> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-3.md). # Government and public sector compliance Government compliance — FedRAMP, FISMA, NIST AI RMF, OMB M-24-10, Section 508, Privacy Act, FOIA, EO 14110. Government AI compliance is **the densest regulatory surface of any sector** — federal procurement, agency-specific rules, executive orders, civil rights statutes, and state/local overlays compound. The frame below covers the federal core; state and local agencies should add applicable analogs. ## Regulatory frame | Regime | Applies when | Evaluation-evidence shape | | ------------------------------------------------- | ------------------------------------------------------ | ------------------------------------------------------------------------- | | **OMB M-24-10** | All federal agency AI; rights/safety-impacting subset | Pre- and post-deployment testing; continuous monitoring; public inventory | | **NIST AI RMF (AI 100-1)** | Voluntary framework; cited in agency policy | GOVERN/MAP/MEASURE/MANAGE evidence | | **EO 14110 (AI Safety/Security)** | Federal AI use; certain capabilities require reporting | Red-team evidence; safety eval results | | **FISMA / FedRAMP** | Cloud services storing federal info | ATO package; SOC 2 / FedRAMP Moderate or High | | **Section 508 / WCAG 2.1 AA** | All federal digital services | Accessibility scoring on outputs | | **Privacy Act of 1974** | Systems-of-records on US persons | PII handling, SORN, audit log | | **FOIA (5 USC 552)** | Public records released by agency | Exemption citation; redaction quality | | **NIST SP 800-53 Rev. 5** | Federal information systems | Control inventory; continuous monitoring | | **NIST SP 800-171** | DoD CUI handling | CMMC level alignment | | **EEOC / Title VII / Title VI / ADA / Rehab Act** | Federally-funded programs | Disparate impact; reasonable accommodation | | **State AI laws** | State agencies; CO, NY, IL, CA, others | State-specific bias testing, disclosure | | **GAO bid-protest jurisdiction** | Federal procurement decisions | Documented evaluation basis | ## OMB M-24-10 (Advancing Governance, Innovation, and Risk Management) Issued March 2024, builds on EO 14110. Key requirements: * Each agency designates a Chief AI Officer * Minimum practices for **rights-impacting AI** and **safety-impacting AI**: * Pre- and post-deployment testing with realistic conditions * Independent evaluation * Risk impact assessment * Ongoing monitoring of operational risks * Adequate staff training * Public AI use case inventory * Generative AI specific guardrails **Stratix evaluation evidence supports M-24-10:** * Pre- and post-deployment scenario suite frozen at deployment + production trace sampling * Drift-monitoring dashboards * Audit trail per evaluation tied to use case in agency inventory * Independent-evaluation tier (separate Stratix project, separate reviewers) ## NIST AI RMF (AI 100-1) Voluntary framework cited by NIST AI 600-1 (Generative AI Profile, July 2024). Agency policies adopt it via FAR clauses or internal directives. Function-to-evidence mapping covered in [eval-patterns.md](/more-in-this-section-2/eval-patterns-3.md). ## EO 14110 Issued October 2023. Requires: * AI safety and security guidelines from NIST * Reporting requirements for foundational models above compute thresholds * Federal-agency AI use case inventories * Critical infrastructure AI safety standards Most direct operational implication for agencies using Stratix: ensure use cases above the M-24-10 thresholds carry the evaluation evidence the EO requires NIST to define. ## FedRAMP / FISMA For cloud-based AI services serving federal agencies: * ATO required at applicable impact level (Low / Moderate / High) * FedRAMP authorization handles the underlying cloud; agency ATO covers the application layer * Continuous monitoring and POA\&M tracking **Stratix posture:** * Customers needing FedRAMP-authorized deployment should engage Enterprise — talk to * BYOK custom models for sensitive workloads keep inference within the agency's authorized boundary ## Section 508 / WCAG 2.1 AA For citizen-facing outputs: * Plain-language requirement (Plain Writing Act of 2010) * Reading-level targets (most agencies set 6th-8th grade) * Multilingual parity for limited-English-proficient populations (EO 13166) * Screen-reader compatibility for any rendered output **Stratix evaluation evidence:** * Reading-level scorer applied to every citizen-facing output * Per-language judge runs to detect quality drops in non-English ## Privacy Act of 1974 For any system-of-records on US persons: * Notice requirements (SORN — System of Records Notice) * Routine-use disclosure rules * Access and correction rights for the subject **Stratix supports:** * Audit trail of data access * Tenant isolation * DPA available with Privacy Act commitments ## FOIA 5 USC 552. Federal agencies must: * Respond within 20 working days * Cite specific exemption subsections for any withholding * Provide segregable non-exempt portions State analogs (sunshine laws) often have stricter timelines. ## State and local AI laws Selected examples (non-exhaustive): * **NYC Local Law 144** — Bias audit for employment decision tools * **CA AB 2273** — Age-Appropriate Design Code for online services * **CO SB21-169** — Insurance algorithms (covers state-purchased insurance) * **IL AI Video Interview Act** — Notice and consent for AI in interviews * **State public-records / sunshine laws** — Vary; often shorter deadlines than FOIA ## Recommended setup 1. Enterprise tier with executed agency ATO process where applicable 2. SSO + RBAC scoped to agency role classifications 3. Use-case inventory entry per Stratix project; tied to the agency M-24-10 inventory 4. NIST AI RMF GOVERN evidence package retained per use case 5. Pre- and post-deployment scenario suite frozen at ATO; production trace sampling configured 6. Disparate-impact monitoring on every rights-impacting output 7. Audit retention matching the longer of agency records schedule or 7 years 8. Public-output reading-level rule applied to citizen-facing outputs 9. Independent evaluation for rights-impacting AI (separate project + separate reviewers) ## See also * [Government scenarios](/more-in-this-section-2/scenarios-3.md) * [Government eval patterns](/more-in-this-section-2/eval-patterns-3.md) * [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md) * [Enterprise](/4.2-industry-use-cases/government-public-sector.md) * [BYOK custom models](/5.-select-pick-the-model/byok-custom-models.md)