Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Government and public sector compliance

Government compliance — FedRAMP, FISMA, NIST AI RMF, OMB M-24-10, Section 508, Privacy Act, FOIA, EO 14110.

Government AI compliance is the densest regulatory surface of any sector — federal procurement, agency-specific rules, executive orders, civil rights statutes, and state/local overlays compound. The frame below covers the federal core; state and local agencies should add applicable analogs.

Regulatory frame

Regime
Applies when
Evaluation-evidence shape

OMB M-24-10

All federal agency AI; rights/safety-impacting subset

Pre- and post-deployment testing; continuous monitoring; public inventory

NIST AI RMF (AI 100-1)

Voluntary framework; cited in agency policy

GOVERN/MAP/MEASURE/MANAGE evidence

EO 14110 (AI Safety/Security)

Federal AI use; certain capabilities require reporting

Red-team evidence; safety eval results

FISMA / FedRAMP

Cloud services storing federal info

ATO package; SOC 2 / FedRAMP Moderate or High

Section 508 / WCAG 2.1 AA

All federal digital services

Accessibility scoring on outputs

Privacy Act of 1974

Systems-of-records on US persons

PII handling, SORN, audit log

FOIA (5 USC 552)

Public records released by agency

Exemption citation; redaction quality

NIST SP 800-53 Rev. 5

Federal information systems

Control inventory; continuous monitoring

NIST SP 800-171

DoD CUI handling

CMMC level alignment

EEOC / Title VII / Title VI / ADA / Rehab Act

Federally-funded programs

Disparate impact; reasonable accommodation

State AI laws

State agencies; CO, NY, IL, CA, others

State-specific bias testing, disclosure

GAO bid-protest jurisdiction

Federal procurement decisions

Documented evaluation basis

OMB M-24-10 (Advancing Governance, Innovation, and Risk Management)

Issued March 2024, builds on EO 14110. Key requirements:

  • Each agency designates a Chief AI Officer

  • Minimum practices for rights-impacting AI and safety-impacting AI:

  • Pre- and post-deployment testing with realistic conditions

  • Independent evaluation

  • Risk impact assessment

  • Ongoing monitoring of operational risks

  • Adequate staff training

  • Public AI use case inventory

  • Generative AI specific guardrails

Stratix evaluation evidence supports M-24-10:

  • Pre- and post-deployment scenario suite frozen at deployment + production trace sampling

  • Drift-monitoring dashboards

  • Audit trail per evaluation tied to use case in agency inventory

  • Independent-evaluation tier (separate Stratix project, separate reviewers)

NIST AI RMF (AI 100-1)

Voluntary framework cited by NIST AI 600-1 (Generative AI Profile, July 2024). Agency policies adopt it via FAR clauses or internal directives.

Function-to-evidence mapping covered in eval-patterns.md.

EO 14110

Issued October 2023. Requires:

  • AI safety and security guidelines from NIST

  • Reporting requirements for foundational models above compute thresholds

  • Federal-agency AI use case inventories

  • Critical infrastructure AI safety standards

Most direct operational implication for agencies using Stratix: ensure use cases above the M-24-10 thresholds carry the evaluation evidence the EO requires NIST to define.

FedRAMP / FISMA

For cloud-based AI services serving federal agencies:

  • ATO required at applicable impact level (Low / Moderate / High)

  • FedRAMP authorization handles the underlying cloud; agency ATO covers the application layer

  • Continuous monitoring and POA&M tracking

Stratix posture:

  • Customers needing FedRAMP-authorized deployment should engage Enterprise — talk to [email protected]

  • BYOK custom models for sensitive workloads keep inference within the agency's authorized boundary

Section 508 / WCAG 2.1 AA

For citizen-facing outputs:

  • Plain-language requirement (Plain Writing Act of 2010)

  • Reading-level targets (most agencies set 6th-8th grade)

  • Multilingual parity for limited-English-proficient populations (EO 13166)

  • Screen-reader compatibility for any rendered output

Stratix evaluation evidence:

  • Reading-level scorer applied to every citizen-facing output

  • Per-language judge runs to detect quality drops in non-English

Privacy Act of 1974

For any system-of-records on US persons:

  • Notice requirements (SORN — System of Records Notice)

  • Routine-use disclosure rules

  • Access and correction rights for the subject

Stratix supports:

  • Audit trail of data access

  • Tenant isolation

  • DPA available with Privacy Act commitments

FOIA

5 USC 552. Federal agencies must:

  • Respond within 20 working days

  • Cite specific exemption subsections for any withholding

  • Provide segregable non-exempt portions

State analogs (sunshine laws) often have stricter timelines.

State and local AI laws

Selected examples (non-exhaustive):

  • NYC Local Law 144 — Bias audit for employment decision tools

  • CA AB 2273 — Age-Appropriate Design Code for online services

  • CO SB21-169 — Insurance algorithms (covers state-purchased insurance)

  • IL AI Video Interview Act — Notice and consent for AI in interviews

  • State public-records / sunshine laws — Vary; often shorter deadlines than FOIA

Recommended setup

  1. Enterprise tier with executed agency ATO process where applicable

  2. SSO + RBAC scoped to agency role classifications

  3. Use-case inventory entry per Stratix project; tied to the agency M-24-10 inventory

  4. NIST AI RMF GOVERN evidence package retained per use case

  5. Pre- and post-deployment scenario suite frozen at ATO; production trace sampling configured

  6. Disparate-impact monitoring on every rights-impacting output

  7. Audit retention matching the longer of agency records schedule or 7 years

  8. Public-output reading-level rule applied to citizen-facing outputs

  9. Independent evaluation for rights-impacting AI (separate project + separate reviewers)

See also

PreviousFinancial services scenariosNextGovernment cookbook and samples

Last updated

Was this helpful?