NIST AI RMF, HIPAA, FISMA:
Translate high-level frameworks into concrete controls, artifacts, and ongoing checks.
🟤NIST AI RMF core functions: Govern, Map, Measure, Manage

🟤Control alignment with FISMA/NIST 800-53 and FedRAMP baselines (at a leadership level)

🟤HIPAA implications for AI: PHI boundaries, BAAs, minimum necessary, de-identification basics

🟤Evidence you’ll need: risk register, model documentation, monitoring plans

🟤Roles and accountability: program, security, privacy, and clinical/mission SMEs

🟤Continuous monitoring and change-control for model and policy drift

VA AI Ethical Principles & Policy Compliance
Make ethics operational, tie VA principles to decisions, workflows, and review gates.
🟤Translating principles into prompts, acceptance criteria, and escalation triggers

🟤Harm analysis: safety, fairness, explainability, and human oversight in practice

🟤Dignity-preserving data practices: consent posture, minimization, redaction patterns

🟤Tone and representation: avoiding stigmatizing or biased outputs

🟤Documentation: ethics justifications, trade-offs, and exception handling

🟤How to run lightweight ethics reviews without slowing delivery

Navigating FAR/DFARS in AI Procurement
Acquire AI and data services that are compliant, competition-sound, and vendor-agnostic.
🟤Key FAR/DFARS clauses for data, software, and services (leadership view)

🟤Market research that avoids disclosing acquisition-sensitive info

🟤Data rights and deliverables: technical data, software, and model artifacts

🟤Evaluation factors: performance, security, privacy, and maintenance obligations

🟤Avoiding vendor lock-in: portability, export formats, retrievability

🟤ost-award governance: QASP elements, SLAs, remedies, and change management

Intellectual Property in the Age of LLMs
Understand who owns what, data, prompts, fine-tunes, and outputs, and avoid license traps.
🟤Ownership models for AI outputs and training derivatives

🟤Third-party data and content: licensing checks and attribution duties

🟤Open source in AI stacks: permissive vs. copyleft risk patterns

🟤Fine-tune and RAG boundaries: IP around embeddings, indexes, and adapters

🟤Contractor vs. government purpose rights; work-for-hire considerations

🟤Record-keeping that preserves claims and avoids inadvertent disclosure

AI Ethics: Going Beyond Checklists
Build a living ethics practice that detects risk early and documents reasoning for oversight.
🟤From principles to playbooks: bias probes, challenge questions, and dissent capture

🟤Impact assessments that are short, specific, and revisited after changes

🟤Human-in/-on-the-loop patterns: where judgment belongs and how to prove it

🟤Transparency without over-exposure: model cards and user-facing caveats

🟤Handling disagreement: SME adjudication and decision logs

🟤Measuring ethical fitness over time: signals and thresholds

OMB Memos M-25-21 and M-25-22
Turn OMB direction into concrete action items, roles, and artifacts for your program.
🟤What the memos require: governance, inventories, risk controls, reporting

🟤Agency playbook: who owns what, and how to coordinate cross-functionally

🟤Required documentation and cadence: inventories, waivers, and oversight updates

🟤Interplay with CIO, CISO, privacy, and mission owners

🟤Practical timelines and readiness checks before launch or scale

🟤Common pitfalls and how to avoid “paper compliance”

Privacy, Records, and Data Governance (Privacy Act, PRA, CUI, FOIA)
Protect people and records while keeping work moving, know the lines you cannot cross.
🟤Privacy Act and PRA basics for AI use (collections, disclosures, minimization)

🟤CUI handling and data residency expectations for AI services

Records management: what becomes a record, retention, and version control

🟤FOIA-readiness: drafting and documenting with potential disclosure in mind

🟤De-identification, masking, and redaction patterns that survive re-identification risk

🟤Incident response at the data layer: containment, notification, and remediation artifacts