The text of the Super Intelligence (SI) Governance and Acquisition Policy
Approval #
| Role | Name | Signature |
|---|---|---|
| Chief Information Security Officer (CISO) |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, with the SI use-case inventory publication.
Mandate. Two Office of Management and Budget (OMB) memoranda set the requirements in this policy. Both were issued on April 3, 2025:
- M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust. It requires each agency to name accountable officials, including a Chief AI Officer or equivalent. This policy calls that position the Chief Super Intelligence Officer (CSIO). It also requires each agency to set workforce expectations for appropriate use, especially where the technology supports consequential decisions, and to publish a use-case inventory every year.
- M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government. It applies to solicitations issued on or after September 30, 2025, and required agencies to update their acquisition procedures by December 29, 2025. Under it, agencies buy technology that is fit for purpose and avoid vendor lock-in. Contracts set clear data and intellectual-property terms. The Senior Agency Official for Privacy (SAOP) takes part whenever the system will handle personally identifiable information (PII).
These memoranda rescinded and replaced M-24-10 and M-24-18. Executive Order 14434, Inaugurating the Era of Super Intelligence (September 29, 2026), directs agencies to use the terms “Super Intelligence” and “SI” in place of “Artificial Intelligence (AI)” in policy documents. This policy uses Super Intelligence (SI). The titles of earlier memoranda and orders keep their published wording. The M-25-21 requirement for an agency strategy applies only to agencies under the Chief Financial Officers (CFO) Act, but every requirement in this policy applies to the Organization. The policy also meets National Institute of Standards and Technology (NIST) SP 800-53 controls PM-1 and SA-4 for SI.
1. Policy Statement #
Super Intelligence (SI) has the meaning that 15 U.S.C. 9401(3) gives the term the law uses (EO 14434, §§ 2(a), 3(a)). SI that the Organization cannot account for, explain, or replace puts at risk the people its decisions affect, and it limits the Organization’s ability to change vendors. The Organization governs its use of SI through four things:
- Named accountable officials.
- An SI use-case inventory that the CSIO publishes every year.
- Workforce expectations for appropriate use.
- Acquisition terms that keep the Organization in control of its data and its options.
2. Accountable Officials #
| Role | Responsibility |
|---|---|
| Chief Super Intelligence Officer (CSIO), the position OMB M-25-21 calls the Chief AI Officer, or the official designated as equivalent | Accountable for SI governance and the use-case inventory. Coordinates with the Chief Information Officer (CIO), the CISO, and the SAOP. |
| CIO | Makes sure SI systems are authorized to operate under the Risk Management Framework, and that SI acquisitions follow this policy. |
| CISO | Reviews the security of SI systems and services before authorization and at each significant change. |
| SAOP | Takes part early and throughout any SI acquisition or use that handles PII. Approves the privacy assessment. |
| Contracting Officers and Contracting Officer’s Representatives | Apply the acquisition requirements in this policy. |
| System Owners | Register each SI use case in the inventory and keep its record current. |
3. SI Use-Case Inventory #
System Owners must record every use of SI in the SI use-case inventory, whether the SI is built, bought, or embedded in a commercial product. Each entry gives:
- The purpose.
- The data the SI uses.
- Whether it supports a consequential decision.
- Its authorization status.
- The accountable System Owner.
The CSIO publishes the inventory every year in the format OMB prescribes (OMB M-25-21), and keeps the internal record current between publications. A use case that is not in the inventory is not authorized.
4. Workforce Expectations #
Personnel may use only the SI tools the Organization has approved, and only for the approved purposes. Personnel must not use DeepSeek apps, models, or services, or tools built on them, on any Organization device or for Organization work (FASCSA Exclusion and Removal Order 2026-01). Personnel must not enter sensitive information into any SI service that is not authorized to hold it. Sensitive information includes Controlled Unclassified Information (CUI) and PII. Personnel must not enter CUI into an SI system that is internet-enabled, connected to infrastructure outside the Organization’s control, or not authorized to protect CUI (ISOO Notice 2026-01). Before CUI goes into any SI system, the CIO, the CISO, and the CUI Program Manager assess the system (ISOO Notice 2026-01). The Controlled Unclassified Information (CUI) Policy (POL-CUI-001) sets the rest of the CUI rules.
Where SI supports a consequential decision about a person, a qualified individual reviews the outcome and can override it. The person affected can ask for that review.
Personnel must complete training on these expectations before using SI tools, and every year after. The Agency Learning Management System (LMS) holds the completion records.
5. Acquisition Requirements #
For every solicitation, order, or renewal issued on or after September 30, 2025, that includes SI, the Contracting Officer’s acquisition file must show these seven things (OMB M-25-22):
- The program office defined the requirement by its mission outcome, and the SI is fit for that purpose, with performance criteria the vendor must meet.
- The contract avoids vendor lock-in. Data is portable in an open format, the solution works with the Organization’s systems, and the terms allow a move to another provider.
- The contract separates government and contractor data ownership and intellectual-property rights. It prohibits the vendor from using the Organization’s data to train models beyond the Organization’s use without written consent.
- The SAOP took part from the start of requirements definition wherever the SI will handle PII.
- A large language model also meets the Large Language Model Procurement Requirements (POL-LLM-001) while OMB M-26-04 is in force. Those requirements carry out Executive Order 14319, Preventing Woke AI in the Federal Government.
- The SI system or service has an authorization to operate, or falls under an existing one, before it processes Organization data.
- The SI is not a DeepSeek product or service, and is not a third-party product or service built using a DeepSeek implementation (FASCSA Exclusion and Removal Order 2026-01).
Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security (June 2, 2026), directs the Cybersecurity and Infrastructure Security Agency (CISA) to issue directives that speed the cyber defense of civilian federal systems. It sets no direct task for the Organization. The CISO applies each such directive through the Vulnerability Management Policy (POL-VM-001).
The SI security review and monitoring tools are:
(No technology inventory entries for this family.)
6. Risk Management for SI That Supports Consequential Decisions #
Before the Organization deploys SI that supports a decision with legal, material, or safety consequences for a person, the System Owner must complete four practices (OMB M-25-21):
- An impact assessment covering intended use, data quality, and expected benefits and risks.
- Testing in a realistic setting.
- Ongoing monitoring for performance and unintended outcomes.
- The human review path described under Workforce Expectations.
System Owners may use the NIST Artificial Intelligence Risk Management Framework (NIST AI 100-1) to carry out these practices. Information Security Oversight Office (ISOO) Notice 2026-01 uses its definition of these systems.
The CSIO may stop a use case that no longer meets these conditions.
7. Measures and Review #
Each year, with the inventory publication, the CSIO reports three measures:
- The number of SI use cases.
- The share of use cases that support consequential decisions and have completed the four risk practices.
- The share of SI acquisitions that met the acquisition requirements.
8. References #
These are the sources this document cites, with a link to each official text.
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 26, 2023.
- Definitions (National Artificial Intelligence Initiative Act of 2020) (15 U.S.C. § 9401).
- Exclusion and Removal of DeepSeek Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 24, 2026.
- Executive Order 14319: Preventing Woke AI in the Federal Government, July 23, 2025.
- Executive Order 14409: Promoting Advanced Artificial Intelligence Innovation and Security, June 2, 2026.
- Executive Order 14434: Inaugurating the Era of Super Intelligence, September 29, 2026.
- ISOO Notice 2026-01: Responsible Use of Classified National Security Information and Controlled Unclassified Information with AI tools, March 30, 2026.
- OMB M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, April 3, 2025.
- OMB M-25-22: Driving Efficient Acquisition of Artificial Intelligence in Government, April 3, 2025.
- OMB M-26-04: Increasing Public Trust in Artificial Intelligence Through Unbiased AI Principles, December 11, 2025.