Each card gives the rule, its status, the words that matter and our part in the work. Your agency makes the determinations; we provide the evidence and the documentation.
U.S. federal (executive agencies)Key date: April 3, 2025
OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust
In force; rescinds and replaces M-24-10. Minimum practices for high-impact AI were due within 365 days (April 3, 2026).
“the intended purpose for the AI and its expected benefit, supported by specific metrics or qualitative analysis”
What we do: We produce the evidence an AI impact assessment asks for: the expected benefit against the current process, the costs and expected savings, the pre-deployment test results and the monitoring plan, and your agency's reviewers make the determinations.
Source: OMB M-25-21 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federalKey date: April 8, 2025
OMB Circular A-94 (1992), reinstated by OMB M-25-23
In force: M-25-23 (April 8, 2025) revoked the 2023 Circular and reinstated the October 29, 1992 Circular with appendices A and B.
“The net present value of such investments should be evaluated with the 7 percent real discount rate discussed in Section 8.b. unless the analysis is able to allocate the investment's costs between provision of Federal cost savings and external social benefits.”
What we do: Our business cases compute net present value at the discount rates the Circular prescribes and show federal savings and public benefits separately.
Source: OMB Circular A-94 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federal (voluntary framework; named by Texas law)Key date: January 26, 2023
NIST AI Risk Management Framework (AI RMF 1.0) and the Generative AI Profile (NIST AI 600-1)
AI RMF 1.0 released January 26, 2023 and being revised under the AI Action Plan; NIST AI 600-1 released July 26, 2024.
“The AI RMF 1.0 is being revised as part of the White House AI Action Plan.”
What we do: We map the delivery to the NIST AI RMF and its Generative AI Profile, and keep the risk screen, the test results and the review records with your team.
Source: NIST AI Risk Management Framework (nist.gov) (opens in a new tab) · Checked November 10, 2026
U.S. federal (FedRAMP)Key date: February 25, 2026
FedRAMP Certification Classes (Notice 0004 and the agency guidance on classes)
In force under the Consolidated Rules for 2026 (launched June 24, 2026; mandatory January 1, 2027), as announced in Notice 0004 of February 25, 2026: four classes from Class A (minimal assurance) to Class D; Class B includes the current LI-SaaS and Low baselines, Class C the Moderate baseline and Class D the High baseline; classes are not one-for-one replacements for impact levels.
“Agencies should not treat Certification Classes as one-for-one replacements for Low, Moderate, or High impact levels.”
What we do: Your agency categorizes the system first, and the blueprint then records, for each workload, the cloud service and the FedRAMP class it holds, ready for your agency's risk decision.
Source: FedRAMP Certification Classes (fedramp.gov) (opens in a new tab) · Checked November 12, 2026
Texas (state agencies and local governments)Key date: September 1, 2025
Texas SB 1964: heightened scrutiny AI systems, the AI code of ethics and vendor duties (Gov. Code §§2054.003, 2054.702, 2054.703, 2054.708)
In force since September 1, 2025; DIR's implementing rules (1 TAC chapter 219: the AI code of ethics, the risk and impact assessments and the vendor risk-framework requirement) took effect March 18, 2026, and DIR publishes the standardized notice form (AI System Facts).
“A state agency that deploys or uses a heightened scrutiny artificial intelligence system or a vendor that contracts with a state agency for the deployment or use of a heightened scrutiny artificial intelligence system shall conduct a system assessment that outlines:”
What we do: When a system will make, or be a controlling factor in, a decision about access to a government service, we document whether it meets the heightened-scrutiny definition for your agency's inventory, draft the risk assessment DIR's rules ask for, write the impact assessment Texas asks of a state agency and its vendor (or the review a local government completes), and prepare DIR's standardized notice for your agency to publish.
Source: Texas SB 1964 (capitol.texas.gov) (opens in a new tab) · Checked November 10, 2026