Federal AI Compliance Landscape

The US federal AI compliance landscape consists of 94 government-wide requirements (as of July 2025) drawn from five laws, six executive orders, and three OMB guidance documents, alongside 10 executive-branch oversight and advisory bodies. A 2025 GAO audit found that only 4 of 35 recommendations it had made to agencies roughly 18 months earlier had been implemented, a gap between stated requirements and agency compliance that the Government Accountability Office documented across multiple agencies (Source: GAO-25-107933: AI Federal Efforts Guided by Requirements and Advisory Groups).

Statutory foundation

Five enacted laws supply the statutory basis for federal AI governance:

Executive orders

Successive administrations have produced a layered set of executive orders, spanning the first Trump administration, the Biden administration, and the second Trump administration:

(Sources: Executive Order 13859 — Maintaining American Leadership in Artificial Intelligence, Executive Order 14110 — Safe, Secure, and Trustworthy AI, Executive Order 14179 — Removing Barriers to American Leadership in Artificial Intelligence, Executive Order 14319 — Preventing Woke AI in the Federal Government, Executive Order 14320 — Promoting the Export of the American AI Technology Stack)

OMB guidance

OMB issues binding guidance that operationalizes the executive orders:

(Sources: OMB Memorandum M-24-10, OMB Memorandum M-24-18, OMB M-25-21 — Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, OMB M-25-22 — Driving Efficient Acquisition of Artificial Intelligence in Government)

Agency requirements

As of July 2025, all federal agencies are required to:

1. Prepare, share, and publish annual AI use case inventories (ongoing).
2. Appoint a Chief AI Officer (CAIO) at every agency.
3. Publicly release an AI strategy, due September 30, 2025.
4. Adhere to AI acquisition guidance per M-25-22 by September 30, 2025.
5. Ensure contracts for LLMs comply with the EO 14319 unbiased-AI principles (ideological neutrality).
6. Adopt generative AI policies, required under M-25-21.

Agency interpretation of the high-impact standard

M-25-21 turns on whether an AI system's output "serves as a principal basis for decisions or actions with legal, material, binding, or significant effect" on six enumerated interests, and separately designates categories of use as presumed high-impact. Because the memorandum leaves the "principal basis" element to be applied case by case, individual agencies have begun issuing their own readings of how it applies within their domains, and those readings determine whether the minimum risk-management practices of M-25-21 § 4(b) attach.

The first sustained example is the Office of Personnel Management memorandum of August 27, 2026, Use of Artificial Intelligence in the Federal Hiring Process. Determination of the terms or conditions of federal employment — including pre-employment screening, hiring, and reasonable accommodation — sits in M-25-21's presumed-high-impact list, and OPM records that agencies were defaulting to treating any hiring use of AI as high-impact on that basis. The memorandum concludes that four categories of hiring use are generally not high-impact: drafting job opportunity announcements, decision support for applicant-level evaluations, pre-offer quality control, and aggregate hiring-program evaluation. Its reasoning is that where an appropriate official independently reviews the supporting data, evaluates the decisional logic, and adopts the AI-assisted product, the official's review rather than the AI output supplies the decision's justification — a reading OPM states is not an exemption for human oversight as such, since an output "may serve as a principal basis even where a human formally approves the result." Where officials ratify AI outputs without independent review of the underlying record, or where AI is the sole scoring instrument without a reviewable basis for certification, the memorandum directs that the use be treated as high-impact. The memorandum states that it does not modify M-25-21 and that M-25-21 controls in the event of inconsistency (OPM Memorandum — Use of Artificial Intelligence in the Federal Hiring Process (August 2026); nextgov.com).

Appendix A of the memorandum states the test in its most transferable form, and the formulation is not confined to hiring: "The inquiry is functional, not formal: identify what in fact supplies the justification for the decision or action in the documented workflow." It adds that "a high-impact determination is possible whether there is or is not human oversight," and that "asserted human validation or review does not, by itself, remove a use from the definition" — what matters is whether the documented record shows the official's independent judgment supplied the justification. The memorandum also names the textual hook it relies on, M-25-21's own footnote 27, which contemplates AI being "integrated in decision or activity pipelines in high-impact categories without meeting the definition of high-impact" (OPM Memorandum — Use of Artificial Intelligence in the Federal Hiring Process (August 2026)). See Meaningful Human Review.

Agencies making a non-high-impact determination for a presumed high-impact use must document it in writing to their Chief AI Officer; agencies retaining a high-impact designation must either implement the § 4(b) practices or seek a CAIO waiver. That documentation-and-waiver path places the CAIO, rather than OMB, at the point where the standard is applied in practice.

Oversight bodies

GAO-25-107933 identifies 10 executive-branch oversight and advisory bodies:

Implementation gap

GAO's 2023 report (GAO-24-105980) made 35 recommendations to 19 agencies to implement federal AI requirements. By July 2025 (GAO-25-107933), 4 had been implemented — at OPM (AI rotational programs), DOT (consistency plan to OMB), and two others — while 31 remained unimplemented across 16 agencies. OMB declined to respond to GAO's request for comment, which GAO noted given that OMB has 15 requirements of its own. GAO characterized the result as a gap in which requirements exist but enforcement is weak (Source: GAO-25-107933: AI Federal Efforts Guided by Requirements and Advisory Groups).

Policy reorientation across administrations

The 2025 policy changes — EO 14148 rescinding EO 14110, and M-25-21/22 replacing M-24-10/18 — shifted the stated emphasis of federal AI policy from the safety and risk-management framing of the Biden-era documents toward an innovation and acceleration framing under the second Trump administration. Many of the underlying statutory requirements survive the EO changes, while their interpretation and implementation priorities shift.

EO 14319's unbiased-AI principles for LLM procurement create a potential tension with AI safety research that involves studying model outputs with ideological content. The requirement that vendors disclose system prompts, rather than model weights, establishes a transparency obligation in government procurement that also functions as a negotiating point.

Federal and state interaction

EO 14365 (December 2025) targets state AI laws for federal preemption. State attorney general guidance documents from California, New Jersey, Massachusetts, and Oregon constitute a concurrent state-level enforcement layer, producing a fragmented compliance picture for companies operating across multiple states (Sources: State AG AI Guidances (CA, NJ, MA, OR), Techno-Federalism: How Regulatory Fragmentation Shapes the U.S.-China AI Race).

Relationships

• instance-of: Regulatory Typology: Self-Regulation, Co-Regulation, Traditional Government Regulation — traditional regulation with statutory requirements
• related: Government AI Procurement, Federal AI Adoption — Patterns and Tensions
• depends-on: Executive Order 14179 — Removing Barriers to American Leadership in Artificial Intelligence, Executive Order 14319 — Preventing Woke AI in the Federal Government, OMB M-25-21 — Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, OMB M-25-22 — Driving Efficient Acquisition of Artificial Intelligence in Government
• related: Government Accountability Office (GAO), National AI Advisory Committee (NAIAC), National Institute of Standards and Technology (NIST), GSA — General Services Administration (AI Deployer), OPM — Office of Personnel Management (AI Deployer)
• contradicts (partially): Techno-Federalism — federal preemption push vs. state AG enforcement; unresolved tension
• supports: GAO-25-107933: AI Federal Efforts Guided by Requirements and Advisory Groups