icdev 0.0.3__py3-none-any.whl

context/compliance/omb_m25_21_high_impact_ai.json

@@ -0,0 +1,248 @@
+{
+  "metadata": {
+    "title": "OMB Memorandum M-25-21 — Advancing the Responsible Acquisition and Governance of Artificial Intelligence",
+    "source": "Office of Management and Budget, M-25-21, November 2025",
+    "classification": "CUI // SP-CTI",
+    "version": "1.0",
+    "last_updated": "2026-02-23",
+    "description": "OMB M-25-21 requirements for federal agencies on high-impact AI classification, risk management, transparency, human oversight, and annual reporting. Maps to NIST 800-53 Rev 5 controls via crosswalk for multi-regime deduplication (D113). Supersedes portions of M-24-10."
+  },
+  "categories": [
+    {
+      "id": "INVENTORY",
+      "title": "AI Use Case Inventory",
+      "description": "Agencies must maintain and publicly release an inventory of AI use cases",
+      "requirement_count": 3
+    },
+    {
+      "id": "CLASSIFICATION",
+      "title": "High-Impact AI Classification",
+      "description": "Agencies must identify and classify AI systems as high-impact based on safety, rights, and civil liberties criteria",
+      "requirement_count": 4
+    },
+    {
+      "id": "RISK_MGMT",
+      "title": "Risk Management",
+      "description": "Agencies must implement risk management practices for all AI systems, with enhanced requirements for high-impact AI",
+      "requirement_count": 4
+    },
+    {
+      "id": "OVERSIGHT",
+      "title": "Human Oversight and Accountability",
+      "description": "Agencies must ensure adequate human oversight, appeal processes, and accountability structures",
+      "requirement_count": 4
+    }
+  ],
+  "requirements": [
+    {
+      "id": "M25-INV-1",
+      "family": "AI Use Case Inventory",
+      "title": "Maintain AI Use Case Inventory",
+      "description": "Agencies shall maintain a comprehensive inventory of AI use cases, updated at least annually. The inventory must include each AI system's name, purpose, deployment status, operational domain, data sources, and responsible official. Agencies shall make the inventory publicly available, excluding classified or sensitive use cases that may be reported separately to OMB.",
+      "evidence_required": "Published AI use case inventory, evidence of annual update cadence, inventory completeness review records.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["PM-5", "PM-7", "PL-2"],
+      "key_actions": [
+        "Create and maintain AI use case inventory",
+        "Publish inventory publicly (unclassified portions)",
+        "Establish annual update cycle"
+      ]
+    },
+    {
+      "id": "M25-INV-2",
+      "family": "AI Use Case Inventory",
+      "title": "AI Component Registration",
+      "description": "Each AI component in the organization's portfolio shall be individually registered with metadata including: model name and version, intended purpose, training data provenance summary, risk classification, deployment date, date of last risk assessment, human oversight role designation, and contact information for the responsible official.",
+      "evidence_required": "AI component registration records, metadata completeness audit, responsible official designations.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["CM-8", "PM-5", "SA-4"],
+      "key_actions": [
+        "Register each AI component with required metadata",
+        "Assign responsible official per component",
+        "Track deployment and assessment dates"
+      ]
+    },
+    {
+      "id": "M25-INV-3",
+      "family": "AI Use Case Inventory",
+      "title": "Annual AI Reporting to OMB",
+      "description": "Agencies shall submit annual reports to OMB on AI use, including metrics on high-impact AI systems, risk management activities, compliance status, and any incidents or unintended consequences. Reports must include both quantitative metrics and qualitative assessments of AI governance maturity.",
+      "evidence_required": "Annual AI report submissions to OMB, incident log, compliance metrics dashboard, governance maturity self-assessment.",
+      "priority": "P2",
+      "nist_800_53_crosswalk": ["PM-9", "CA-7", "AU-6"],
+      "key_actions": [
+        "Compile annual AI metrics report",
+        "Track and report AI incidents",
+        "Self-assess AI governance maturity"
+      ]
+    },
+    {
+      "id": "M25-CLS-1",
+      "family": "High-Impact AI Classification",
+      "title": "High-Impact AI Identification Criteria",
+      "description": "Agencies shall classify AI systems as high-impact when they are used in or directly support decisions that have a significant effect on: (1) individual or community safety, (2) civil rights or civil liberties, (3) access to critical resources or services including healthcare, housing, education, employment, or financial services, or (4) privacy. Classification decisions must be documented with rationale and reviewed at least annually.",
+      "evidence_required": "High-impact classification determinations, classification criteria documentation, annual review records, classification rationale.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["RA-2", "RA-3", "PM-9"],
+      "key_actions": [
+        "Apply high-impact classification criteria to all AI systems",
+        "Document classification rationale",
+        "Conduct annual classification review"
+      ]
+    },
+    {
+      "id": "M25-CLS-2",
+      "family": "High-Impact AI Classification",
+      "title": "Safety-Impacting AI Designation",
+      "description": "AI systems that directly control or materially inform decisions affecting physical safety of individuals shall be designated as safety-impacting. Safety-impacting AI requires additional safeguards including independent testing, fallback mechanisms, real-time monitoring, and documented failure mode analysis.",
+      "evidence_required": "Safety-impacting AI designation records, independent test results, fallback mechanism documentation, failure mode analysis.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["RA-3", "RA-5", "SI-4", "CP-2"],
+      "key_actions": [
+        "Identify safety-impacting AI systems",
+        "Conduct independent safety testing",
+        "Document failure modes and fallback mechanisms"
+      ]
+    },
+    {
+      "id": "M25-CLS-3",
+      "family": "High-Impact AI Classification",
+      "title": "Rights-Impacting AI Designation",
+      "description": "AI systems that directly affect individual rights, access to services, or civil liberties shall be designated as rights-impacting. Rights-impacting AI requires bias testing, human review of adverse decisions, appeal mechanisms, and transparency notices to affected individuals.",
+      "evidence_required": "Rights-impacting designation records, bias testing results, human review process documentation, appeal mechanism documentation, transparency notice templates.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["AC-6", "AU-2", "PM-15", "IR-4"],
+      "key_actions": [
+        "Identify rights-impacting AI systems",
+        "Implement bias testing protocols",
+        "Establish human review and appeal processes"
+      ]
+    },
+    {
+      "id": "M25-CLS-4",
+      "family": "High-Impact AI Classification",
+      "title": "Minimal-Risk AI Documentation",
+      "description": "AI systems not classified as high-impact shall still be documented in the inventory with basic metadata, undergo periodic review for classification changes, and comply with baseline risk management practices. Minimal-risk designation does not exempt systems from inventory, monitoring, or governance requirements.",
+      "evidence_required": "Minimal-risk classification records, periodic review schedule, baseline risk management evidence.",
+      "priority": "P2",
+      "nist_800_53_crosswalk": ["PM-5", "CA-7", "PL-2"],
+      "key_actions": [
+        "Document minimal-risk classification",
+        "Schedule periodic classification reviews",
+        "Apply baseline risk management"
+      ]
+    },
+    {
+      "id": "M25-RISK-1",
+      "family": "Risk Management",
+      "title": "AI Risk Assessment Process",
+      "description": "Agencies shall conduct risk assessments for all AI systems commensurate with their impact classification. Risk assessments shall evaluate: technical performance risks, bias and fairness risks, privacy risks, security risks, and operational risks. High-impact AI systems require formal risk assessments documented in accordance with NIST AI RMF principles, updated at least annually or upon significant system changes.",
+      "evidence_required": "AI risk assessment reports, risk register, risk assessment update schedule, NIST AI RMF alignment documentation.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["RA-3", "RA-5", "PM-9", "CA-2"],
+      "key_actions": [
+        "Conduct formal AI risk assessments",
+        "Maintain AI risk register",
+        "Align with NIST AI RMF"
+      ]
+    },
+    {
+      "id": "M25-RISK-2",
+      "family": "Risk Management",
+      "title": "AI Testing and Evaluation",
+      "description": "Agencies shall test AI systems before deployment and conduct ongoing evaluation during operation. Testing shall include performance benchmarking, bias and fairness testing, adversarial testing, and privacy impact assessment. High-impact AI requires independent third-party testing or red-team evaluation.",
+      "evidence_required": "Pre-deployment test results, performance benchmarks, bias testing results, adversarial test results, privacy impact assessment, third-party test reports (for high-impact).",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["CA-2", "CA-8", "SA-11", "RA-5"],
+      "key_actions": [
+        "Test AI systems before deployment",
+        "Conduct bias and adversarial testing",
+        "Obtain independent testing for high-impact AI"
+      ]
+    },
+    {
+      "id": "M25-RISK-3",
+      "family": "Risk Management",
+      "title": "AI Continuous Monitoring",
+      "description": "Agencies shall implement continuous monitoring for deployed AI systems to detect performance degradation, model drift, emerging biases, and security threats. Monitoring shall include automated alerting, periodic performance reviews, and defined thresholds for intervention or system deactivation.",
+      "evidence_required": "Monitoring system documentation, alerting configuration, performance review records, drift detection reports, intervention threshold documentation.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["CA-7", "SI-4", "AU-6", "IR-4"],
+      "key_actions": [
+        "Deploy continuous AI monitoring",
+        "Configure automated alerts for drift and degradation",
+        "Define intervention thresholds"
+      ]
+    },
+    {
+      "id": "M25-RISK-4",
+      "family": "Risk Management",
+      "title": "AI Incident Response",
+      "description": "Agencies shall establish AI-specific incident response procedures integrated with existing cyber incident response plans. Procedures shall address AI-specific incidents including model poisoning, adversarial attacks, unintended bias discovery, privacy breaches from AI inference, and system failures causing harm. Post-incident reviews shall update risk assessments and inform future risk management.",
+      "evidence_required": "AI incident response plan, incident log, post-incident review reports, risk assessment updates from incidents.",
+      "priority": "P2",
+      "nist_800_53_crosswalk": ["IR-1", "IR-4", "IR-5", "IR-8"],
+      "key_actions": [
+        "Establish AI incident response procedures",
+        "Integrate with existing cyber IR plans",
+        "Conduct post-incident reviews"
+      ]
+    },
+    {
+      "id": "M25-OVR-1",
+      "family": "Human Oversight and Accountability",
+      "title": "Human Oversight Requirement",
+      "description": "Agencies shall ensure meaningful human oversight for high-impact AI systems. Human oversight includes the ability to understand AI system outputs, override automated decisions, intervene in real-time when necessary, and deactivate the system if it poses unacceptable risk. The level of human oversight shall be proportional to the system's impact classification and the reversibility of its decisions.",
+      "evidence_required": "Human oversight plan, override capability documentation, operator training records, intervention procedure documentation.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["AC-6", "AU-2", "PM-10", "SA-8"],
+      "key_actions": [
+        "Define human oversight roles for each high-impact AI system",
+        "Document override and intervention capabilities",
+        "Train human operators"
+      ]
+    },
+    {
+      "id": "M25-OVR-2",
+      "family": "Human Oversight and Accountability",
+      "title": "Transparency and Notice",
+      "description": "Agencies shall provide clear and accessible notice to individuals when AI is used to make or materially support decisions that affect them. Notice shall include: that AI is being used, what information the AI considers, how to request human review, and how to appeal adverse decisions. Transparency notices shall be provided in plain language appropriate for the affected population.",
+      "evidence_required": "Transparency notice templates, evidence of notice delivery, plain language review, accessibility compliance.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["PM-15", "AC-8", "PL-4"],
+      "key_actions": [
+        "Create transparency notice templates",
+        "Deliver notices to affected individuals",
+        "Ensure plain language and accessibility"
+      ]
+    },
+    {
+      "id": "M25-OVR-3",
+      "family": "Human Oversight and Accountability",
+      "title": "Appeal and Redress Process",
+      "description": "Agencies shall establish and maintain accessible processes for individuals to appeal AI-assisted decisions and seek redress. Appeal processes shall include: clear instructions for filing appeals, timely human review of appealed decisions, the ability to provide additional information or context, and notification of appeal outcomes. Appeals of high-impact AI decisions must receive human review independent of the original AI-assisted decision maker.",
+      "evidence_required": "Appeal process documentation, appeal submission mechanism, appeal review records, outcome notification records, independent reviewer designation (for high-impact).",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["IR-4", "PM-15", "AU-6"],
+      "key_actions": [
+        "Establish appeal process for AI-assisted decisions",
+        "Ensure timely human review of appeals",
+        "Designate independent reviewers for high-impact decisions"
+      ]
+    },
+    {
+      "id": "M25-OVR-4",
+      "family": "Human Oversight and Accountability",
+      "title": "Chief AI Officer Designation",
+      "description": "Agencies shall designate a Chief AI Officer (CAIO) or equivalent senior official responsible for coordinating AI governance, overseeing the AI use case inventory, ensuring compliance with AI policies, managing AI risk, and serving as the primary point of contact for OMB on AI matters. The CAIO shall have sufficient authority, resources, and access to agency leadership to fulfill these responsibilities.",
+      "evidence_required": "CAIO designation letter, role and responsibilities documentation, organizational chart showing reporting structure, evidence of resource allocation.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["PM-2", "PM-10", "PM-1"],
+      "key_actions": [
+        "Designate Chief AI Officer",
+        "Define CAIO roles and authority",
+        "Ensure adequate resources for AI governance"
+      ]
+    }
+  ]
+}

context/compliance/omb_m26_04_unbiased_ai.json

@@ -0,0 +1,262 @@
+{
+  "metadata": {
+    "title": "OMB Memorandum M-26-04 — Advancing Unbiased and Transparent Artificial Intelligence in the Federal Government",
+    "source": "Office of Management and Budget, M-26-04, January 2026",
+    "classification": "CUI // SP-CTI",
+    "version": "1.0",
+    "last_updated": "2026-02-23",
+    "description": "OMB M-26-04 requirements for federal agencies on model cards, system cards, bias testing, fairness metrics, disparity analysis, human review processes, and documentation standards. Builds on M-25-21 and EO 13960 'Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government.' Maps to NIST 800-53 Rev 5 controls via crosswalk for multi-regime deduplication (D113)."
+  },
+  "categories": [
+    {
+      "id": "MODEL_DOCS",
+      "title": "Model Documentation",
+      "description": "Requirements for model cards and system cards documenting AI components",
+      "requirement_count": 4
+    },
+    {
+      "id": "BIAS_FAIRNESS",
+      "title": "Bias and Fairness",
+      "description": "Requirements for bias testing, fairness metrics, and disparity analysis",
+      "requirement_count": 5
+    },
+    {
+      "id": "HUMAN_REVIEW",
+      "title": "Human Review and Appeal",
+      "description": "Requirements for human-in-the-loop review and appeal processes",
+      "requirement_count": 4
+    },
+    {
+      "id": "IMPACT_ASSESS",
+      "title": "Impact Assessment",
+      "description": "Requirements for pre-deployment and ongoing impact assessments",
+      "requirement_count": 3
+    }
+  ],
+  "requirements": [
+    {
+      "id": "M26-DOC-1",
+      "family": "Model Documentation",
+      "title": "Model Card Generation",
+      "description": "Agencies shall produce a model card for each AI/ML model deployed in production systems. Model cards shall follow the format established by Mitchell et al. (2019) as adapted for federal use, and include: model details (name, version, type, architecture), intended use (primary use cases, out-of-scope uses), training data (sources, preprocessing, known limitations), evaluation data and metrics, ethical considerations, and caveats and limitations. Model cards must be updated when models are retrained, fine-tuned, or significantly modified.",
+      "evidence_required": "Model card documents for each deployed model, model card update history, model card review and approval records.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["PL-2", "SA-4", "CM-8"],
+      "key_actions": [
+        "Generate model cards for all deployed AI models",
+        "Include all required sections per federal template",
+        "Update model cards on model changes"
+      ]
+    },
+    {
+      "id": "M26-DOC-2",
+      "family": "Model Documentation",
+      "title": "System Card Generation",
+      "description": "Agencies shall produce a system card for each AI system (encompassing one or more models, data pipelines, and integration components). System cards shall document: system purpose and scope, component models (with references to individual model cards), data flows and processing, human oversight design, risk profile, appeal mechanisms, monitoring approach, and compliance status. System cards provide the holistic view necessary for governance review.",
+      "evidence_required": "System card documents, component model references, data flow diagrams, human oversight documentation.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["PL-2", "SA-3", "SA-4", "PM-5"],
+      "key_actions": [
+        "Generate system cards for all AI systems",
+        "Link to component model cards",
+        "Document data flows and oversight design"
+      ]
+    },
+    {
+      "id": "M26-DOC-3",
+      "family": "Model Documentation",
+      "title": "Documentation Accessibility",
+      "description": "Model cards and system cards for non-classified AI systems shall be made available to relevant stakeholders including oversight bodies, affected communities, and (where appropriate) the public. Documentation shall be written in plain language and maintained in a centralized, searchable repository.",
+      "evidence_required": "Documentation repository, stakeholder access records, plain language review evidence, public-facing documentation (where applicable).",
+      "priority": "P2",
+      "nist_800_53_crosswalk": ["PM-15", "AC-8", "PL-4"],
+      "key_actions": [
+        "Maintain centralized documentation repository",
+        "Ensure plain language accessibility",
+        "Share with relevant stakeholders"
+      ]
+    },
+    {
+      "id": "M26-DOC-4",
+      "family": "Model Documentation",
+      "title": "Documentation Currency",
+      "description": "Model cards and system cards shall be reviewed and updated at least annually, upon significant system changes, upon discovery of new risks or biases, or when operational context materially changes. Agencies shall maintain version history of all documentation changes with change rationale.",
+      "evidence_required": "Documentation version history, update trigger records, change rationale documentation, annual review records.",
+      "priority": "P2",
+      "nist_800_53_crosswalk": ["CM-3", "CM-4", "PL-2"],
+      "key_actions": [
+        "Review documentation annually at minimum",
+        "Update on significant changes",
+        "Maintain version history with rationale"
+      ]
+    },
+    {
+      "id": "M26-BIAS-1",
+      "family": "Bias and Fairness",
+      "title": "Pre-Deployment Bias Testing",
+      "description": "Agencies shall conduct bias testing before deploying any AI system that makes or supports decisions affecting individuals. Testing shall evaluate the system's performance across relevant demographic groups, protected classes, and historically underserved populations. Bias testing methodology, results, and any identified disparities shall be documented in the model card and system card.",
+      "evidence_required": "Pre-deployment bias test plans, test results across demographic groups, identified disparity documentation, remediation actions taken.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["CA-2", "SA-11", "RA-3"],
+      "key_actions": [
+        "Develop bias testing methodology",
+        "Test across demographic groups before deployment",
+        "Document and remediate identified disparities"
+      ]
+    },
+    {
+      "id": "M26-BIAS-2",
+      "family": "Bias and Fairness",
+      "title": "Fairness Metrics Definition",
+      "description": "Agencies shall define and track fairness metrics appropriate to each AI system's context and use case. Metrics shall include but are not limited to: demographic parity, equalized odds, predictive parity, and calibration across groups. The choice of fairness metrics shall be documented with rationale, and trade-offs between metrics shall be explicitly acknowledged and justified.",
+      "evidence_required": "Fairness metrics selection documentation, metric calculation methodology, metric tracking records, trade-off analysis documentation.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["CA-7", "SI-4", "PM-9"],
+      "key_actions": [
+        "Select appropriate fairness metrics per system",
+        "Document metric selection rationale",
+        "Track metrics continuously"
+      ]
+    },
+    {
+      "id": "M26-BIAS-3",
+      "family": "Bias and Fairness",
+      "title": "Disparity Analysis",
+      "description": "Agencies shall conduct disparity analysis for high-impact AI systems at least quarterly, comparing system outcomes across demographic groups. Analysis shall identify statistically significant disparities, evaluate whether disparities are justified by legitimate operational factors, and document remediation plans for unjustified disparities. Disparity analysis results shall be reported to the Chief AI Officer.",
+      "evidence_required": "Quarterly disparity analysis reports, statistical significance methodology, justification for observed disparities, remediation plans, CAIO reporting records.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["CA-7", "AU-6", "PM-9"],
+      "key_actions": [
+        "Conduct quarterly disparity analysis",
+        "Evaluate and justify observed disparities",
+        "Report to Chief AI Officer"
+      ]
+    },
+    {
+      "id": "M26-BIAS-4",
+      "family": "Bias and Fairness",
+      "title": "Bias Mitigation Measures",
+      "description": "Agencies shall implement and document bias mitigation measures for AI systems where bias risks have been identified. Mitigation approaches may include: training data augmentation, algorithmic adjustments, post-processing corrections, human review of flagged decisions, or alternative decision pathways. The effectiveness of mitigation measures shall be evaluated and documented.",
+      "evidence_required": "Bias mitigation plan, mitigation implementation evidence, mitigation effectiveness evaluation, before/after metric comparison.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["SI-4", "CA-7", "PM-4"],
+      "key_actions": [
+        "Implement bias mitigation measures",
+        "Evaluate mitigation effectiveness",
+        "Document before/after comparisons"
+      ]
+    },
+    {
+      "id": "M26-BIAS-5",
+      "family": "Bias and Fairness",
+      "title": "Protected Class Monitoring",
+      "description": "Agencies shall implement ongoing monitoring of AI system outputs for disparate impact on protected classes as defined by applicable civil rights laws, executive orders, and agency-specific policies. Where direct demographic data is unavailable, agencies shall use proxy analysis methodologies documented and validated by agency statisticians or data scientists.",
+      "evidence_required": "Protected class monitoring plan, monitoring results, proxy methodology documentation (if applicable), data scientist validation records.",
+      "priority": "P2",
+      "nist_800_53_crosswalk": ["CA-7", "SI-4", "AU-6"],
+      "key_actions": [
+        "Monitor outputs for disparate impact",
+        "Validate proxy methodologies",
+        "Report monitoring results periodically"
+      ]
+    },
+    {
+      "id": "M26-REV-1",
+      "family": "Human Review and Appeal",
+      "title": "Human Review of Adverse AI Decisions",
+      "description": "Agencies shall ensure that individuals adversely affected by AI-assisted decisions have the right to request and receive human review. Human reviewers shall have the authority, training, and information necessary to evaluate the AI's recommendation independently, including access to the factors considered by the AI system. Human review shall be completed within a timeframe consistent with the urgency and impact of the decision.",
+      "evidence_required": "Human review policy, reviewer training records, reviewer authority documentation, review completion time records, review outcome records.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["AC-6", "AU-2", "PM-15"],
+      "key_actions": [
+        "Establish human review rights for adverse decisions",
+        "Train qualified human reviewers",
+        "Track review completion times and outcomes"
+      ]
+    },
+    {
+      "id": "M26-REV-2",
+      "family": "Human Review and Appeal",
+      "title": "Formal Appeal Process",
+      "description": "Agencies shall establish formal appeal processes for AI-assisted decisions, separate from the initial human review. The appeal process shall include: clear instructions accessible to all affected individuals, the ability to submit additional evidence or context, review by a decision-maker independent of the original AI-assisted process, written explanation of appeal outcomes, and information about further recourse options.",
+      "evidence_required": "Formal appeal process documentation, appeal submission mechanism, independent reviewer assignment records, written appeal outcome records.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["IR-4", "PM-15", "PL-4"],
+      "key_actions": [
+        "Establish formal appeal process",
+        "Assign independent appeal reviewers",
+        "Provide written appeal outcomes"
+      ]
+    },
+    {
+      "id": "M26-REV-3",
+      "family": "Human Review and Appeal",
+      "title": "Opt-Out and Alternative Pathways",
+      "description": "Where feasible and consistent with the agency's mission, agencies shall provide individuals the option to opt out of AI-assisted decision-making and request a fully human-driven process. Where opt-out is not feasible, agencies shall document the justification and ensure enhanced human oversight of the AI-assisted process.",
+      "evidence_required": "Opt-out policy documentation, opt-out mechanism, feasibility analysis (where opt-out not provided), enhanced oversight documentation.",
+      "priority": "P2",
+      "nist_800_53_crosswalk": ["AC-6", "PM-15"],
+      "key_actions": [
+        "Evaluate opt-out feasibility per system",
+        "Implement opt-out mechanisms where feasible",
+        "Document justification where opt-out not possible"
+      ]
+    },
+    {
+      "id": "M26-REV-4",
+      "family": "Human Review and Appeal",
+      "title": "Decision Explanation Capability",
+      "description": "Agencies shall ensure that AI systems supporting high-impact decisions can provide meaningful explanations of the factors that contributed to each decision. Explanations shall be understandable to both the affected individual and the human reviewer, and shall identify the key data inputs, model factors, and confidence level that influenced the AI's recommendation.",
+      "evidence_required": "Explainability capability documentation, sample explanations, user comprehension testing, explanation accuracy validation.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["AU-2", "SI-4", "PM-15"],
+      "key_actions": [
+        "Implement decision explanation capability",
+        "Test explanation comprehensibility",
+        "Validate explanation accuracy"
+      ]
+    },
+    {
+      "id": "M26-IMP-1",
+      "family": "Impact Assessment",
+      "title": "Pre-Deployment Impact Assessment",
+      "description": "Agencies shall conduct a comprehensive impact assessment before deploying any AI system classified as high-impact. The assessment shall evaluate potential impacts on affected individuals and communities, including: civil rights and civil liberties impacts, privacy impacts, safety impacts, economic impacts, and impacts on government decision quality. Impact assessments shall be reviewed by the agency's Chief AI Officer and relevant civil rights and privacy officials.",
+      "evidence_required": "Pre-deployment impact assessment report, civil rights impact analysis, privacy impact analysis, safety impact analysis, CAIO review and sign-off.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["RA-3", "RA-8", "PM-9"],
+      "key_actions": [
+        "Conduct pre-deployment impact assessment",
+        "Analyze civil rights, privacy, and safety impacts",
+        "Obtain CAIO review and approval"
+      ]
+    },
+    {
+      "id": "M26-IMP-2",
+      "family": "Impact Assessment",
+      "title": "Ongoing Impact Monitoring",
+      "description": "Agencies shall monitor the real-world impacts of deployed AI systems on an ongoing basis. Impact monitoring shall include tracking actual outcomes for affected individuals, collecting feedback from users and affected communities, comparing predicted impacts with actual impacts, and identifying unintended consequences. Material deviations from expected impacts shall trigger reassessment.",
+      "evidence_required": "Impact monitoring reports, outcome tracking data, community feedback records, predicted vs. actual impact comparison, reassessment trigger documentation.",
+      "priority": "P1",
+      "nist_800_53_crosswalk": ["CA-7", "SI-4", "PM-4"],
+      "key_actions": [
+        "Track real-world AI outcomes",
+        "Collect stakeholder feedback",
+        "Compare predicted vs. actual impacts"
+      ]
+    },
+    {
+      "id": "M26-IMP-3",
+      "family": "Impact Assessment",
+      "title": "Impact Assessment Publication",
+      "description": "Agencies shall make non-classified portions of impact assessments available to relevant oversight bodies and, where appropriate, to the public. Published assessments shall include a summary of findings, identified risks and mitigation measures, and the agency's decision regarding deployment. Classified assessments shall be reported through appropriate channels.",
+      "evidence_required": "Published impact assessment summaries, oversight body notification records, public-facing assessment (where applicable).",
+      "priority": "P2",
+      "nist_800_53_crosswalk": ["PM-15", "PL-4", "AC-8"],
+      "key_actions": [
+        "Publish non-classified assessment portions",
+        "Notify oversight bodies",
+        "Maintain classified reporting channels"
+      ]
+    }
+  ]
+}