academic institutions, State governments, and other Federal agencies to develop training programs and benchmark its updated AI policies against best practices in the field. Members of the EDGE Board and AI Safety Team regularly engage with interagency groups and councils, including the CDO council, the CAIO council, the CHCO council, the U.S. Office of Personnel Management, the AI Talent Task Force, and the three interagency working groups coordinated by the CAIO council on generative AI, AI-related acquisitions, and AI risk management.\n

\n External consultation will continue to play a critical role in both governance and safety efforts. The EDGE Board plans to consult with external experts as appropriate and consistent with applicable law. This consultation may include input from Federally Funded Research and Development Centers, academic institutions, think tanks, and industry experts to stay informed about AI\u2019s latest trends, risks, and best practices. Civil society organizations, labor unions, and similar groups may also be consulted to ensure that AI systems meet public interest standards and consider workforce impacts.\n

\n AI Use Case Inventories\n

\n \n Describe your agency\u2019s process for soliciting and collecting AI use cases across all sub- agencies, components, or bureaus for the inventory. In particular, address how your agency plans to ensure your inventory is comprehensive, complete, and encompasses updates to existing use cases.\n \n

\n GSA\u2019s process for soliciting and collecting AI use cases across the organization is led by the CAIO. The CAIO is responsible for ensuring that the AI use case inventory is comprehensive and up to date, with the support of the AI Safety Team, various program offices, and the Office of the Chief Information Officer (OCIO).\n

\n The process begins with the issuance of an annual request to all offices, requiring them to submit information on current and planned AI systems. Each office must identify all AI applications, regardless of the size or scope of the system. The CAIO provides and maintains standardized guidelines and templates for reporting in compliance with OMB standards. This centralized submission process is used to collect and manage AI use cases, allowing offices to submit their entries in a consistent and structured manner. All offices participate in this process and regularly update their entries to reflect any changes, such as new AI capabilities, updates to existing systems, or the decommissioning of older technologies.\n

\n The CAIO oversees periodic reviews and audits to maintain the inventory\u2019s accuracy and completeness. The CAIO also coordinates within the OCIO so that existing processes like Authorizations To Operate, Federal Information Technology Acquisition Reform Act reviews, and new software requests can identify AI instances across the enterprise. This process ensures that GSA\u2019s AI inventory remains accurate and fully reflects the agency\u2019s ongoing use of AI technology. This approach, led by the CAIO, provides a comprehensive and complete inventory of AI use cases that support the agency\u2019s governance and decision-making processes regarding AI deployment.\n

\n Reporting on AI Use Cases Not Subject to Inventory\n

\n \n Describe your agency\u2019s process for soliciting and collecting AI use cases that meet the criteria for exclusion from being individually inventoried.\n \n

\n GSA has not identified any AI use cases that are not subject to inventory.\n

\n \n 2. Advancing responsible AI innovation\n \n

\n \n Removing Barriers to the Responsible Use of AI\n \n
\n \n AI Talent\n \n
\n \n AI Sharing and Collaboration\n \n
\n \n Harmonization of Artificial Intelligence Requirements\n \n

\n Removing Barriers to the Responsible Use of AI\n

\n \n Describe any barriers to the responsible use of AI that your agency has identified, as well as any steps your agency has taken (or plans to take) to mitigate or remove these identified barriers.\n \n

\n GSA has identified several potential barriers to the responsible use of AI, including the procurement of AI solutions, access to high-quality data products with scalable infrastructure, and AI models and libraries. GSA has established an enterprise data platform (i.e., Enterprise Data Solution or EDS), which includes an enterprise data catalog, scalable compute infrastructure, analytical tooling, and AI/ML systems and services. This platform allows for programs to store, curate, and productize their data holdings for analytical purposes, as well as disseminate the information products generated via hosted services. EDS also allows for sandbox capabilities where AI tools can be safely tested and where rapid prototyping may occur.\n

\n GSA supports several pilot projects that assess the capabilities and viability of AI products for specific use cases, including the ease with which AI infrastructure and products may be set up, and how AI tools and services can be leveraged to improve mission outcomes for agencies. These pilot projects are designed to help GSA better understand, manage, and provide guidance for internal and other agency use regarding AI technologies for future implementation.\n

\n GSA has leveraged sandboxes to test AI capabilities of AI chatbots, IT security enhancements, custom application development, and general productivity assessments, allowing staff to evaluate AI\u2019s potential while ensuring security and compliance.\n

\n To support the availability of AI tooling and infrastructure, the\n \n FedRAMP\n \n program has established a framework for prioritizing emerging technologies (ETs) for FedRAMP authorization, which covers technologies listed in the Office of Science and Technology Policy\u2019s Critical and Emerging Technologies. This framework enables routine and consistent prioritization of the most critical cloud-relevant ETs needed for use by Federal agencies. This prioritization controls how FedRAMP prioritizes its own work and review processes, and will not address how sponsoring agencies manage their own internal priorities.\n

\n \n Identify whether your agency has developed (or is in the process of developing) internal guidance for the use of generative AI.\n \n

\n GSA has developed internal guidance for the use of generative AI and has made it available to employees on an internal website. This guidance includes the safeguards and oversight mechanisms necessary for responsible use without posing undue risk. The EDGE Board and AI Safety Team provide oversight by reviewing and dispositioning AI use cases, ensuring compliance with ethical standards, data privacy, and security protocols. The guidance also requires that generative AI tools be used under controlled conditions set forth by the guidance and standards established in OMB M-25-21 and M-25-22 and enforced and overseen by the AI Safety Team. GSA is evaluating continuous monitoring and evaluation processes and tools for generative AI.\n

\n AI Talent\n

\n \n Describe any planned or in-progress initiatives from your agency to increase AI talent. In particular, reference any hiring authorities that your agency is leveraging, describe any AI focused teams that your agency is establishing or expanding, and identify the skillsets or skill levels that your agency is looking to attract. If your agency has designated an AI Talent Lead, identify which office they are assigned to.\n \n

\n GSA is taking a multi-pronged approach to strengthen its AI workforce and infrastructure. Through targeted hiring strategies, the formation of specialized teams, and the development of centralized platforms, GSA is positioning itself as a leader in responsible AI adoption across the Federal Government. These efforts are designed to attract top-tier talent, ensure ethical, and secure AI deployment, and support other agencies in scaling their AI capabilities.\n

\n \n AI Talent Recruitment and Hiring Authorities:\n \n To meet the growing demand for AI expertise, in FY24 GSA has launched the AI Talent Surge, a strategic initiative aimed at rapidly expanding its AI workforce. The agency utilized flexible hiring authorities such as Direct Hire Authority, which allowed for expedited recruitment of highly qualified candidates, and the Pathways Programs, which targeted students and recent graduates for entry-level roles.\n
\n \n AI-Focused Teams and Offices:\n \n GSA has established several key teams to guide its AI strategy and implementation. At the helm is the CAIO, who also serves as the agency\u2019s CDO. The EDGE Board is co-chaired by the CDO/CAIO and the Deputy Administrator, both, ensuring that executive-level oversight is in place for all major AI initiatives. The AI Safety Team, a technically focused group, is responsible for conducting risk assessments, ensuring compliance with ethical standards, and evaluating the safety of AI applications. GSA\u2019s TTS and OCIO are also expanding their AI-related functions, supporting both internal innovation and cross-agency collaboration.\n
\n \n Infrastructure and Platforms Supporting AI Talent:\n \n GSA\u2019s launch of USAi.Gov marks a significant step in providing Federal agencies the tools and infrastructure needed to experiment with and adopt generative AI technologies. The platform offers capabilities such as chatbot development, document summarization, and code generation, while also supporting model evaluation for bias and performance. USAi.Gov includes dashboards for workforce upskilling and analytics, helping agencies monitor and improve their AI readiness. This initiative is part of GSA\u2019s broader role as a Federal AI enabler, offering secure, scalable, and shared services that facilitate responsible AI deployment across Government.\n

\n \n If applicable, describe your agency\u2019s plans to provide any resources or training to develop AI talent internally and increase AI training opportunities for Federal employees.\n \n

\n GSA has made AI-related training available through online learning platforms to develop AI talent internally. The agency supports the AI Community of Excellence (CoE), which serves as a collaborative space for sharing knowledge and best practices, and is leading the AI Talent Surge effort to attract and retain skilled professionals to advance AI capabilities across the agency.\n

\n GSA also leverages sandboxes to test AI capabilities, including enhancements, custom development, and general productivity assessments, allowing staff to evaluate AI\u2019s potential while ensuring security and compliance. GSA is committed to developing AI talent internally and increasing AI training opportunities for Federal employees. Role-based AI training tracks are accessible through online learning platforms, providing employees at various levels the opportunity to gain relevant skills. These tracks include foundational courses for employees, intermediate training for technical roles, and advanced courses for AI practitioners focusing on development, deployment, and ethical considerations.\n

\n Additionally, GSA leads a Government-wide initiative, called the AI Training Series, through its CoE and the Artificial Intelligence Community of Practice (AI CoP). It is designed to equip Federal employees with the knowledge and skills needed to responsibly and effectively engage with AI technologies in their roles. The program supports compliance with the AI Training Act and relevant Executive Orders, offering structured learning across three specialized tracks: Technical Track, Acquisition Track, and Leadership and Policy Track. All sessions are designed to be accessible to Federal employees regardless of technical background. Recordings and materials are made available through platforms like USA Learning and the Federal Acquisition Institute. Through this initiative, GSA plays a central role in modernizing Federal workforce capabilities, fostering cross-agency collaboration, and promoting responsible AI adoption across Government.\n

\n AI Sharing and Collaboration\n

\n \n Describe your agency\u2019s process for ensuring that custom-developed AI code\u2014including models and model weights\u2014for AI applications in active use is shared consistent with Section 2.b of M-25-21.\n \n

\n All custom-developed AI code, including models and model weights for AI applications in active use, is shared in compliance with OMB M-25-21, Section 2.b (Sharing of Agency Data and AI Assets) by adhering to established processes for transparency and open access. This includes reviewing AI use case applications through the AI Safety Team and other relevant offices to ensure that code and models meet data security, privacy, and ethical standards before being shared. This content is disseminated via sharing platforms such as open.gsa.gov and data.gov.\n

\n \n Elaborate on your agency\u2019s efforts to encourage or incentivize the sharing of code, models, and data with the public. Include a description of the relevant offices that are responsible for coordinating this work.\n \n

\n To advance the responsible and effective use of AI across the Federal Government, GSA has launched a suite of initiatives designed to foster collaboration, streamline adoption, and ensure ethical governance. These efforts reflect GSA\u2019s commitment to building a unified, secure, and scalable AI ecosystem that supports agency missions while promoting transparency and innovation. From strategic frameworks and interagency communities to shared platforms and internal tools, GSA is positioning itself as a central enabler of AI transformation in the public sector.\n

\n \n AI Strategy and Governance:\n \n GSA has established a robust framework to guide Federal agencies in the ethical and effective use of artificial intelligence. This includes developing strategic use cases aligned with agency missions, offering governance models to ensure compliance with Federal standards, and providing procurement guidance to mitigate risks. Through these efforts, GSA fosters a culture of responsible AI adoption while encouraging interagency collaboration and knowledge sharing.\n
\n \n AI CoP:\n \n The AI CoP serves as a collaborative hub for Federal employees, contractors, and academic partners to exchange knowledge and best practices in AI. Through working groups, shared resources, and leadership from an executive steering committee, the CoP supports ongoing learning and cross-agency engagement. It complements GSA\u2019s governance efforts by cultivating a community that drives responsible AI adoption from the ground up.\n
\n \n USAi.Gov Platform:\n \n USAi.Gov is a centralized platform launched by GSA to streamline AI adoption across Federal agencies. It offers a secure environment for evaluating diverse AI tools, including chatbots and summarization models, from leading providers like OpenAI and Google. Agencies can test solutions before procurement, access performance dashboards, and ensure alignment with Federal AI policies. This shared services model reduces barriers to entry and promotes scalable, trustworthy AI deployment.\n
\n \n GSA\u2019s Use of USAi:\n \n GSA has developed an AI tool to enhance productivity and safety in Federal workflows. Featuring a chatbot, API integrations, and an admin console, it enables secure and compliant AI use tailored to agency needs. Built with staff input and privacy in mind, GSA\u2019s AI tool is now being considered for broader Federal deployment as a shared service, supporting tenant-based models and continuous improvement through user feedback.\n

\n To support the Federal Government\u2019s growing interest in AI, GSA is actively organizing and participating in a range of events that promote collaboration, innovation, and responsible AI adoption. These gatherings\u2014ranging from monthly community meetings and national expos to policy symposia and hackathons\u2014offer valuable opportunities for agencies, industry leaders, and academic partners to share knowledge, explore ETs, and shape the future of AI in Government.\n

\n \n AI CoP Monthly Meetings:\n \n Held virtually on the second Thursday of each month, these meetings provide a space for Federal stakeholders to engage with emerging AI topics and showcase agency innovations. With guest speakers and collaborative sessions, the events reinforce the CoP\u2019s mission to foster responsible AI use and interagency learning.\n
\n \n AI & Big Data Expo North America 2025:\n \n Held at the Santa Clara Convention Center, the AI & Big Data Expo North America is a major industry event where GSA participates as a partner organization. With over 250 speakers and 200 exhibitors, the expo covers cutting-edge topics such as responsible AI, cybersecurity, data monetization, and AIOps. The event attracts a diverse audience of technologists, policymakers, and innovators, offering GSA members complimentary passes and opportunities to engage with leading AI solutions and strategies.\n
\n \n Federal AI Hackathon (July 31, 2024):\n \n The Federal AI Hackathon in 2024 challenged participants in Atlanta, New York, and Washington, DC, to reimagine Federal websites for AI optimization. Teams leveraged large language models and retrieval-augmented generation to build intelligent search engines and user interfaces that enhance transparency and efficiency. Winning solutions demonstrated innovative approaches to improving digital Government services, showcasing the potential of AI to transform public engagement and accessibility.\n

\n Harmonization of Artificial Intelligence Requirements\n

\n \n Explain any steps your agency has taken to document and share best practices regarding AI governance, innovation, or risk management. Identify how these resources are shared and maintained across the agency.\n \n

\n GSA\u2019s approach to AI is grounded in a commitment to transparency and institutional learning. To support this, the agency has prioritized the development of mechanisms that capture insights from AI initiatives and make them accessible across teams and stakeholders. These efforts reflect a broader strategy to ensure AI implementations are not only effective but also informed by evidence, experience, and evolving standards.\n

\n \n AI Use Case Inventory:\n \n To ensure transparency and continuous improvement in its AI initiatives, GSA has developed robust mechanisms for documenting and disseminating best practices. Central to this effort is the AI Use Case Inventory, a comprehensive catalog of AI applications deployed across the agency. Maintained by the CAIO and the AI Safety Team, this inventory serves as a living resource that tracks the life cycle of AI projects\u2014from ideation to implementation. It enables GSA to monitor compliance, assess performance, and identify opportunities for replication or refinement. By systematically documenting each use case, GSA fosters a culture of learning and accountability, ensuring that successful strategies are shared and that risks are proactively managed.\n
\n \n AI Guide for Government:\n \n Complementing this inventory is the AI Guide for Government, a resource developed by GSA\u2019s AI CoE. This guide is tailored for Federal decision-makers and practitioners, offering practical frameworks, case studies, and implementation strategies for responsible AI adoption. It distills complex technical and ethical considerations into actionable insights, making it easier for agencies to navigate the challenges of AI deployment. The guide is regularly updated to reflect emerging trends, regulatory changes, and lessons learned from across the Federal landscape, reinforcing GSA\u2019s commitment to knowledge sharing and continuous improvement.\n

\n GSA has responded to the need for infrastructure, collaboration, and sustained support by building a network of resources and communities that enable safe experimentation, scalable deployment, and cross-functional engagement. These foundational elements help ensure that AI efforts are aligned with agency goals while remaining adaptable to technological and regulatory change.\n

\n \n AI CoE:\n \n GSA has established a multi-layered infrastructure to support the sharing and maintenance of AI resources across the agency. At the heart of this ecosystem is the AI CoE, which provides strategic guidance, technical support, and scalable infrastructure to Federal agencies pursuing AI initiatives. The CoE offers sandbox environments, analytical tooling, and reusable components that enable safe experimentation and rapid prototyping. By centralizing these resources, GSA reduces duplication of effort and accelerates innovation across the Federal enterprise.\n
\n \n AI CoP:\n \n In addition to providing technical support, GSA fosters collaboration through the AI CoP. As noted earlier, this network is open to all Government employees and mission-supporting contractors with .gov or .mil email addresses. It serves as a platform for peer learning, cross-agency dialogue, and resource exchange. Members participate in webinars, workshops, and working groups that address key topics such as ethical AI, data governance, and risk mitigation. The CoP also maintains a shared knowledge repository, ensuring that insights and tools are accessible to all participants.\n
\n \n EDS:\n \n Supporting these efforts is the EDS, a secure and scalable platform managed by GSA\u2019s Office of the Chief Data Officer. EDS provides the technical foundation for AI experimentation, offering sandbox environments, data governance tools, and infrastructure for deploying AI models. It ensures data used in AI projects is properly managed, protected, and aligned with Federal standards.\n

\n Together, these resources create a cohesive framework for innovation, governance, and risk management, enabling GSA to lead by example in the responsible use of artificial intelligence.\n

\n \n 3. Managing risks from the use of AI\n \n

\n Determining Which Artificial Intelligence Is Presumed to Be Safety-Impacting or Rights Impacting\n

\n \n Explain the process by which your agency determines which AI use cases are high-impact. In particular, describe how your agency is reviewing or planning to review each current and planned use of AI to assess whether it matches the definition of high-impact AI, as defined in Section 4.a of M-25-21. Identify whether your agency has created additional criteria for when an AI use is high-impact and describe such supplementary criteria.\n \n

\n GSA handles high-impact AI use cases with additional requirements due to their potential risks to individuals or businesses, establishing transparent governance and compliance processes. The CAIO is responsible for measuring, monitoring, and evaluating the ongoing performance and effectiveness of these applications, and centrally tracking them. System owners and their designees are responsible for enacting these minimum requirements.\n

\n Minimum Requirements for High-Impact AI (before and during employment):\n

\n Before an AI system is employed, several minimum requirements must be met. These include completing an AI Impact Statement, submitting an AI system test plan that demonstrates real-world context testing and contestability, and undergoing an independent evaluation of the AI system by the CAIO (or his or her designee).\n
\n While the AI system is in use, ongoing monitoring is required, with established thresholds for periodic human review. Emergent risks identified through routine testing, continuous monitoring protocols, or third-party findings must be mitigated. All system practitioners must complete requisite AI training requirements, and human validation and intervention protocols should be in place to ensure that all output decisions made by AI systems are regularly evaluated. Additionally, public notice and plain language documentation regarding high-impact use cases must be provided through the public interface, in public disclosure statements, and in the AI use case inventory.\n

\n Additional Requirements for Higher-Impact AI (before and during employment):\n

\n Before implementing an AI system, it is crucial to proactively identify and mitigate algorithmic discrimination or bias and assess and mitigate disparate impacts for protected classes. Direct user testing of system interactions should be conducted, and comments from the user community should be solicited, along with post-transaction customer feedback activities.\n
\n While employing the AI, ongoing monitoring studies for AI-enabled discrimination must be conducted. Any negatively affected individuals should be notified, and fallback and escalation options for AI processes or outcomes should be provided. Where practicable, opt-out alternatives should also be offered.\n

\n Certain high-impact AI use cases are exempt from the outlined requirements, specifically when evaluating a potential vendor, commercial capability, or freely available AI capability not currently used in agency operations, solely for procurement or acquisition decisions; when evaluating an AI application because its provider is the target or potential target of a regulatory enforcement action; or for research and development purposes.\n

\n The CAIO may waive one or more stated requirements for specific covered AI applications, with conditions, if the requirements would increase overall risks to safety or rights, or create an unacceptable impediment to critical agency operations. Waiver appeals are submitted with written justifications to the CAIO and the EDGE Board, are centrally tracked, subject to publication, and reassessed annually.\n

\n The EDGE Board is responsible for establishing the enterprise\u2019s AI risk tolerance, prioritization, and strategic approach to risk management, in alignment with GSA\u2019s Enterprise Risk Management Policy, which encompasses defining likelihood and impact ranking criteria and thresholds, outlining factors for the use case risk rubric, and establishing risk management practices and processes for AI systems; subsequently, the AI Safety Team assesses use cases based on this guidance, and individual system owners are accountable for implementing the defined risk management processes.\n

\n \n If your agency has developed its own distinct criteria to guide a decision to waive one or more of the minimum risk management practices for a particular use case, describe the criteria.\n \n

\n GSA has not developed a distinct criteria in guiding the decision to waive minimum risk management practices.\n

\n For the issuance of waivers, the CAIO, in coordination with other relevant officials, may waive one or more of the required minimum practices for high-impact use cases involving a specific AI application or component, following a written determination. The waiver process involves submitting a formal request to the CAIO and the EDGE Board, which includes a risk assessment and review of the specific system and context. The waiver will be considered for approval should the assessment find that meeting the requirement would increase overall risks to safety or rights or impose an unacceptable barrier to critical agency operations. If the board and the CAIO approve, waivers will be reported to OMB within 30 days of issuance, tracked, and routinely reviewed to ensure compliance with agency standards. GSA maintains a certification process to confirm that AI systems granted waivers continue to meet risk management requirements, and the CAIO may revoke waivers if any noncompliance or unforeseen risks emerge. GSA has not issued a waiver at the time of this compliance plan\u2019s publication.\n

\n Implementation of Risk Management Practices and Termination of Non-Compliant AI\n

\n \n Elaborate on the controls your agency has put in place to prevent non-compliant safety impacting or rights-impacting AI from being deployed to the public. Describe your agency\u2019s intended process to terminate, and effectuate that termination of, any non-compliant AI.\n \n

\n GSA has implemented several controls to prevent non-compliant, high-impact AI from being deployed to the public. Safeguards include the review of AI use cases by the AI Safety Team, confirming all AI systems meet ethical, legal, and technical standards before deployment. The AI Safety Team evaluates risks related to public safety, privacy, civil liberties, and potential biases, with specific attention to AI systems that may have significant impacts on rights or safety.\n

\n To prevent non-compliant, high-impact AI from being deployed to the public, GSA has established continuous monitoring protocols that track AI system interactions at the network level. GSA is developing a strategy to increase its capacity to monitor AI system behaviors and performance. Automated alerts and reporting systems are in place to detect deviations from compliance standards, triggering an immediate review by relevant oversight bodies.\n

\n If a high-impact AI system is found to be non-compliant after deployment, GSA has developed a defined process for termination. The EDGE Board, in collaboration with the OCIO, will issue a termination order. The termination process involves revoking system access, ceasing operations, and ensuring that data processed by the AI system is secured, maintained, or destroyed as required. An incident response team coordinates the shutdown and conducts a post-termination review to assess the impact and identify corrective actions. Additionally, communications will be made regarding use-case terminations, the reasons for the action, and any steps being taken to prevent future issues.\n

\n Minimum Risk Management Practices\n

\n \n Identify how your agency plans to document and validate implementation of the minimum risk management practices. In addition, discuss how your agency assigns responsibility for the implementation and oversight of these requirements.\n \n

\n GSA policy mandates that AI use cases document and validate the implementation of minimum risk management practices as defined in OMB M-25-210 for AI systems through a comprehensive framework managed by the EDGE Board. This process includes detailed documentation at each stage of the AI life cycle, from development and testing to deployment and monitoring. AI use cases are required to maintain thorough records of risk assessments, compliance checklists, data usage audits, real-world testing, and ethical impact evaluations. These documents will be stored in a centralized repository that is accessible to the AI Safety Team and the EDGE Board.\n

\n GSA will conduct periodic audits and performance reviews of AI systems to validate that the minimum risk management practices are being followed. These audits assess compliance with Federal guidelines, including data privacy, bias mitigation, and ethical considerations. Additionally, GSA employs automated monitoring tools to track ongoing compliance, and discrepancies trigger immediate reviews by oversight teams.\n

\n Responsibility for implementing and overseeing these risk management practices is clearly assigned to multiple levels within the organization. The EDGE Board provides strategic oversight and policy guidance, and supports the AI Safety Team in ensuring all AI initiatives comply with legal and ethical standards. The OCIO is responsible for the technical implementation and monitoring of AI systems. Individual project managers and teams are tasked with day-to-day compliance, including adhering to risk management protocols, conducting regular risk assessments, and reporting any issues to the EDGE Board.\n

\n \n Print Page\n \n \n Email Page\n \n

\n Last updated: Sep 30, 2025\n

\n \n Top\n \n \n

\n 1\n Choose a location\n

\n Error, The Per Diem API is not responding. Please try again later.\n

\n No results could be found for the location you've entered.\n

\n Get my location\n \n OR\n

\n \n State\n \n \n City (optional)\n \n

\n OR\n

\n \n ZIP\n \n \n

\n Rates for Alaska, Hawaii, and U.S. territories and possessions are set by the\n \n Department of Defense.\n \n

\n Rates for foreign countries are set by the\n \n Department of State.\n \n

\n \n

\n 2\n Choose a date\n

\n \n Select fiscal year\n \n

\n OR\n

\n \n Travel start date (mm/dd/yyyy)\n \n \n Travel end date (mm/dd/yyyy)\n \n

\n Rates are available between 10/1/2023 and 09/30/2026.\n

\n The End Date of your trip can not occur before the Start Date.\n

\n \n \n \n

\n \n

\n \n Additional terms and conditions\n \n \n \n

\n Traveler reimbursement is based on the location of the work activities and not the accommodations,\n unless lodging is not available at the work activity, then the agency may authorize the rate where\n lodging is obtained.\n

\n Unless otherwise specified, the per diem locality is defined as\n \n \"all locations within, or entirely\n surrounded by, the corporate limits of the key city, including independent entities located within\n those boundaries.\"\n \n

\n Per diem localities with county definitions shall include\n \n \"all locations within, or entirely\n surrounded by, the corporate limits of the key city as well as the boundaries of the listed counties,\n including independent entities located within the boundaries of the key city and the listed counties\n (unless otherwise listed separately).\"\n \n

\n When a military installation or Government - related facility(whether or not specifically named) is\n located partially within more than one city or county boundary, the applicable per diem rate for the\n entire installation or facility is the higher of the rates which apply to the cities and / or counties,\n even though part(s) of such activities may be located outside the defined per diem locality.\n

\n \n\n", "best_field": "cleaned_text_custom_parser", "enhanced": true, "date_published": null, "image": null, "num_tokens_oai_tokenizer": null, "num_tokens_gemini_tokenizer": null}, "favicon": "https://www.gsa.gov/sites/gsa.gov/themes/custom/gsa/favicon.ico", "state": "candidate", "enhanced": true, "answer": null, "valid_answer": false, "source_citation_index": 7, "user_web_page_id": null, "status": "ready", "reader": false, "rank": 2, "reason": "The source outlines a robust framework for ethical use of AI that is aligned with compliance standards, relevant for compliance officers."}, {"id": 598053, "type": "GenericWebPage", "mime_type": "text/html", "url": "https://www.forvismazars.us/forsights/2024/11/doj-now-looking-for-ai-risk-mitigation-in-compliance-programs", "slug": "forvismazars", "title": "DOJ Now Looking for AI Risk Mitigation in Compliance Programs | Forvis Mazars", "snippet": "Brush up on new DOJ updates calling for corporations to have a plan for potential AI risks. The U.S. Department of Justice (DOJ) released new updates to the Evaluation of Corporate Compliance Programs (ECCP) guidelines in September 2024.", "image": null, "date_published": null, "media": [], "products": [], "source": {"id": 598053, "website_id": 41757, "url": "https://www.forvismazars.us/forsights/2024/11/doj-now-looking-for-ai-risk-mitigation-in-compliance-programs", "title": "DOJ Now Looking for AI Risk Mitigation in Compliance Programs | Forvis Mazars", "snippet": "Brush up on new DOJ updates calling for corporations to have a plan for potential AI risks. The U.S. Department of Justice (DOJ) released new updates to the Evaluation of Corporate Compliance Programs (ECCP) guidelines in September 2024.", "cleaned_text": null, "cleaned_text_custom_parser": null, "cleaned_text_custom_parser_2": null, "best_field": null, "enhanced": false, "date_published": null, "image": null, "num_tokens_oai_tokenizer": null, "num_tokens_gemini_tokenizer": null}, "favicon": "https://www.forvismazars.us/ui/fm/www/apple-touch-icon.png", "state": "candidate", "enhanced": false, "answer": null, "valid_answer": false, "source_citation_index": 8, "user_web_page_id": null, "status": "not_processed", "reader": false, "rank": 2, "reason": "The source provides additional insights into compliance expectations regarding AI risk management."}, {"id": 598044, "type": "GenericWebPage", "mime_type": "text/html", "url": "https://medium.com/@mukherjee.amitav/beyond-iso-42001-the-role-of-iso-iec-23894-in-ai-risk-management-7c4f3036544f", "slug": "medium", "title": "Beyond ISO 42001: The Role of ISO/IEC 23894 in AI Risk Management | by Amitav Mukherjee | Medium", "snippet": "ISO/IEC 23894 is laser-focused on AI risk management. It acknowledges that while AI shares some risks with traditional software systems (like security vulnerabilities), it also introduces unique risks.", "image": null, "date_published": null, "media": [], "products": [], "source": {"id": 598044, "website_id": 18, "url": "https://medium.com/@mukherjee.amitav/beyond-iso-42001-the-role-of-iso-iec-23894-in-ai-risk-management-7c4f3036544f", "title": "Beyond ISO 42001: The Role of ISO/IEC 23894 in AI Risk Management | by Amitav Mukherjee | Medium", "snippet": "ISO/IEC 23894 is laser-focused on AI risk management. It acknowledges that while AI shares some risks with traditional software systems (like security vulnerabilities), it also introduces unique risks.", "cleaned_text": null, "cleaned_text_custom_parser": null, "cleaned_text_custom_parser_2": null, "best_field": null, "enhanced": false, "date_published": null, "image": null, "num_tokens_oai_tokenizer": null, "num_tokens_gemini_tokenizer": null}, "favicon": "https://medium.com/favicon.ico", "state": "candidate", "enhanced": false, "answer": null, "valid_answer": false, "source_citation_index": 9, "user_web_page_id": null, "status": "not_processed", "reader": false, "rank": 2, "reason": "This source discusses the integration of ISO standard requirements into corporate compliance programs, which is relevant for compliance officers."}, {"id": 520550, "type": "GenericWebPage", "mime_type": "text/html", "url": "https://aws.amazon.com/blogs/security/ai-lifecycle-risk-management-iso-iec-420012023-for-ai-governance/", "slug": "amazon", "title": "AI lifecycle risk management: ISO/IEC 42001:2023 for AI governance | Amazon Web Services", "snippet": "But how can you make sure that your AI systems are ethical, resilient, and aligned with compliance standards? ISO/IEC 42001, the international management system standard for AI, offers a framework to help organizations implement AI governance across the lifecycle.", "image": null, "date_published": null, "media": [], "products": [], "source": {"id": 520550, "website_id": 245, "url": "https://aws.amazon.com/blogs/security/ai-lifecycle-risk-management-iso-iec-420012023-for-ai-governance/", "title": "AI lifecycle risk management: ISO/IEC 42001:2023 for AI governance | Amazon Web Services", "snippet": "But how can you make sure that your AI systems are ethical, resilient, and aligned with compliance standards? ISO/IEC 42001, the international management system standard for AI, offers a framework to help organizations implement AI governance across the lifecycle.", "cleaned_text": null, "cleaned_text_custom_parser": "But how can you make sure that your AI systems are ethical, resilient, and aligned with compliance standards? ISO/IEC 42001, the international management system standard for AI, offers a framework to help organizations implement AI governance across the lifecycle.", "cleaned_text_custom_parser_2": null, "best_field": "cleaned_text_custom_parser", "enhanced": false, "date_published": null, "image": null, "num_tokens_oai_tokenizer": null, "num_tokens_gemini_tokenizer": null}, "favicon": "https://www.amazon.com/favicon.ico", "state": "candidate", "enhanced": false, "answer": null, "valid_answer": false, "source_citation_index": 10, "user_web_page_id": null, "status": "not_processed", "reader": false, "rank": 2, "reason": "The source gives a general overview of ISO standards, including AI management which has relevant application for risk management."}]