Skip to content
Article reader Listen + reading controls
LISTEN + READ YOUR WAY

Article reader

Preparing the reader…

0:00 0:00
Reading settings
Text size
100%

Federal AI standards should standardize evidence, not freeze design

Federal agencies need a common way to show that an artificial intelligence (AI) system is understood, controlled, and worthy of use. They do not need Washington to prescribe one architecture, model class, or development method for every mission.

That tension sat inside the Federal AI Governance and Transparency Act introduced in 2024. House bill H.R. 7532 proposed a government-wide structure for AI governance, including agency charters, inventories, risk practices, workforce training, oversight, and updates to federal acquisition rules.

The bill advanced through the House Oversight Committee and was formally reported late in 2024, but it did not become law. The question it raised remains unresolved: what should federal AI standards make uniform, and where should they preserve variation?

The right answer is to standardize the interfaces of accountability—the evidence agencies retain, the decisions they document, and the signals they exchange—without freezing the technical design beneath them.

Revised and substantially expanded July 17, 2026, to reflect the bill's outcome and the federal AI guidance that followed.

Uniformity is valuable at the boundaries

Government-wide standards can reduce duplicated effort and make oversight possible across agencies. A common vocabulary for lifecycle stage, impact, incident, evaluation, waiver, and material change allows people to compare systems that serve very different missions.

Common fields also support mobility. A privacy reviewer moving between agencies should not have to relearn what an AI system inventory means. A contractor supporting several departments should not face incompatible evidence requests for the same underlying claim. Congress and inspectors general should be able to aggregate information without forcing every agency into a bespoke reporting exercise.

The most valuable shared standards describe:

  • the minimum information in a system registry;
  • roles and decision rights across the lifecycle;
  • how intended purpose, users, affected people, and operating context are documented;
  • what constitutes a material system change;
  • evidence required for higher-impact uses;
  • incident, complaint, override, and appeal records;
  • public notice and disclosure fields;
  • model, data, software, and vendor provenance;
  • contractor reporting and government access rights; and
  • conditions for suspension and retirement.

These are interfaces. They make work from different organizations legible to one another.

Standardization should not erase context

An AI system used to forecast equipment maintenance does not present the same questions as a system influencing access to a federal benefit. A language model supporting an internal help desk differs from a targeting or intelligence capability. Even within one category, consequences vary with population, environment, authority, data, and human workflow.

A universal checklist can produce two failures. It can impose unnecessary controls on low-consequence uses, slowing useful work without reducing meaningful risk. It can also give high-consequence systems the appearance of legitimacy because every box is checked, even when the evidence does not address the real failure modes.

The National Institute of Standards and Technology (NIST) AI Risk Management Framework offers a better pattern. Its Govern, Map, Measure, and Manage functions define outcomes and questions that organizations apply to a particular context. The framework is structured enough to create a shared language and flexible enough to support different missions, risk tolerances, and technical approaches.

Federal standards should work the same way: common evidence architecture, proportional implementation.

Standardize the claim and the evidence

AI governance is full of statements that sound precise but are difficult to audit: the model is accurate, the system is fair, a human remains in the loop, the data are representative, or the use is low risk.

A standard should require each claim to identify:

  1. Meaning. What exactly does “accurate,” “fair,” “representative,” or “human oversight” mean for this task?
  2. Scope. For which users, populations, data, environments, and system versions does the claim apply?
  3. Method. How was the claim evaluated, against which baseline, and by whom?
  4. Result. What happened, including uncertainty, tradeoffs, and known failure cases?
  5. Validity period. Which changes would make the evidence stale?
  6. Owner. Who is accountable for monitoring and refreshing the claim?

This creates an assurance case rather than a compliance slogan. Two agencies can use different models and tests while presenting their reasoning in a form that oversight bodies can examine.

The U.S. Government Accountability Office (GAO) has shown why this is necessary. Its review of federal AI implementation found incomplete and inaccurate use-case inventories. Its review of AI use for Department of Homeland Security cybersecurity found that one use reported as AI was not AI and identified weaknesses in data reliability and performance monitoring. A standard is not useful merely because agencies submit the same field. The field must carry reliable evidence.

Procurement is where standards become real

Many federal AI systems are assembled from commercial models, cloud services, integrators, government data, and agency workflows. The government cannot meet its own transparency and oversight obligations if contracts do not provide the necessary visibility.

Government-wide acquisition standards should require terms appropriate to the use for:

  • system and model version notice;
  • data and output rights;
  • evaluation access and test support;
  • logs and audit evidence;
  • incident and vulnerability reporting;
  • notice of material provider or subcontractor changes;
  • security and privacy responsibilities;
  • portability and transition assistance; and
  • continued access to government records at contract end.

The reported text of H.R. 7532 anticipated this connection by directing changes to the Federal Acquisition Regulation so contractors and subcontractors would provide information agencies needed to comply.

Current Office of Management and Budget (OMB) guidance separates agency use and acquisition into M-25-21 and M-25-22. Agencies should implement them as one operating system. Governance requirements that are not translated into solicitations and contracts will fail at the vendor boundary.

Training should follow responsibility

The 2024 bill also emphasized workforce training. “AI literacy” is often treated as one general curriculum, but people need different knowledge for different decisions.

Senior leaders need to understand portfolio risk, evidence, funding, and accountability. Acquisition professionals need to negotiate observability, data rights, competition, and exit. Product and program leaders need to define baselines and adoption conditions. Engineers need secure development, evaluation, and monitoring practices. Reviewers need enough technical understanding to challenge claims. Frontline users need to recognize limitations, document overrides, and report failures.

Training should be attached to authority. If a person can approve a high-impact use, accept residual risk, modify a model, or rely on its output in a public decision, the curriculum should prepare that person for that responsibility.

Completion rates are a weak measure. Better measures ask whether staff can identify an applicable governance path, produce usable evidence, respond to an incident, and make a defensible go, constrain, or stop decision.

Build standards that can survive policy change

Federal AI guidance changed in 2025. Future administrations and Congresses will change it again. Standards should distinguish stable operating questions from variable policy choices.

Stable questions include what the system does, who owns it, who is affected, what it depends on, how it performs, how failures are detected, and who can stop it. Variable policy determines thresholds, categories, reporting periods, public fields, and which official holds particular authority.

If agencies build around the stable questions, new policy becomes a mapping exercise. If they build a separate spreadsheet for every memorandum, policy change destroys continuity and creates more administrative work.

The same principle applies to technical standards. Require machine-readable provenance, documented evaluations, and interoperable evidence formats. Do not assume one model architecture or vendor will remain dominant. Define what the government must be able to know and do, then allow mission teams to choose the smallest technical approach that satisfies those conditions.

A common floor, not a common ceiling

The federal government does need consistent AI governance. Fragmentation wastes effort, complicates oversight, and allows accountability gaps to hide between agencies and contractors.

Consistency should create a common floor: reliable inventories, explicit owners, evidence tied to context and version, lifecycle decisions, incident visibility, public notice, and enforceable acquisition rights. Agencies should remain free to exceed that floor and to implement it through architectures suited to their missions.

The goal is not identical AI across government. It is comparable assurance. A citizen, leader, auditor, or operator should be able to understand what claim an agency is making about a system, inspect the evidence supporting that claim, and identify who is accountable when conditions change.

That is what federal standards should standardize.

Sources

READER-NEUTRAL SUBSCRIPTION

Follow Field Notes via RSS.

Copy this address into the RSS reader you already use. New notes will appear there automatically—no account, email address, or tracking required.

Open the feed