OMB M-24-10 (AI governance, risk management, and transparency) and M-24-18 (AI acquisition) establish binding requirements for federal agencies and their contractors -- mapped to 15 SWT3 witness procedures.
Who this is for: Federal Chief AI Officers, AI Governance Board members, agency CIOs and CISOs, federal acquisition professionals (COs and COTRs), AI vendors selling to federal agencies, and compliance teams preparing AI systems for federal use.
IN EFFECT: M-24-10 has been in effect since March 28, 2024. M-24-18 acquisition requirements apply to contracts awarded under solicitations issued on or after March 23, 2025. Federal agencies are actively implementing these requirements.
CRITICAL ASSESSOR NOTICE: SWT3 witness anchors record that a governance event occurred and capture its computational factors. They do not replace assessor judgment. The assessor must independently verify that the substance of each implementation meets OMB requirements. Anchors provide the evidence trail -- the assessor determines whether that evidence is sufficient.
| Field | Detail |
|---|---|
| M-24-10 | Advancing Governance, Innovation, and Risk Management for Agency Use of AI (March 28, 2024) |
| M-24-18 | Advancing the Responsible Acquisition of AI in Government (September 24, 2024) |
| M-24-18 Effective | Applies to solicitations issued on or after March 23, 2025 |
| Scope | All CFO Act agencies and their AI vendors/contractors |
| Key Roles | Chief AI Officer (mandatory), AI Governance Board, Chief Data Officer |
| Impact Assessment | Required before deploying safety-impacting or rights-impacting AI |
| AI Inventory | Annual public AI use case inventory (Section 4) |
| Code Sharing | Proactive sharing of custom-developed AI code and model weights |
| SWT3 Procedures | 15 procedures mapped across 13 namespaces |
OMB Memorandum M-24-10, issued March 28, 2024, is the most comprehensive federal AI governance directive to date. It establishes four pillars of agency AI obligations:
OMB Memorandum M-24-18, issued September 24, 2024, extends AI governance requirements into the federal procurement process. It applies to contracts awarded under solicitations issued on or after March 23, 2025.
| OMB Requirement | Source | Procedure | Description |
|---|---|---|---|
| Chief AI Officer / Governance Board | M-24-10 Sec.3 | AI-GOV.1 | Governance event witnessing |
| AI impact assessment | M-24-10 Sec.5(b) | AI-IMPACT.1 | Impact assessment witnessing |
| AI use case inventory | M-24-10 Sec.4 | AI-TRANS.1 | Transparency disclosure witnessing |
| Bias and equity assessment | M-24-10 Sec.5(c)(iii) | AI-FAIR.1 | Bias detection witnessing |
| Data quality and provenance | M-24-10 Sec.5(c)(i) | AI-DATA.1 | Data governance witnessing |
| Human oversight | M-24-10 Sec.5(c)(iv) | AI-HITL.1 | Human oversight witnessing |
| Monitoring and audit | M-24-10 Sec.5(c)(ii) | AI-AUDIT.1 | Audit integrity witnessing |
| Explainability and notice | M-24-10 Sec.5(c)(v) | AI-EXPL.1 | Explainability witnessing |
| AI lifecycle and code sharing | M-24-10 Sec.6 | AI-LCM.1 | Lifecycle event witnessing |
| AI security controls | M-24-10 Sec.5(c)(vi) | AI-SEC.1 | Security control witnessing |
| AI supply chain risk | M-24-18 Sec.4 | AI-SUPPLY.1 | Supply chain provenance witnessing |
| AI component SBOM | M-24-18 Sec.5 | AI-SBOM.1 | Component transparency witnessing |
| AI identity management | M-24-18 Sec.3(b) | AI-ID.1 | Identity witnessing |
| AI testing and assessment | M-24-18 Sec.3(c) | AI-ASSESS.1 | Assessment witnessing |
| Consent and notice | M-24-18 Sec.3(d) | AI-CONSENT.1 | Consent mechanism witnessing |
OMB requires: Agencies must designate a Chief AI Officer and establish an AI Governance Board. The CAIO must coordinate all AI activities, the board must include cross-functional membership (CIO, CDO, CHCO, senior agency official for privacy, civil rights/liberties officer), and the governance structure must be actively maintained with documented decisions.
How SWT3 addresses it: witnessGovernance() mints an anchor recording each governance event -- board meetings, policy approvals, risk acceptance decisions, CAIO directives. Factor A captures the event type. Factor B records the decision outcome. The anchor chain proves that governance is active and continuous, not a one-time designation. For M-24-18, governance anchors also demonstrate vendor oversight and acquisition review board activity.
Query AI-GOV.1 anchors for the assessment period. Verify that governance meeting cadence is consistent (M-24-10 implies ongoing, not annual). Check that cross-functional participation is reflected in anchor metadata. For agencies, verify CAIO designation predates AI deployment.
OMB requires: Before deploying any safety-impacting or rights-impacting AI, agencies must complete an AI impact assessment covering data quality, bias, human oversight, monitoring, explainability, and security. The assessment must be completed and risk mitigations implemented -- or a waiver obtained from the agency head -- before the AI system goes live.
How SWT3 addresses it: witnessImpact() mints an anchor recording the assessment scope, classification (safety/rights), assessment date, assessor identity, and completion status. The anchor timestamp proves the assessment was completed before deployment. Factor A captures the risk classification. Factor B records whether the system passed, required mitigation, or received a waiver.
The critical verification is temporal: the AI-IMPACT.1 anchor timestamp must predate the first production inference anchor for the same system. If a waiver was obtained, verify the waiver authority matches the agency head or designated official.
OMB requires: Agencies must provide notice and explanation to individuals adversely affected by AI decisions, particularly for rights-impacting AI. Individuals must have a way to contest AI-influenced outcomes and request human review.
How SWT3 addresses it: witnessExplainability() mints an anchor recording the explanation type (model rationale, feature importance, decision factors), recipient category (affected individual, reviewing official, oversight body), and delivery method. The anchor proves that explanations are generated and delivered as required, creating an evidence trail for individual rights requests.
For rights-impacting AI, verify that AI-EXPL.1 anchors exist for every adverse decision. Check that the explanation mechanism is meaningful -- boilerplate disclosures that do not explain the specific decision factors are insufficient under M-24-10.
OMB requires: Under M-24-18, AI vendors must demonstrate supply chain transparency in federal procurements. This includes identifying all third-party AI components, model providers, training data sources, and inference dependencies. Agencies must assess supply chain risk as part of AI acquisition.
How SWT3 addresses it: witnessSupplyChain() mints an anchor recording the component inventory, provider attestation status, risk assessment results, and last review date. For M-24-18 compliance, the anchor chain demonstrates continuous supply chain visibility across the contract period, not just at award time.
Verify that AI-SUPPLY.1 anchors are current (refreshed at least quarterly per M-24-18 guidance). Cross-reference with the contract's AI-specific clauses to confirm all required supply chain disclosures are covered. For multi-tier supply chains, verify that sub-provider attestations cascade through the anchor chain.