OMB Memorandum M-24-10 (Advancing Governance, Innovation, and Risk Management for Agency Use of AI)
OMB-M-24-10 · US
In force since 2024-03-28. A Policy statement from US. Binding on covered federal agencies. Three pillars: (I) strengthen AI governance through agency Chief AI Officers + AI Governance Boards; (II) advance responsible AI innovation including authorized use, talent, and infrastructure; (III) manage risks from agency AI use with mandatory minimum practices for safety- and rights-impacting AI by December 1, 2024. Agencies must publicly inventory their AI uses annually (continuing the EO 13960 + EO 14110 inventory tradition) and report AI procurements quarterly. Attachment 1 sets the operative risk-management minimum practices (AI impact assessment, real-world performance testing, independent evaluation, ongoing monitoring, public notice + plain-language explanation, human oversight + opt-out for rights-impacting uses).
Key finding
Binding federal-agency directive operationalising EO 14110 §10; CAIOs + governance boards required; rights-impacting AI must meet minimum risk-management practices by Dec 2024.
“Agencies must apply specific minimum practices when using safety-impacting or rights-impacting AI (§5(c)).”
Coverage at a glance
Coverage fingerprint — color = verdict, height = confidence. One tick per tracked topic.
Key finding
Binding federal-agency directive operationalising EO 14110 §10; CAIOs + governance boards required; rights-impacting AI must meet minimum risk-management practices by Dec 2024.
“Agencies must apply specific minimum practices when using safety-impacting or rights-impacting AI (§5(c)).”
sec:5(c) · Primary source
Reviewed by Editorial board (in formation) (Policy Window) · · Editorial board
Scope and obligations
Binding on covered federal agencies. Three pillars: (I) strengthen AI governance through agency Chief AI Officers + AI Governance Boards; (II) advance responsible AI innovation including authorized use, talent, and infrastructure; (III) manage risks from agency AI use with mandatory minimum practices for safety- and rights-impacting AI by December 1, 2024. Agencies must publicly inventory their AI uses annually (continuing the EO 13960 + EO 14110 inventory tradition) and report AI procurements quarterly. Attachment 1 sets the operative risk-management minimum practices (AI impact assessment, real-world performance testing, independent evaluation, ongoing monitoring, public notice + plain-language explanation, human oversight + opt-out for rights-impacting uses).
OMB Memorandum M-24-10 (Advancing Governance, Innovation, and Risk Management for Agency Use of AI) addresses 3 contested AI-governance topics explicitly, 3 via general principles,.
Topics governed
- implicitFoundation Models / GPAI— §5 + Attachment 1 — minimum practices apply to safety- + rights-impacting AI regardless of foundation-model classification; no compute-threshold trigger
§5(c)paraphraseBefore agencies use new or existing safety-impacting or rights-impacting AI, they must implement the minimum practices in this section; if they cannot, they must cease using the AI until compliance is achieved.
- implicitAI in Employment— Attachment 1 examples include employment + benefits decisions as rights-impacting; minimum practices apply
- implicitAI in Healthcare— Attachment 1 examples include healthcare access decisions as rights-impacting; minimum practices apply
- governsCompute-Threshold Reporting— §3(a)(iv)–(v) annual public AI use-case inventory + quarterly AI procurement reporting to OMB
§3(a)(v)paraphraseAgencies must report to OMB and, as appropriate, publicly release aggregate metrics about their AI use cases that are determined to be safety-impacting or rights-impacting.
- governsTransparency Obligations— §3(a)(iv) public AI use-case inventory; Attachment 1 §5(c)(v) plain-language public notice + explanation for rights-impacting AI
§3(a)(iv)paraphraseAgencies must individually inventory each of their AI use cases at least annually, submit the inventory to OMB, and post a public version of the inventory on the agency website.
- governsIndividual Redress— Attachment 1 §5(c)(v)(D) human consideration + remedy for rights-impacting AI; opt-out where practicable
§5(c)(v)(D)paraphraseFor rights-impacting AI, agencies must provide timely human consideration and potential remedy through a fallback and escalation process where individuals can appeal or contest adverse decisions.
Cross-jurisdiction comparison
How peer instruments treat the topics OMB Memorandum M-24-10 (Advancing Governance, Innovation, and Risk Management for Agency Use of AI) governs.
| Topic | EU-AIA-2024 | US-EO-14110 | US-EO-14179 | UK-WHITEPAPER-2023 | CN-GENAI-2023 | G7-HIROSHIMA | OECD-AI-PRIN | COE-AI-CONV | UN-RES-2024 | NIST-AI-RMF | BLETCHLEY-2023 | SEOUL-2024 | NIST-AI-RMF-GENAI | CA-SB-1047 | IN-DPDP-2023 | BR-AIBILL-2024 | ASEAN-AI-GUIDE-2024 | AU-AI-STRATEGY-2024 | ANTHROPIC-RSP-2024° | OPENAI-PREPAREDNESS-2023° | DEEPMIND-FSF-2024° | META-FRONTIER-2024° | UK-US-AISI-MOU-2024 | WH-VOLUNTARY-2023 | SG-MODEL-AI-2024 | JP-METI-AI-2024 | NYC-LL-144-2021 | CO-SB-24-205 | IL-HB-3773-2024 | EU-GDPR-2016 | EU-GPAI-COP-2025 | EU-AIA-DELEGATED-ART51 | GSA-AI-GUIDE-2024 | FAR-PART-39 | DOD-RAI-2022 | FEDRAMP-AI-2024 | DFARS-252-204 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Compute-Threshold Reporting | governs | governs | silent | silent | silent | silent | silent | silent | silent | silent | implicit | implicit | silent | governs | silent | silent | silent | silent | implicit | implicit | silent | silent | silent | implicit | silent | silent | silent | silent | silent | silent | silent | silent | governs | implicit | implicit | implicit | implicit |
| Transparency Obligations | governs | implicit | silent | implicit | conflicts | governs | governs | governs | implicit | governs | implicit | governs | governs | implicit | implicit | governs | governs | silent | governs | implicit | implicit | governs | implicit | governs | governs | governs | silent | silent | silent | governs | governs | silent | governs | implicit | governs | governs | silent |
| Individual Redress | governs | silent | silent | implicit | governs | silent | governs | governs | silent | implicit | silent | silent | implicit | implicit | governs | governs | silent | silent | silent | silent | silent | silent | silent | silent | implicit | implicit | silent | silent | silent | governs | silent | silent | implicit | silent | implicit | implicit | silent |
°= industry self-imposed voluntary framework. Comparing a voluntary code's "governs" tint with a binding regulation's "governs" tint flattens the legal-force distinction; use the instrument-page banner for the operative status of each.
How to cite this article
APA 7
Policy Window. (2024). OMB Memorandum M-24-10 (Advancing Governance, Innovation, and Risk Management for Agency Use of AI) [Wiki article — Instrument]. https://policywindow.org/wiki/omb-m-24-10
Chicago 17
Policy Window. 2024. "OMB Memorandum M-24-10 (Advancing Governance, Innovation, and Risk Management for Agency Use of AI)." Wiki article (Instrument). https://policywindow.org/wiki/omb-m-24-10.
BibTeX
@misc{policywindow-omb-m-24-10,
title = {OMB Memorandum M-24-10 (Advancing Governance, Innovation, and Risk Management for Agency Use of AI)},
author = {Policy Window},
year = {2024},
howpublished = {OMB Memorandum M-24-10 (Mar. 28, 2024), Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence},
url = {https://policywindow.org/wiki/omb-m-24-10},
note = {Primary source: https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management-for-Agency-Use-of-Artificial-Intelligence.pdf}
}References
- OMB Memorandum M-24-10 (Mar. 28, 2024), Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence
- §5 + Attachment 1 — minimum practices apply to safety- + rights-impacting AI regardless of foundation-model classification; no compute-threshold trigger
- Attachment 1 examples include employment + benefits decisions as rights-impacting; minimum practices apply
- Attachment 1 examples include healthcare access decisions as rights-impacting; minimum practices apply
- §3(a)(iv)–(v) annual public AI use-case inventory + quarterly AI procurement reporting to OMB
- §3(a)(iv) public AI use-case inventory; Attachment 1 §5(c)(v) plain-language public notice + explanation for rights-impacting AI
- Attachment 1 §5(c)(v)(D) human consideration + remedy for rights-impacting AI; opt-out where practicable
Cite this article
6 formats · 1-click copyPersistent identifier: https://policywindow.org/wiki/omb-m-24-10 — committed-stable URL with content-versioning via ?asOf= (rollout pending per methodology §7). DOIs via Zenodo are on the roadmap.
Track this article
Save OMB Memorandum M-24-10 (Advancing Governance, Innovation, and Risk Management for Agency Use of AI) to your local reading list, follow the RSS changelog for any catalog change, or compare with a peer article. All three work without signup.
Per-audience views
- Provisions →Article-by-article obligation breakdown for procurement + RFP authors.
- Disclosure form →Vendor-disclosure questionnaire derived from this instrument's operative obligations.
- Harm narratives →Documented harms relevant to this instrument's topics, for civil-society advocacy.
- Briefing pack →Journalist-ready summary with quotes + dates + primary-source links.