Drafting Agency AI Policies

Learning Objectives

After completing this lecture, a federal policy lead or Chief AI Officer designee will be able to: first, construct the full policy taxonomy an agency needs to satisfy Executive Order 14110, OMB Memorandum M-24-10, the NIST AI Risk Management Framework, the Federal Information Security Modernization Act, and emerging ISO/IEC 42001 audit expectations, all of which an agency under scrutiny must now produce on demand for a GAO or Inspector General review; second, distinguish the five levels at which an agency issues AI policy, namely the Secretary's or Administrator's Directive at level one, the Chief AI Officer Policy Memo at level two, the AI Governance Board Charter and approved operating procedures at level three, the program-specific Standard Operating Procedure at level four, and the individual system's Concept of Operations at level five, and know which actors must sign each; third, draft a policy with the stakeholder engagement pattern used by successful agencies such as GSA, VA, and CISA, including the legal review sequence with the Office of General Counsel, the coordination with the Privacy Officer and Senior Agency Official for Privacy, the engagement with civil rights and civil liberties officers required by OMB M-24-10, and the public comment step used when a policy is rights-impacting; fourth, write policy in plain language that is enforceable, auditable, and understandable by non-specialists, using the plain-language principles in the 2010 Plain Writing Act and the federal web content style guide; and fifth, build the enforcement and revision cycle that keeps policy alive rather than shelved, with metrics for policy compliance, a revision trigger list, and documented links between each policy and the underlying authority it implements.

Key Topics Covered

The lecture covers eight topics in sequence. First, the federal policy landscape for AI, including how OMB M-24-10 relates to EO 14110 and how the NIST AI RMF plays in as a voluntary-but-expected framework. Second, the five-level policy taxonomy from Secretary's Directive to system CONOPS, with worked examples drawn from the Department of Veterans Affairs AI Policy Framework, the GSA AI Governance Charter, and the DHS AI Strategy. Third, the drafting process, including scoping, legal review, privacy review, civil rights review, public engagement where applicable, executive review, and publication in the agency's policy system of record. Fourth, the elements every policy must contain, including authority, scope, definitions, roles and responsibilities, requirements, exceptions and waivers, enforcement, and revision cadence. Fifth, plain-language drafting including sentence length, active voice, defined terms, and readability targets under the Plain Writing Act. Sixth, coordination with privacy, records, and civil rights offices, including the SAOP and the Section 508 and Title VI obligations. Seventh, policy enforcement, including training, attestation, compliance audits, and IG or GAO-facing evidence packages. Eighth, revision cadence, including annual review, incident-driven revision, and sunset or re-issuance decisions.

Why This Matters for Government

Agency AI policy is not a glossy external document. It is the load-bearing operating system of your AI program. It is what allows the Chief AI Officer to say yes or no to a use case and have the decision stick. It is what gives the contracting officer language to cite in a cure notice. It is what a GAO auditor asks to see first. And it is what converts abstract obligations in OMB M-24-10, EO 14110, FISMA, and the NIST AI RMF into concrete actions that staff can take tomorrow morning. When an agency's AI policy is well drafted, mid-career program managers at VA, IRS, DHS, and DOD can operate inside a known envelope. When it is poorly drafted or missing, every AI decision becomes a one-off negotiation, which is slow, inconsistent, and legally fragile.

Policy failure modes in federal AI fall into three buckets. The first is the phantom policy: a document that exists on the agency web site but does not map to any actual decision process. The VA OIG in 2024 found exactly this pattern in two program offices, where AI policies referred to an AI Governance Board that had not met in eight months. Staff interviewed could not name the Board's decision authority. The remediation required re-chartering the Board, tying each policy to a named decision authority, and publishing decision logs. The second failure mode is the inherited policy, where an agency copies language from another agency or a commercial framework without adapting it to local authorities. The result is policy that references controls the agency does not own or use, which fails audit and confuses staff. The third failure mode is the frozen policy, last revised in 2021, still referring to 'machine learning' as a single technology, with no reference to generative AI, agentic systems, or the OMB M-24-10 rights-impacting taxonomy published in 2024. Frozen policy is worse than no policy because it suggests to staff that the old categories still apply when they do not.

Good policy drafting, by contrast, is a discipline. It starts with clarity about authority: what statute, regulation, or executive action is this policy implementing? It moves through explicit stakeholder engagement that gets the Office of General Counsel, the Senior Agency Official for Privacy, the Chief Information Security Officer, the Civil Rights Office, and affected mission owners on record before publication. It produces a plain-language document that a new employee can understand without a glossary. And it establishes a living enforcement and revision process, so that policy keeps pace with the rapid evolution of AI technology and federal guidance. Agencies that have institutionalized this discipline, including GSA, NASA, and elements of DHS, can respond to a GAO request with a policy package in days rather than months. Agencies that have not, scramble, and frequently end up with audit findings that tie leadership capacity up for quarters.

The Five-Level Policy Taxonomy

Federal AI policy should be organized in a five-level taxonomy, with each level having a distinct purpose, audience, and signatory. Level one is the Secretary's or Administrator's Directive, a one- to three-page document that establishes the agency's AI posture and names the Chief AI Officer as the senior accountable official under OMB M-24-10. It cites EO 14110, OMB M-24-10, and the agency's statutory mission. The Secretary or Administrator signs it. It is infrequently revised; once every two years is typical. Level two is the CAIO Policy Memo, a longer document that operationalizes the directive, covering topics such as the use case inventory process, the rights-impacting and safety-impacting classifications, training requirements, and incident reporting. The CAIO signs it and it is typically revised annually. Level three is the AI Governance Board Charter and its approved operating procedures. The Charter establishes the Board's membership, decision authority, quorum, and escalation rules. Operating procedures cover how the Board intakes and reviews use cases, what artifacts are required for approval, and how decisions are documented. The Board itself approves its operating procedures and the CAIO approves the Charter.

Level four is the program-specific Standard Operating Procedure. Each major program area with AI, such as VA benefits processing, IRS taxpayer services, or CBP secondary screening, needs an SOP translating Level one through three into actions that frontline teams can execute. The program's Assistant Secretary or Deputy signs it. Level five is the individual system's Concept of Operations, which combines the technical design, operational plan, monitoring plan, human-in-the-loop design, appeal path, training requirements, and incident response plan for that specific AI system. The program manager signs the CONOPS with concurrence from the CAIO's office.

Failure to maintain all five levels produces specific and diagnosable pathologies. If the Directive is missing or vague, the agency has no unified posture and different program offices drift. If the CAIO Memo is missing, staff cannot determine what counts as rights-impacting or how to report incidents. If the Board Charter is weak, decisions feel arbitrary. If SOPs are missing, frontline staff improvise. If CONOPS are missing, the agency cannot explain to an IG why a system is operating as it is. A GAO auditor asked to evaluate an agency's AI governance will walk this taxonomy from top to bottom and the gaps become the findings.

The Drafting Process: Seven Steps That Produce Durable Policy

Durable agency AI policy is produced by a seven-step drafting process. Step one is scoping, which names the policy's purpose, the authority it implements, the audience, and the Level in the taxonomy. Scoping produces a one-page memo that the CAIO approves before substantive drafting begins; this prevents weeks of work on a document aimed at the wrong level or audience. Step two is the first draft, produced by the CAIO's policy lead with input from at least one mission owner, the Office of General Counsel, and the CISO. This draft is deliberately rough; its purpose is to produce a shared artifact that stakeholders can react to, not to achieve final quality.

Step three is legal review, coordinated by the Office of General Counsel. OGC checks alignment with statute, prior agency policy, executive branch guidance, and litigation posture. OGC also flags any language that creates enforceable rights in third parties, which is typically avoided in internal policy. Step four is privacy, records, and civil rights review. The Senior Agency Official for Privacy reviews for Privacy Act and Section 208 of the E-Government Act implications. The Agency Records Officer reviews for records management obligations under 44 USC chapter 31. The Civil Rights office reviews for Title VI, Section 504, and any agency-specific civil rights obligations. For rights-impacting uses, OMB M-24-10 requires civil rights office engagement, making this review non-optional for any policy touching those uses.

Step five is executive review, which brings the policy to the AI Governance Board and, for high-visibility policies, to the Deputy Secretary or Administrator. The Board functions as an integration point that catches cross-mission conflicts. Step six is public engagement where applicable. For rights-impacting policies, agencies increasingly post draft policy for a limited public comment window, either through the Federal Register or a dedicated agency portal, gathering external expertise and demonstrating procedural legitimacy. Step seven is publication and socialization, which includes posting in the agency policy system of record, sending a notice to affected staff, training program leads on new obligations, and scheduling the first compliance check. Skipping any step creates predictable pathologies: skipping legal review produces unenforceable policy; skipping privacy review produces a Privacy Act violation risk; skipping socialization produces a policy that nobody follows.

Elements Every Policy Must Contain

A well-drafted federal AI policy contains nine sections, in approximately this order. First, Authority, citing the statutes, regulations, executive orders, and prior agency documents the policy implements; this section is what makes the policy binding. Second, Scope, identifying the types of AI systems, use cases, programs, and personnel covered; scope should be explicit about what is excluded as well as what is included. Third, Definitions, using the OMB M-24-10 and NIST AI RMF terminology where possible, with agency-specific terms clearly distinguished. Fourth, Roles and Responsibilities, naming the CAIO, CIO, CISO, SAOP, Chief Data Officer, Civil Rights Office, General Counsel, and mission owners with specific responsibilities, not vague phrases like 'as appropriate.'

Fifth, Requirements, the substantive rules: what staff must do, what is prohibited, what must be documented, what must be reviewed. Requirements should use 'shall' language for mandatory items and 'should' for recommended practices, never mixing the two ambiguously. Sixth, Exceptions and Waivers, describing the limited circumstances where requirements may be relaxed and who has authority to grant a waiver. The OMB M-24-10 exception pattern, where rights-impacting use cases can be exempted only through a documented risk-acceptance signed by the CAIO, is the federal gold standard. Seventh, Enforcement, including compliance monitoring, training requirements, attestation, and disciplinary consequences for non-compliance. Enforcement language should reference the agency's existing accountability systems rather than inventing new ones.

Eighth, Revision, including a revision cadence (annual is common), revision triggers (regulatory changes, major incidents, OIG findings), and the named authority for revisions. Ninth, Effective Date and Signatures, with the appropriate official signing and clear dates. Policies missing these sections predictably fail; every IG finding I have reviewed on federal AI policy gaps maps to one of these nine elements.

Plain-Language Drafting and Readability

The Plain Writing Act of 2010 requires federal agencies to use plain language in communications with the public, and OMB has extended plain-language expectations to internal policy as well. For AI policy, plain language is not optional polish; it is the difference between policy that staff can follow and policy that becomes a shelf ornament. Good AI policy has sentences that average under 20 words, uses active voice more than 80% of the time, and defines technical terms at first use with a simple definition rather than a long technical footnote. The federal web content style guide and PlainLanguage.gov provide target readability levels, typically 8th to 10th grade on standard readability scales for internal policy.

Four specific practices distinguish the best federal AI policies. First, they define 'AI' and 'AI system' once, at the start, using the OMB M-24-10 and NIST AI RMF definitions. They do not reinvent terminology. Second, they use consistent subject-verb patterns for requirements: 'Program managers shall…', 'The CAIO shall…', 'Users may…'. This makes compliance checking trivially easy for auditors. Third, they include worked examples at the end of key sections, illustrating how the requirement applies to a concrete use case the agency actually runs. Fourth, they include a decision flow or checklist for the most common use cases, so that a new program manager can orient in minutes rather than reading the entire policy.

Anti-patterns to avoid include: undefined acronyms (every audit I have seen cites this), passive voice hiding the actor ('it shall be ensured that…'), nested conditionals more than two layers deep, cross-references to external documents without a date and version, and use of vendor-specific terminology that will change next product cycle. Agencies that adopt plain-language drafting as a discipline find that policy adoption increases measurably; staff are more likely to follow policy they can understand.

Enforcement, Compliance Evidence, and Revision Cadence

A policy that is not enforced is a suggestion. Federal AI policy enforcement relies on five mechanisms working together. First, training: every covered employee must complete training on the policy's requirements, and training completion must be tracked. Second, attestation: for higher-sensitivity obligations, annual attestation where covered employees affirm that they understand and will comply; attestation logs become evidence in any subsequent IG review. Third, compliance monitoring: the CAIO's office or Internal Audit periodically samples use cases and verifies adherence, with findings reported to the AI Governance Board. Fourth, incident-driven review: any AI incident triggers a policy-compliance check, asking whether the policy was followed, whether the policy itself was adequate, and what revision is indicated. Fifth, IG and GAO-facing evidence: a policy is only as strong as the evidence package you can hand an auditor. Mature agencies maintain a perpetual evidence folder per policy with the signed document, training logs, attestation logs, compliance reports, incident cross-references, and revision history.

Revision cadence is the other half of enforcement. Annual review is standard. Revision triggers are additive: a new statute, EO, or OMB memo; a significant incident; a new IG or GAO finding; a major technology shift (for example, the arrival of widely deployed generative AI in 2023 triggered many agency policy revisions in 2024). Revision should not change every detail; it should incorporate new obligations while preserving the stable core. A revision log at the end of the policy captures the history and supports auditor questions about what the policy said at the time of a specific decision. Policies that revise chaotically without logs are nearly as audit-fragile as frozen policies.

The final enforcement discipline is consequence management. If a program office fails compliance, the CAIO's office documents the failure, sets a remediation plan, and tracks it to closure. Repeated non-compliance escalates to the Deputy Secretary. The Inspector General or GAO may also request compliance records. Agencies that treat compliance as a living process, with named consequences for failure, produce policy that actually shapes behavior; agencies that treat compliance as a formality produce policy that shapes paper.

Related Lectures

L3 3.2.1 Federal AI Governance Basics. L4 4.2.1 Navigating the Federal AI Landscape. L4 4.3.2 Cross-Agency AI Coordination. L3 3.4.2 AI Risk Assessment Methodology.