> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-3.md). # Government and public sector compliance Government AI compliance is **the densest regulatory surface of any sector** — federal procurement, agency-specific rules, executive orders, civil rights statutes, and state/local overlays compound. The frame below covers the federal core; state and local agencies should add applicable analogs. ## Regulatory frame | Regime | Applies when | Evaluation-evidence shape | | ------------------------------------------------- | ------------------------------------------------------ | ------------------------------------------------------------------------- | | **OMB M-24-10** | All federal agency AI; rights/safety-impacting subset | Pre- and post-deployment testing; continuous monitoring; public inventory | | **NIST AI RMF (AI 100-1)** | Voluntary framework; cited in agency policy | GOVERN/MAP/MEASURE/MANAGE evidence | | **EO 14110 (AI Safety/Security)** | Federal AI use; certain capabilities require reporting | Red-team evidence; safety eval results | | **FISMA / FedRAMP** | Cloud services storing federal info | ATO package; SOC 2 / FedRAMP Moderate or High | | **Section 508 / WCAG 2.1 AA** | All federal digital services | Accessibility scoring on outputs | | **Privacy Act of 1974** | Systems-of-records on US persons | PII handling, SORN, audit log | | **FOIA (5 USC 552)** | Public records released by agency | Exemption citation; redaction quality | | **NIST SP 800-53 Rev. 5** | Federal information systems | Control inventory; continuous monitoring | | **NIST SP 800-171** | DoD CUI handling | CMMC level alignment | | **EEOC / Title VII / Title VI / ADA / Rehab Act** | Federally-funded programs | Disparate impact; reasonable accommodation | | **State AI laws** | State agencies; CO, NY, IL, CA, others | State-specific bias testing, disclosure | | **GAO bid-protest jurisdiction** | Federal procurement decisions | Documented evaluation basis | ## OMB M-24-10 (Advancing Governance, Innovation, and Risk Management) Issued March 2024, builds on EO 14110. Key requirements: * Each agency designates a Chief AI Officer * Minimum practices for **rights-impacting AI** and **safety-impacting AI**: * Pre- and post-deployment testing with realistic conditions * Independent evaluation * Risk impact assessment * Ongoing monitoring of operational risks * Adequate staff training * Public AI use case inventory * Generative AI specific guardrails **Stratix evaluation evidence supports M-24-10:** * Pre- and post-deployment scenario suite frozen at deployment + production trace sampling * Drift-monitoring dashboards * Audit trail per evaluation tied to use case in agency inventory * Independent-evaluation tier (separate Stratix project, separate reviewers) ## NIST AI RMF (AI 100-1) Voluntary framework cited by NIST AI 600-1 (Generative AI Profile, July 2024). Agency policies adopt it via FAR clauses or internal directives. Function-to-evidence mapping covered in [eval-patterns.md](/more-in-this-section-2/eval-patterns-3.md). ## EO 14110 Issued October 2023. Requires: * AI safety and security guidelines from NIST * Reporting requirements for foundational models above compute thresholds * Federal-agency AI use case inventories * Critical infrastructure AI safety standards Most direct operational implication for agencies using Stratix: ensure use cases above the M-24-10 thresholds carry the evaluation evidence the EO requires NIST to define. ## FedRAMP / FISMA For cloud-based AI services serving federal agencies: * ATO required at applicable impact level (Low / Moderate / High) * FedRAMP authorization handles the underlying cloud; agency ATO covers the application layer * Continuous monitoring and POA\&M tracking **Stratix posture:** * Customers needing FedRAMP-authorized deployment should engage Enterprise — talk to * BYOK custom models for sensitive workloads keep inference within the agency's authorized boundary ## Section 508 / WCAG 2.1 AA For citizen-facing outputs: * Plain-language requirement (Plain Writing Act of 2010) * Reading-level targets (most agencies set 6th-8th grade) * Multilingual parity for limited-English-proficient populations (EO 13166) * Screen-reader compatibility for any rendered output **Stratix evaluation evidence:** * Reading-level scorer applied to every citizen-facing output * Per-language judge runs to detect quality drops in non-English ## Privacy Act of 1974 For any system-of-records on US persons: * Notice requirements (SORN — System of Records Notice) * Routine-use disclosure rules * Access and correction rights for the subject **Stratix supports:** * Audit trail of data access * Tenant isolation * DPA available with Privacy Act commitments ## FOIA 5 USC 552. Federal agencies must: * Respond within 20 working days * Cite specific exemption subsections for any withholding * Provide segregable non-exempt portions State analogs (sunshine laws) often have stricter timelines. ## State and local AI laws Selected examples (non-exhaustive): * **NYC Local Law 144** — Bias audit for employment decision tools * **CA AB 2273** — Age-Appropriate Design Code for online services * **CO SB21-169** — Insurance algorithms (covers state-purchased insurance) * **IL AI Video Interview Act** — Notice and consent for AI in interviews * **State public-records / sunshine laws** — Vary; often shorter deadlines than FOIA ## Recommended setup 1. Enterprise tier with executed agency ATO process where applicable 2. SSO + RBAC scoped to agency role classifications 3. Use-case inventory entry per Stratix project; tied to the agency M-24-10 inventory 4. NIST AI RMF GOVERN evidence package retained per use case 5. Pre- and post-deployment scenario suite frozen at ATO; production trace sampling configured 6. Disparate-impact monitoring on every rights-impacting output 7. Audit retention matching the longer of agency records schedule or 7 years 8. Public-output reading-level rule applied to citizen-facing outputs 9. Independent evaluation for rights-impacting AI (separate project + separate reviewers) ## See also * [Government scenarios](/more-in-this-section-2/scenarios-3.md) * [Government eval patterns](/more-in-this-section-2/eval-patterns-3.md) * [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md) * [Enterprise](/4.2-industry-use-cases/government-public-sector.md) * [BYOK custom models](/5.-select-pick-the-model/byok-custom-models.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.layerlens.ai/more-in-this-section-2/compliance-3.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.