Federal AI Intelligence · U.S. Government AI Observatory
Governance disclosure assessment
Filtered: topic = Cybersecurity; AI type = generative
Key findings
- 14 use-case records from 9 agencies: 6 deployed (43%), 2 pilots, 6 in development or acquisition, 0 retired, 0 with no stage reported.
- 1 records are designated high-impact; 0 of them (0%) answered at least one minimum-practice question.
- DOE, DOJ, PBGC report 7 of 14 use cases (50%).
- 100% of reported deployed use cases (6 of 6) are classified as generative or agentic AI.
- Sourcing is reported for 71% of use cases. Where reported, 50% involve in-house development.
Governance evidence: all use cases in the current filter
| Practice | In place | In progress | Not in place | N/A or precluded | Other | No answer | In scope |
|---|---|---|---|---|---|---|---|
| Pre-deployment testing | 1 | 1 | 0 | 0 | 0 | 12 | 14 |
| AI impact assessment | 1 | 1 | 0 | 0 | 0 | 12 | 14 |
| Independent review | 1 | 1 | 0 | 0 | 0 | 12 | 14 |
| Ongoing monitoring | 1 | 1 | 0 | 0 | 0 | 12 | 14 |
| Operator training | 1 | 1 | 0 | 0 | 0 | 12 | 14 |
| Fail-safe | 1 | 0 | 0 | 1 | 0 | 12 | 14 |
| Appeal process | 0 | 0 | 0 | 2 | 0 | 12 | 14 |
| User and public consultation | 1 | 1 | 0 | 0 | 0 | 12 | 14 |
"In place" means the agency reported the practice as established. "No answer" means the field was blank; it says nothing about whether the practice exists.
Agencies with high-impact records
| Agency | High-impact | Answered any practice | Practice answers in place |
|---|---|---|---|
| VA | 1 | 0 | 0 of 8 |
Method
All figures are computed directly from the normalised inventory records. Category labels are normalised from the source answer options; original values are kept on each record. Governance answers are classified as in place, in progress, not in place, not applicable, precluded, waived, other or no answer, and blanks are never read as "no". See the Methodology page for full rules.
Limitations
- Figures are what agencies reported in the 2025 inventory. They are not verified, and registration of use cases is not complete for every agency.
- A blank answer is missing evidence, not evidence that a practice or safeguard is absent.
- Counts are use-case records. A larger portfolio does not indicate better performance or greater AI maturity, and agencies differ in how they split systems into use cases.
- The inventory has no budget, cost, accuracy or outcome data. None is shown or inferred here.
- This is a disclosure analysis. It is not an audit, a compliance determination or an official government assessment.
Source records
All 14 records.
| Record | Agency ID | Agency | Use case | Stage |
|---|---|---|---|---|
| R1440 | USDA-142 | USDA | Infosec Chatbot | Deployed |
| R1616 | DOJ-0174 | DOJ | Exiger Supply Chain Risk Management - DDIQ Research Engine | Deployed |
| R1617 | DOJ-0175 | DOJ | Exiger Supply Chain Risk Management - DDIQ Due Diligence Analytics | Deployed |
| R1950 | DHS-2543 | DHS | AI Security and Monitoring | Deployed |
| R3130 | PBGC - 02 | PBGC | IT Security Monitoring | Deployed |
| R3319 | DOE-441 | DOE | Microsoft Copilot for Security | Deployed |
| R0029 | SEC-36 | SEC | Augmenting cyber threat alerts on the ACES platform with ACES's specific information. | Pilot |
| R1195 | GSA | Software Supply Chain Security Research | Pre-deployment | |
| R2076 | VA-25-3685 | VA | CSOC AI Analyst Accelerator (Andesite AI) | Pre-deployment |
| R3139 | PBGC - 11 | PBGC | IT Security and Privacy Control Assessment | Pre-deployment |
| R3180 | SBA-21 | SBA | Security Team Productivity Enhancement | Pre-deployment |
| R3196 | SBA-41 | SBA | AI-Powered Search and Recovery | Pre-deployment |
| R3503 | DOE-647 | DOE | CyberSearch | Pre-deployment |
| R3549 | DOE-693 | DOE | COREII | Pilot |
Prepared with Federal AI Intelligence by Irakli Petriashvili. Source: https://github.com/ombegov/2025-Federal-Agency-AI-Use-Case-Inventory