The Department of Homeland Security (DHS) revised its artificial intelligence (AI) policy to allow its chief AI officer (CAIO) to waive requirements, including prohibited uses, if those exceptions remain consistent with law, regulation, and governmentwide policy.
The updated Directive 139-08, quietly issued last month, adds the waiver provision to a departmentwide framework governing how DHS develops, acquires, deploys, and operates AI. Compared with the version issued Jan. 15, 2025, the revision also adds requirements for sharing AI assets, prioritizes domestically developed technology, and changes language about human oversight.
“The purpose is to advance AI innovation and governance while managing risks from the use of AI, particularly those affecting the safety or rights of individuals,” the document reads.
Its scope includes AI used by DHS intelligence elements and in national security systems, as well as technology used on the department’s behalf. The DHS Office of Inspector General remains excluded.
DHS policy allows CAIO to waive prohibited AI uses
The new approvals and waivers section allows the CAIO to waive “any requirement of this Directive and implementing policy, including prohibited uses of AI at DHS.” It requires coordination with relevant officials, consideration of the circumstances, and documentation of the technical and operational reasons for an exception. The new language does not authorize exceptions to applicable law, regulation, or governmentwide policy.
The same section explicitly authorizes the department’s CAIO and designated component and intelligence officials to approve AI use cases, as necessary, and require retirement of uses that violate the directive or implementing policy.
DHS retains its prohibition on relying solely on AI outputs for arrests, searches, seizures, civil enforcement penalties, or denials of government benefits. The revision clarifies that using AI for support functions, such as translation or transcription, does not constitute relying on AI outputs as the sole basis for agency action.
The updated policy also changes the standard for mandatory human oversight. The January version required oversight for safety-impacting or rights-impacting AI, as well as AI used for significant or final agency decisions or actions. The revision instead requires oversight when AI use is high impact.
A new glossary defines high-impact AI as a use in which the output serves as a principal basis for decisions or actions with legal, material, binding, or significant effects on areas such as civil rights, privacy, access to government services, health and safety, critical infrastructure, or strategic assets. The definition references Office of Management and Budget Memorandum M-25-21.
Its governance requirements likewise replace language about promoting equity and inclusivity with language emphasizing responsible adoption, appropriate stakeholder participation, streamlined decisions, and reduced administrative burden.
Policy promotes code-sharing and U.S. AI
For technology and acquisition teams, the revision adds a section directing DHS to proactively share custom-developed code, AI models, use cases, and related data across the department and government, as appropriate and consistent with law. Where practicable, DHS is to prioritize releasing and maintaining AI code as open source software in a public repository.
Those sharing requirements include exceptions for legal and contractual restrictions and identifiable risks to national security, privacy, public safety, agency operations, and system security. A separate addition encourages lawful data sharing to support increased AI adoption.
The acquisition provisions now prioritize AI developed or produced in the United States, to the maximum extent practicable and consistent with applicable law. They retain requirements addressing testing, risk management, transparency, performance, and data ownership, while removing the January 2025 version’s requirement to assess environmental efficiency and sustainability.
A new generative AI section states that personnel use the technology to improve operational efficiency and support DHS missions. It subjects those uses to the directive’s prohibitions, applicable human oversight requirements, and enterprise AI risk management framework.