Federal AI Governance: Selected Primary-Source Milestones

January 2023: NIST AI RMF 1.0

NIST released AI RMF1.0 on January26,2023 as a voluntary framework. The agency’s current source also records the July26,2024 GenerativeAIProfile and April7,2026 critical-infrastructure concept note. NIST source and current revision status.

Keep guidance and law separate in a compliance calendar. A helpful framework does not become a universal mandatory requirement merely because the government publishes it.

January 2025: a change in executive direction

The January23,2025 order, Removing Barriers to American Leadership in Artificial Intelligence, directed preparation of an action plan and review of specified prior executive-policy actions. Read the order’s operative sections for what was directed and who was responsible. Official order.

A direction to an agency to review or change a policy is different from evidence that every downstream action has been completed. Record implementation events separately when their official sources are available.

December 2025: state-law challenges directed

ExecutiveOrder14365, dated December11,2025, directed an AI litigation task force, evaluation of state AI laws and specified agency work concerning national policy. The direction is a primary-source fact; the result of a particular challenge requires its own court or agency record. Official national-policy order.

Do not treat the existence of the order as proof that a named state law has been invalidated. Identify the actual provision, proceeding and applicable order before changing an implementation decision.

April 2026: NIST critical-infrastructure concept note

NIST’s April7,2026 publication is identified as a concept note for an AI RMF profile on trustworthy AI in critical infrastructure. Organizations can use it to understand the work under development while retaining the distinction between a proposal for a profile and completed requirements. The current NIST overview links the source.

This page does not infer a specific release date for the revised RMF or the final profile from the concept-note date.

How to read a policy milestone

For each event, record the issuing body, date, document type, operative language, addressee and any subsequent implementation or litigation. A press release can identify an event while the underlying order supplies its terms.

Distinguish an announced priority from a filed proceeding, a proposed rule from an adopted rule, and a court’s interim order from a final disposition. Do not flatten those distinctions into a single “AI law changed” label.

The earlier edition included additional current-litigation and agency-status claims that were not individually reverified for this revision. They should not be treated as a current docket record. The selected milestones above retain a bounded, explicit source basis.

What an organization can do with the timeline

1. Identify which activity or obligation the event could affect.
2. Read the primary source and record the exact stage.
3. Determine whether a subsequent action changes its effect.
4. Assign a reviewer and a decision date for the organization.
5. Update the relevant records and explain what changed.

A governance process should remain usable when policy changes. Keep the system inventory, accountable owners, evidence and change record in place, then revise the relevant obligation mapping. See the multi-jurisdiction working method.