20 FAM 102.2
Bureau Level Roles and Responsibilities (Data and AI)
(CT:DATA-13; 02-20-2025)
(Office of Origin: M/SS/CFA)
20 FAM 102.2-1 Bureau Chief Data Officer (BCDO) Roles and Responsibilities
(CT:DATA-7; 10-15-2024)
20 FAM 102.2-1(A) BCDO Role
(CT:DATA-13; 02-20-2025)
GS-14/15 or FS-02/01 level Department employee who is the “go-to” person (below the DAS level) for all things data and AI in their work units.
20 FAM 102.2-1(B) BCDO Responsibilities
(CT:DATA-13; 02-20-2025)
a. Identify data domains, data holdings, and systems;
b. Develop and implement action plans and roadmaps to align domains’ management of data with the Data Management Policies;
c. Promote, direct, and coordinate the Operational Level activities (20 FAM 202.1-5);
d. Define and collect metrics that assess the effectiveness and value of the data management efforts; and
e. Elevate issues to the Strategic Level (20 FAM 202.1-3) for action, as necessary.
20 FAM 102.2-2 Data Steward Roles and Responsibilities
(CT:DATA-7; 10-15-2024)
20 FAM 102.2-2(A) Data Steward Role
CT:DATA-13; 02-20-2025
Reserved.
20 FAM 102.2-2(B) Data Steward Responsibilities
(CT:DATA-13; 02-20-2025)
a. Ensure effective control and use of data assets
b. Monitor data governance at the working-level
c. Be well-versed in 20 FAM and FAH and any supplemental guidance
d. Inform and enact Tactical Level (20 FAM 202.1-4) action plans and roadmaps
e. Report data management accountability, efficiency, and effectiveness to BCDO or Bureau-Appointed Data Representative
f. Assist BCDO or Bureau-Appointed Data Representative in mapping data across disparate data systems and storages; and
g. Educating Data Users on the value of data and its management requirements.
20 FAM 102.2-3 AI Use Case Owner Roles and Responsibilities
(CT:DATA-7; 10-15-2024)
20 FAM 102.2-3(A) AI Use Case Owner Role
(CT:DATA-13; 02-20-2025)
a. Bureau or office-level authority over an AI Use Case (as designated by each bureau or office).
b. This role can be associated with an individual or position. Bureaus and offices shall ensure accounting for AI Use Case Owners remains current.
c. Each AI Use Case must have an associated owner, but owners can be associated with multiple AI Use Cases.
20 FAM 102.2-3(B) AI Use Case Owner Responsibilities
(CT:DATA-13; 02-20-2025)
An AI Use Case owner is responsible for ensuring compliance with 20 FAM 302.2 Compliance Standards (AI). Key responsibilities include:
a. Supporting the AI Use Case Inventory
1. Serve as the primary point of contact for your AI Use Case(s) during reporting periods, including the preparation of an AI Use Case Inventory update and certification described in 20 FAM 302.2-3e.
2. Report to the Responsible AI Official (RAIO) through the annual AI Use Case Inventory (see 20 FAM 302.2-3)
3. Identify AI Use Cases that are exempt from the Public AI Use Case Inventory, per E.O. 13960.
(i) For AI Use Cases that are SBU:
(A) You may request an AI Use Case be withheld from the Public AI Use Case Inventory because it is Sensitive but Unclassified (SBU).
(B) You may request an AI Use Case that is SBU be included in the Public AI Use Case Inventory.
4. Address AI Use Cases that are not compliant with the principles outlined in 20 FAM 302.2-3:
(i) You must develop a plan to ensure compliance within six months, or they must retire the application.
(ii) M/SS/CfA will work with all AI Use Case Owners to facilitate compliance within this timeframe
b. Ensuring AI Use Cases comply with minimum risk management practices for rights and safety-impacting AI.
Consistent with OMB M-24-10, Section 5(b), AI Use Case owners, in coordination with the AISC, RAIO, and CAIO, must:
1. Review each current or planned AI Use Case (see 20 FAM 302.2-3) to assess whether it matches the definition of safety-impacting AI or rights-impacting AI, as reflected in 20 FAM 301.2.
(i) When conducting such an assessment, the AI Use Case Owner must look to whether an AI output serves as a principal basis for a decision or action.
(ii) AI used for one of the purposes identified in OMB M-24-10, Appendix I is automatically presumed to be safety-impacting or rights-impacting.
2. Identify additional context-specific risks that are associated with the AI Use Case and address them as appropriate. Such risk considerations may include:
(i) Impacts to safety, security, civil rights, civil liberties, privacy, democratic values, human rights, equal opportunities, worker well-being, access to critical resources and services, Department trust and credibility, and market competition.
3. Use existing mechanisms wherever possible, (for example, the Authorization to Operate process).
4. Refer to 20 FAH-1 H-304 for detailed guidance on how to implement these minimum risk management practices.
5. Exemptions:
i. Consistent with 44 USC 3552(b)(6), 20 FAM 102.2-3(B)a(1-4) does not apply to AI when it is being used as a component of a National Security System. The practices in this section do not supersede, modify, or direct an interpretation of existing requirements mandated by law or governmentwide policy.
ii. AI Use Case owners must coordinate to ensure that the adoption of these practices does not conflict with other applicable laws or guidance.
iii. AI Use Case owners are not required to follow the minimum practices outlined in this section when using AI solely to:
(A) Evaluate a commercial capability, a potential vendor, or a freely available AI capability that is not otherwise used in Department operations, exclusively for the purpose of making a procurement or acquisition decision. See AI.State and A/OPE’s Acquisition Policy and Regulations site for existing procurement guidance, including AI.
(B) Achieve its conformity with the requirements of this section, such as using an AI application in controlled testing conditions to validate minimum testing requirements as indicated in 20 FAH-1 H-304.