Agency heads enable trained, accountable officials at the lowest appropriate level to find, weigh, reduce and accept the risk of each AI use case; within 180 days and every two years to 2036 submit to OMB and post a compliance plan (or a determination that the agency uses no covered AI) including plans to align existing AI principles; within 270 days update internal policies on IT infrastructure (tools, open source, deployment), data (inventory, quality, lawful access, representativeness), cybersecurity (authorizations, continuous monitoring and authorization for AI) and privacy to match the memorandum and Executive Orders 14179 and 13960, favouring models that need less data and compute and are more explainable; within 270 days adopt a generative AI acceptable use policy with safeguards and oversight; and (except DoD and the Intelligence Community) compile the AI use case inventory yearly or more often, send it to OMB and post a public version.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.