Required actions
- Agencies appoint Chief AI Officers, maintain AI use-case inventories and publish AI strategies - Apply minimum risk-management practices to "high-impact AI" (pre-deployment testing, impact assessment, ongoing monitoring, human oversight) or stop using it - Procurement contracts must address data rights, vendor lock-in and disclosure of AI use