Learning Objectives

After completing this capstone workshop, participants will be able to produce a defensible, agency-specific AI strategy document that directly maps to the statutory and policy obligations now facing federal executive-branch organizations.

Specifically, you will be able to:

1. Draft the ten required sections of an OMB M-24-10 compliant agency AI Strategy (Executive Summary, Mission Context, Maturity Baseline, Vision and Objectives, Use Case Portfolio, Capability Roadmap, Governance Framework, Workforce Strategy, Stakeholder Engagement, Risk Register, and Metrics), referencing the template the Chief AI Officer must sign and publish.
2. Translate OMB M-24-10 required minimum practices for rights-impacting and safety-impacting AI into concrete agency commitments, including pre-deployment testing protocols, ongoing monitoring, human review, opt-out mechanisms for consequential decisions, and a termination plan for AI that fails a minimum practice.
3. Align the strategy to NIST AI RMF 1.0 functions (Govern, Map, Measure, Manage) so that the GAO AI Accountability Framework's four principal areas (Governance, Data, Performance, Monitoring) can be audited against written commitments.
4. Integrate Executive Order 14110 (Safe, Secure, and Trustworthy AI) obligations on dual-use foundation models, red-teaming, reporting, and equity with ongoing agency responsibilities under the Privacy Act of 1974, FISMA, FedRAMP, and Section 508.
5. Build a use-case inventory consistent with the public AI use case inventory required by Section 7225 of the Advancing American AI Act, including descriptions of rights-impacting and safety-impacting designations.
6. Conduct a realistic peer review cycle in which strategy drafts are challenged by compliance counsel, the CIO, the Senior Agency Official for Privacy, Equal Employment Opportunity, procurement, and mission-program leadership, producing a document the agency head can actually sign.
7. Connect the strategy to resourcing reality: appropriations cycles, FITARA, the Technology Modernization Fund, and interagency shared services provided by GSA and NIST.

By the end of ninety minutes, you will leave with a 15- to 20-page draft AI strategy that a Chief AI Officer could route for comment the next business day.

Key Topics Covered

This capstone integrates everything previously covered in the L3 curriculum into one coherent artifact. Topics covered in this workshop include:

Strategy anatomy. The anatomy of a federal AI strategy document including executive summary, organizational context, maturity baseline, strategic vision, quantified objectives, prioritized use-case portfolio, capability roadmap, governance model, workforce plan, stakeholder engagement plan, risk register, and measurement framework.

OMB M-24-10 alignment. The ten enterprise-level requirements every CFO Act agency strategy must satisfy: designate a Chief AI Officer at the Senior Executive Service level; establish an AI Governance Board chaired by the Deputy Secretary or equivalent; inventory AI use cases annually; identify and manage risks from AI that impact safety or rights; implement minimum practices; publish compliance plans; remove barriers to responsible AI use; promote innovation; advance equity; and manage workforce implications.

NIST AI RMF operationalization. Mapping each strategic commitment to a RMF function (Govern, Map, Measure, Manage) and to the RMF Playbook actions, so that an auditor from GAO or an OIG can trace a policy statement to a control to a measurable artifact.

Executive Order 14110 obligations. Reporting requirements for dual-use foundation models over the 10^26 FLOP training threshold; the National AI Research Resource pilot; AI talent surge via the USDS and the Presidential Innovation Fellows program; and agency-level obligations on equity, labor, privacy, and consumer protection.

Sector-specific layering. How Department of Health and Human Services, Department of Defense (DoD Directive 3000.09 and RAI Strategy), Department of Homeland Security (AI Roadmap), Department of Veterans Affairs (Trustworthy AI Framework), Department of the Treasury (OCC Model Risk Management SR 11-7), and Securities and Exchange Commission guidance layer on top of the government-wide minimum practices.

Drafting cadence. A 4-6 week, 6-8 working-session schedule including a context and maturity session; a vision and objectives session; a use-case portfolio session; a capability roadmap session; a governance and workforce session; a stakeholder engagement and risk session; a draft integration and review session; and a leadership approval session.

Peer review. A structured review protocol using a redline, a challenge-question set, and a resolution log to turn a first draft into a signable document.

Publication and socialization. How to publish the strategy consistently with the public use-case inventory, FOIA proactive disclosure expectations, and Privacy Act system-of-records-notice timelines.

Living-document mechanics. Quarterly pulse reviews, annual revision cadence, and trigger events (major incident, new administration, major budget change) that force interim updates.

Why This Matters for Government

A written AI strategy is not a rhetorical artifact. Under OMB Memorandum M-24-10 (Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence), issued March 28, 2024 by the Office of Management and Budget, every CFO Act agency must publish a Compliance Plan, designate a Chief AI Officer, stand up an AI Governance Board, and maintain a public use-case inventory. GAO reported in its 2023 update of the AI Accountability Framework (GAO-21-519SP) that the most common root cause of failed federal AI programs was not technology choice but the absence of a written, enterprise-level strategy aligning AI to mission.

This capstone exists because every piece of downstream compliance, from FedRAMP authorization of an AI service to a Privacy Act System of Records Notice, ultimately points back to a strategic artifact that names the Senior Accountable Official, the mission use, the risk tier, the minimum practices to be applied, and the metrics that will be monitored. Without that artifact, Inspectors General, GAO, congressional oversight committees, and the Office of Information and Regulatory Affairs have nothing to audit against.

Consider the pattern we have now observed across dozens of federal programs. In 2023, the Department of Veterans Affairs paused several predictive analytics deployments after the Office of the Inspector General found that there was no enterprise-level written strategy naming which tools were rights-impacting, triggering the minimum-practice obligations now codified in OMB M-24-10. In 2022, the Internal Revenue Service rolled back automated selection models after the National Taxpayer Advocate reported on disparate audit rates; subsequent GAO review recommended that IRS publish an enterprise AI strategy tying audit-selection AI to the Taxpayer Bill of Rights. In 2020, the State of Michigan settled a class action over the MiDAS unemployment fraud-detection system because no written governance document authorized its rights-impacting deployment.

The pattern is consistent. Agencies that have a written, socialized, and signed AI strategy are able to respond to incidents within days by pointing to their commitments, their monitoring program, and their escalation paths. Agencies without a written strategy spend months reconstructing what they were trying to do, why, and under whose authority. That reconstruction usually happens under the supervision of an Inspector General or a congressional committee.

This capstone therefore treats the strategy document as a legal-grade artifact. It must be drafted with the participation of the Office of General Counsel, the Senior Agency Official for Privacy, the Chief Information Security Officer, the Chief Data Officer, the Chief Acquisition Officer, and the Chief Human Capital Officer. It must be signed by an official with authority under the Federal Records Act to bind the agency. It must be published in a manner consistent with FOIA proactive disclosure. It must be revisited when the administration changes, when the budget changes, and when the technology changes.

Participants leave this session with a draft that survives challenge from career compliance staff, political leadership, and external oversight.

WHY THIS CAPSTONE MATTERS

Strategy documents serve multiple purposes in the federal environment, and each purpose has statutory or regulatory weight.

Externalizing your thinking. When you write down your AI strategy, gaps appear. The gap between "we will use AI for benefits adjudication" and "we will use AI to recommend adjudication outcomes under 5 U.S.C. 554 with human review under OMB M-24-10 minimum practice 5.c.iii and an opt-out mechanism" is the difference between a slogan and a commitment. Writing forces specificity.

Creating accountability. The Federal Records Act, 44 U.S.C. 3301, requires agencies to preserve records of policy decisions. A signed AI strategy is a policy record. When the Government Accountability Office reviews your agency, they will ask to see it. When the House Committee on Oversight and Accountability holds a hearing, they will ask to see it. When an Inspector General investigates an incident, they will ask to see it. Your strategy becomes the basis for accountability.

Providing a reference point for decision-making. When a vendor approaches your agency with a generative AI product, your Chief AI Officer checks the strategy. Is this in our use-case portfolio? Is it rights-impacting? Do we have a minimum-practice plan? Is there a FedRAMP-authorized offering? The strategy makes these questions routine rather than improvised.

Communicating to stakeholders. Congress, citizens, advocacy organizations, labor unions representing federal employees under 5 U.S.C. 71, and state and local partners need to understand what your agency is doing. A public strategy lets them understand without a FOIA request.

Providing continuity. Political transitions at the end of each Administration are disruptive. A written strategy that the civil service can execute while political leadership transitions is essential to sustain AI adoption.

WHY THIS MATTERS FOR GOVERNMENT AT SCALE

Across 24 CFO Act agencies, the federal government spends more than 80 billion dollars annually on IT. GAO's Technology Modernization Fund portfolio shows that projects with a written, board-approved strategy cost less, deliver sooner, and produce fewer IG findings than those without. The same pattern holds for AI.

THE STRATEGY DOCUMENT TEMPLATE

Your AI strategy document should include:

1. EXECUTIVE SUMMARY (1 page). State the vision, the three to five strategic priorities, the named Senior Accountable Official, and the date the strategy was signed.
2. ORGANIZATIONAL CONTEXT (1 page). Describe the agency mission under its authorizing statute (for example, the Social Security Act for SSA, Title 38 for VA, the Internal Revenue Code for IRS). Describe the operating environment, stakeholder population, and why AI matters to this mission.
3. CURRENT AI MATURITY (1-2 pages). Provide a maturity baseline across data, infrastructure, workforce, governance, and partnerships. Cite specific FedRAMP authorizations held, specific cloud environments approved, the Authority to Operate status of identified systems, and the current AI workforce head-count.
4. AI VISION AND STRATEGIC OBJECTIVES (1-2 pages). State a 3-5 year vision. Provide quantified objectives such as cycle-time reduction, citizen-satisfaction targets, backlog reduction, or cost avoidance. Each objective must be measurable.
5. STRATEGIC PRIORITIES AND USE CASES (2-3 pages). List the top 3-5 use cases sequenced over three years. For each, provide a name, a one-paragraph description, the mission outcome, the risk tier (general, rights-impacting, safety-impacting), the minimum-practice obligations that apply, the expected go-live quarter, the Senior Accountable Official, and the success metric.
6. CAPABILITY ROADMAP (2-3 pages). Describe the data, infrastructure, tooling, MLOps, evaluation, monitoring, and workforce capabilities needed to execute. Sequence them on a quarterly timeline. Tie them to budget.
7. GOVERNANCE FRAMEWORK (1-2 pages). Name the AI Governance Board composition and chair. Describe the intake, review, approval, and escalation process. State the delegation of authority from the Chief AI Officer to program offices. Describe how risks will be escalated to the agency head.
8. WORKFORCE STRATEGY (1-2 pages). Describe the plan to hire (including Title 5 competitive service and the AI and Tech Talent Task Force hiring authorities), to train (including the OMB-prescribed AI training for covered personnel), and to retain talent. Include change-management for non-AI staff.
9. STAKEHOLDER ENGAGEMENT (1 page). Identify Congress, unions, advocacy groups, vendors, academic partners, state partners. Describe the communication plan.
10. RISK MANAGEMENT (1-2 pages). Describe the top risks: mission failure, rights violation, security incident, equity harm, talent loss, vendor concentration. Describe mitigation for each.
11. METRICS AND ACCOUNTABILITY (1 page). Describe how success will be measured and how often. State who is accountable to whom. State the quarterly review cadence and the trigger events for interim review.

TOTAL: 15-20 pages.

PRACTICAL DEVELOPMENT PROCESS

The remainder of this capstone walks through the seven steps of the drafting process so you leave with a document in hand.

Related Lectures

L3 3.1.1 -- Developing an Organizational AI Strategy (120 min -- Lecture + Workshop)

L3 3.1.2 -- AI Maturity Assessment (90 min -- Workshop + Tool)

L3 3.1.3 -- Prioritization Frameworks for Government AI (90 min -- Workshop)

L3 3.1.4 -- Building the Business Case for Government AI (90 min -- Workshop)

L3 3.1.5 -- AI Roadmap Planning for Agencies (90 min -- Workshop)

L3 3.1.6 -- Workforce Strategy for Government AI (90 min -- Lecture + Scenario)

L3 3.1.7 -- Cultural Transformation for AI-Ready Agencies (90 min -- Lecture)

L3 3.1.8 -- Stakeholder Engagement and Political Management (90 min -- Lecture)

L3 3.1.9 -- AI Strategy for Different Government Contexts (90 min -- Lecture)

L3 3.2.1 -- Establishing an AI Governance Board (the natural next step after strategy is signed)