Federal AI Governance: Selected Primary-Source Milestones

January 26, 2023: NIST releases AI RMF 1.0

Voluntary guidance. NIST released its voluntary AI Risk Management Framework to help organizations manage AI risks. Its current overview also records the July 26, 2024 Generative AI Profile and says AI RMF 1.0 is being revised. NIST — AI Risk Management Framework.

Record the version used for the organization’s work. A voluntary framework and a binding legal requirement belong in separate fields of the source register.

January 23, 2025: A change in federal executive direction

Executive direction. The order Removing Barriers to American Leadership in Artificial Intelligence directed preparation of an AI action plan and review of specified actions taken under the prior executive policy. White House — January 23, 2025 order.

Check the operative sections and addressee. An instruction to review policy does not establish that every resulting change has been completed.

December 11, 2025: State-law challenges and agency work directed

Executive direction. Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence, directed an AI litigation task force, evaluation of state AI laws and specified agency work concerning national policy. White House — national-policy order.

A particular challenge requires its own proceeding and applicable order. The executive direction alone does not establish that a named state law has been invalidated.

April 7, 2026: NIST publishes a critical-infrastructure concept note

Concept note. NIST published a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure. The source identifies work under development, rather than a completed replacement framework. NIST — framework overview and profile link.

Use the concept note to understand the proposed work. Do not infer a final profile release date or new legal obligation from its publication.

How to read a policy milestone

For each event, record the issuing body, date, document type, operative language, addressee and any subsequent implementation or litigation. A press release can identify an event while the underlying order supplies its terms.

Distinguish an announced priority from a filed proceeding, a proposed rule from an adopted rule, and a court’s interim order from a final disposition. Do not flatten those distinctions into a single “AI law changed” label.

The earlier edition included additional current-litigation and agency-status claims that were not individually reverified for this revision. They should not be treated as a current docket record. The selected milestones above retain a bounded, explicit source basis.

What an organization can do with the timeline

1. Identify which activity or obligation the event could affect.
2. Read the primary source and record the exact stage.
3. Determine whether a subsequent action changes its effect.
4. Assign a reviewer and a decision date for the organization.
5. Update the relevant records and explain what changed.

A governance process should remain usable when policy changes. Keep the system inventory, accountable owners, evidence and change record in place, then revise the relevant obligation mapping. See the multi-jurisdiction working method.