White House Office of Management and Budget Issues Government Wide Policy on AI

April 10, 2024

By: Brett J. Ashton

On March 20, 2024, the White House Office of Management and Budget (“OMB”) issued a Memorandum on Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence (the “Memo”) to the heads of the executive departments of all federal departments and agencies. The Memo is another milestone in the Biden Administration’s efforts to implement its Blueprint for an AI Bill of Rights (the “Bill of Rights”)“, Executive Order 14110 on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, and the National Institute of Standards and Technology (“NIST”) AI Risk Management Framework.

The Memo is limited in scope to establishing requirements and guidance for Artificial Intelligence (“AI”) governance, innovation and risk management by the various federal departments and agencies that will be used to establish minimum practices for the use of AI that impact the rights and safety of the public. i.e. – not the entities they regulate. However, the standards established in the Memo demonstrate another step in the implementation of the principles outlined in the AI Bill of Rights, and instructive as to what lays ahead for all regulated industries who use AI.

The Memo requires all agencies to apply minimum risk management practices to “Safety-Impacting” and “Rights-Impacting AI by December 1, 2024, or stop using the AI until they achieve compliance with these requirements. Safety-Impacting AI refers to AI whose output produces an action or serves as a principal basis for a decision that has the potential to significantly impact the safety of:

• Human life or well-being, including loss of life, serious injury, bodily harm, biological or chemical harms, occupational hazards, harassment or abuse, or mental health, including both individual and community aspects of these harms;
• Climate or environment, including irreversible or significant environmental damage;
• Critical infrastructure, including the critical infrastructure sectors defined in Presidential Policy Directive 2159 or any successor directive and the infrastructure for voting and protecting the integrity of elections; or,
• Strategic assets or resources, including high-value property and information marked a sensitive or classified by the Federal Government.

Rights-Impacting AI refers to AI whose output serves as a principal basis for a decision or action concerning a specific individual or entity that has a legal, material, binding, or similarly significant effect on that individual’s or entity’s:

• Civil rights, civil liberties, or privacy, including but not limited to freedom of speech, voting, human autonomy, and protections from discrimination, excessive punishment, and unlawful surveillance;
• Equal opportunities, including equitable access to education, housing, insurance, credit, employment, and other programs where civil rights and equal opportunity protections apply; or
• Access to or the ability to apply for critical government resources or services, including healthcare, financial services, public housing, social services, transportation, and essential goods and services.

The Memo establishes certain basic minimum practices that must be performed by government agencies for AI, regardless of whether it is considered Safety-Impacting or Rights-Impacting, as follows:

Minimum Practices for Either Safety-Impacting or Rights-Impacting AI.

• Complete an AI Impact Assessment
• Test the AI for Performance in a Real-World Context
• Independently Evaluate the AI
• Conduct Ongoing Monitoring of the AI
• Regularly Evaluate Risks from the AI
• Mitigate Emerging Risks to Rights and Safety
• Ensure Adequate Human Training and Assessment
• Provide Additional Human Oversight, Intervention, and Accountability as Part of Decisions or Actions that Could Result in a Significant Impact on Rights or Safety
• Provide Public Notice and Plain Language Documentation

In addition to the basic minimum practices required regardless of the nature of the AI, the Memo further requires the following additional practices be employed by government agencies prior to using Rights-Impacting AI:

Additional Minimum Practices Prior to Using New or Existing Rights-Impacting AI.

• Identify and Assess AI’s Impact on Equity and Fairness, and Mitigate Algorithmic Discrimination When it is Present
• Consult and Incorporate Feedback from Affected Communities and the Public
• Conduct Ongoing Monitoring and Mitigation for AI Enabled Discrimination
• Notify Negatively Affected Individuals
• Maintain Human Consideration and Remedy Process
• Maintain Options to Opt-Out for AI Enabled Decisions

All regulated industries should expect their regulators to move quickly to assess their agencies' use of AI, and the extent to which any AI they are using complies with the requirements of the Memo. How long it will be until the various government agencies begin to extend many of these same AI use requirements to the industries they regulate remains to be seen, but considering the speed in which the technology associated with AI appears to be developing, it is likely to be sooner than expected.

Krieg DeVault attorneys are actively monitoring the rapid development of laws and regulations impacting the use of AI by all regulated industries and ready to help you navigate the quickly shifting regulatory requirements applicable to your business.

Disclaimer. The contents of this article should not be construed as legal advice or a legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult with counsel concerning your situation and specific legal questions you may have. ** In addition to their own experience and thought processes, the authors used Artificial Intelligence to assist in the creation of this Alert.

Practices

• Artificial Intelligence (AI)