OMB issues M-24-10, first government-wide policy on agency AI risk

The White House Office of Management and Budget (OMB) issued memorandum M-24-10 on agency AI governance, innovation and risk management on 28 March 2024. The White House presented it as OMB's first government-wide policy to mitigate the risks of AI while harnessing its benefits.

What it is

The memo governed federal agencies' own use of AI and marked the 150-day milestone of Executive Order 14110. The White House said it built on the Blueprint for an AI Bill of Rights and the NIST AI Risk Management Framework.

Its life was short. In January 2025, EO 14179 gave OMB 60 days to revise M-24-10, and in April 2025 OMB released two revised policies on federal AI use and procurement.

What it requires

• By 1 December 2024, agencies had to put concrete safeguards in place wherever their AI use could affect people's rights or safety, including assessment, testing and monitoring of impacts and steps against algorithmic discrimination.

• An agency that could not apply the safeguards had to stop using the system, unless its leadership justified that stopping would raise overall risk or impede critical operations.

• Every agency had to designate a Chief AI Officer, and CFO Act agencies had to stand up AI Governance Boards by 27 May 2024.

• Agencies had to disclose any AI exempted by waiver and release government-owned AI code, models and data where doing so posed no risk.

What security leaders should do

• Suppliers to federal agencies should keep evidence of testing, monitoring and impact assessment for their AI features, because those were the practices this memo made routine inside agencies.
• Borrow the structure of a named AI officer plus a cross-functional governance board for private-sector AI oversight.
• Read the successor memos before relying on any M-24-10 deadline, since the memo has been replaced.