Homeland Security’s updated AI inventory raises more ques...

Overview

The Department of Homeland Security has updated its AI use case inventory to align with OMB-mandated risk management practices for high-impact AI systems, and the update surfaced inconsistencies in how DHS (Department of Homeland Security) classified and managed AI tools. Some use cases that were previously labeled high-impact appear to have been downgraded without clear justification, and other systems were deployed past OMB's April 3 compliance deadline. Contractors developing or supporting AI systems for DHS must act now to validate classification, confirm their solutions meet evolving OMB risk-management expectations, and remediate gaps in pre-deployment testing, impact assessments, and human oversight. This update increases the likelihood of follow-on audits, re-scoping of requirements, and tighter procurement review for AI work across DHS; contractors should update opportunity screening and capture plans accordingly. Review your DHS-related proposals and existing task orders to determine whether your deliverables map to any items in the updated inventory and adjust compliance artifacts and staffing plans where necessary. For practical guidance on operational security and CUI (Controlled Unclassified Information) handling, see the Secure Operations Guide and related materials.

Immediate Actions (This Week)

[ ] Inventory active DHS-facing AI contracts, task orders, and proposals; flag any deliverable that could be classified as a high-impact AI system under OMB guidance.
[ ] Cross-check your systems against OMB AI Risk Management and the NIST AI Risk Management Framework for obvious gaps: pre-deployment testing, documented impact assessments, and defined human oversight controls.
[ ] Preserve evidence and timelines for deployments and testing (audit-ready logs, change requests, acceptance tests) in case DHS or OMB requests justification for classification or deployment dates.
[ ] Notify capture/proposal leads and legal/compliance teams about the DHS inventory update and OMB’s April 3 compliance deadline; initiate a rapid triage meeting to assign owners.
[ ] Monitor DHS and OMB channels for further clarification or follow-on guidance and sign up for alerts on relevant solicitations and amendments.

Short-Term Actions (30 Days)

[ ] Complete targeted impact assessments for any systems flagged as high-impact or near-high-impact; document residual risks and mitigation steps.
[ ] Implement or validate pre-deployment testing plans and human-in-the-loop (or human-on-the-loop) oversight procedures; update technical approaches and SOW language to reflect these controls.

Long-Term Actions (90+ Days)

[ ] Institutionalize an AI risk-management lifecycle for DHS work: classification, impact assessment, testing, approval gates, monitoring, and reporting.
[ ] Update templates, past performance narratives, and proposal content to demonstrate OMB-aligned risk management practices across procurements and contract vehicles.

Compliance Checklist

[ ] OMB AI Risk Management — ensure programs have documented risk assessments, classification rationale, and timelines for remediation or reclassification.
[ ] NIST AI Risk Management Framework — map your system lifecycle controls to the Framework (governance, risk management, measurement) and document traceability.
[ ] FedRAMP (Federal Risk and Authorization Management Program) — verify cloud hosting and SaaS components meet required authorization levels where applicable.
[ ] FISMA — confirm FISMA-related controls and system security plans are current for federal information systems supporting DHS work.
[ ] Section 508 — validate accessibility of user-facing AI tools and interfaces.
[ ] Privacy Act — ensure privacy impact assessments and data handling practices are documented where personal data is involved.

Compliance scope TBD — re-evaluate when DHS/OMB publish formal guidance or solicitation language.

Resources

OMB AI Risk Management — monitor OMB announcements and guidance (official OMB guidance pages; URL TBD pending source review)
DHS AI inventory update — monitor DHS publications for the updated inventory and follow-up explanations (DHS guidance pages; URL TBD pending source review)
Internal references:
Secure Operations Guide (/insights/secure-operations-guide)
Related guides:
CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide)
CUI-Safe CRM Guide (/insights/cui-safe-crm-guide)

How Cabrillo Club Automates This

Cabrillo Signals War Room — Already detected this event and delivered this briefing within minutes. War Room continues to monitor DHS and OMB publications and will surface clarifications, amendments, and timeline changes as they appear. It maintains an evidence trail of alerts and briefing deliveries so your capture and compliance teams can show when you were notified.
Cabrillo Signals Match Engine — Automatically rescoring your pipeline when policy events affect opportunity fit, the Match Engine will update opportunity match scores and keyword relevance for DHS-facing AI work. It reprioritizes opportunities tied to the NAICS and market segments in your profile so capture teams can focus on solicitations where OMB-aligned risk management will be evaluative factors.
Cabrillo Signals Intelligence Hub — Tracks affected agencies, NAICS codes, and contract vehicles mentioned in this event. Use the Intelligence Hub saved searches to get alerts when follow-on solicitations or amendments appear on SAM.gov (System for Award Management) matching DHS AI profiles and the listed vehicles; it will also aggregate historical references to help you justify classification decisions.
Proposal Studio (Proposal OS) — Generates OMB-aligned compliance matrices, impact-assessment writeups, and first-draft technical approaches using your past performance data. Proposal Studio can pull your validated testing plans and human oversight language into drafts and populate a win-theme library entry showing OMB-compliance strengths for DHS proposals.
Proposal Studio Workflow Tracker — Triggers a capture workflow when an event like this impacts an opportunity: routes compliance review tasks to contracts and legal, enforces review gates for impact assessments and pre-deployment testing artifacts, tracks supplier certifications, and produces an audit-ready documentation package for submission and post-award review.

Explore these features in your Cabrillo console to automate monitoring, re-scoring, and proposal generation so you can respond quickly to DHS and OMB developments.

If you need a hand configuring saved searches or seeding Proposal Studio with test plans and impact assessments, contact your Cabrillo Club account team to prioritize setup.

---