Agencies decide, with the CAIO able to revisit any decision, which use cases are high-impact, and an official documents to the CAIO any finding that a presumed category does not meet the definition. Within 365 days of 3 April 2025 agencies document implementation of the minimum risk management practices for each high-impact use and stand ready to report it to OMB; a non-compliant high-impact use must be safely discontinued. Limited pilots are exempt if small in scale and duration, certified by the CAIO and tracked centrally, with opt-in and opt-out where possible and the practices applied where practicable. The CAIO (without delegation) may waive a practice for a specific application on a written, system- and context-specific risk assessment that compliance would raise overall risk to safety or rights or unacceptably impede critical operations, must recertify each waiver annually and may revoke it, tracks waivers centrally, reassesses them on significant change and reports each grant or revocation to OMB within 30 days; the agency publishes a summary of each determination and waiver with its justification, or states that it has none.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.