Public sources
External changes leadership should watch
The Director role also requires watching the legal, procurement and public environment around AI. I would keep this short and decision focused: what the source says, the proposed Hazen implication, who should own the response and what should trigger the next review.
Source status is separate from the proposed Hazen interpretation. Federal agency guidance is not automatically a legal mandate for Hazen. These notes are concise strategy interpretation, not legal advice. Official sources were reviewed on November 14, 2026.
Check the official OMB memoranda index (opens in a new tab)- The White HouseJanuary 23, 2025Federal policy background
Removing Barriers to American Leadership in Artificial Intelligence (Executive Order 14179)
- What the source says
- Directed agencies to review actions taken under the prior federal AI order, which had been revoked, and to identify policies inconsistent with the new approach.
- Proposed Hazen implication
- This is federal policy background, not an exhaustive statement of current direction. Agency implementation and public procurement expectations can affect client work.
- Proposed response
- Monitor current agency implementation and applicable contract terms rather than treating this order as a complete policy inventory.
- Proposed response owner
- Director of AI Strategy & Adoption with Legal and Government Affairs
- Review trigger
- New administration direction, agency implementation guidance or a relevant client contract change
- Last source review
- November 14, 2026
- Office of Management and BudgetApril 3, 2025Federal agency guidance
M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust
- What the source says
- Sets federal agency requirements for AI use, governance and high impact AI. The memorandum remains listed on the official OMB memoranda index and is referenced by current GSA guidance.
- Proposed Hazen implication
- The memorandum applies to federal agencies, not automatically to Hazen. Similar documentation, testing and oversight expectations may appear in public client work.
- Proposed response
- Review each relevant contract and RFP for incorporated requirements instead of assuming federal agency guidance is binding on Hazen.
- Proposed response owner
- IT and Legal with the affected practice leader
- Review trigger
- A federal solicitation, contract modification, agency implementation update or OMB revision
- Last source review
- November 14, 2026
- Office of Management and BudgetApril 3, 2025Federal AI acquisition guidance
M-25-22: Driving Efficient Acquisition of Artificial Intelligence in Government
- What the source says
- Sets principles for federal AI procurement, including competition, interoperability, risk and lifecycle management. The memorandum remains listed on the official OMB memoranda index and is referenced by current GSA guidance.
- Proposed Hazen implication
- The memorandum applies to federal agency acquisition. Hazen implications depend on the specific client, contract and flow down terms.
- Proposed response
- Include contract specific procurement, vendor and data obligations in AI intake and project review.
- Proposed response owner
- Procurement and Legal with IT
- Review trigger
- A federal procurement, proposed subcontract, changed flow down clause or updated acquisition guidance
- Last source review
- November 14, 2026
- National Institute of Standards and TechnologyCreated April 6, 2026; updated July 17, 2026Profile in development
Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure
- What the source says
- NIST is developing an AI risk profile for critical infrastructure. It is not a final profile or a mandatory standard.
- Proposed Hazen implication
- Water infrastructure is a high consequence setting where risk, testing and accountability matter. Any Hazen response should track the profile's actual development stage.
- Proposed response
- Compare proposed governance with drafts as they emerge and reassess when a final profile is published.
- Proposed response owner
- Data and Technology with Risk and critical infrastructure practice leads
- Review trigger
- A new NIST draft, workshop, final profile or client requirement referencing the profile
- Last source review
- November 14, 2026
- National Institute of Standards and TechnologyInitial public draft August 7, 2026; comment period ended October 6, 2026Initial public draft; comment period closed
TEVV Athlon Framework for Evaluating AI Systems
- What the source says
- NIST released an initial public draft framework for testing, evaluation, verification and validation of AI systems. It is not a final standard, and the comment period is closed.
- Proposed Hazen implication
- The draft offers an input to repeatable evaluation decisions without establishing a mandatory Hazen requirement.
- Proposed response
- Assess useful evaluation concepts for controlled tools and watch for a revised or final publication.
- Proposed response owner
- AI and machine learning engineering with Quality and subject matter experts
- Review trigger
- A revised draft, final framework or material change to an AI evaluation approach
- Last source review
- November 14, 2026
- U.S. General Services AdministrationFederal procurement guidance
Buy SI
- What the source says
- GSA guidance supports bounded pilots, data flow analysis, security review and procurement review when agencies buy AI.
- Proposed Hazen implication
- These practices can inform Hazen's vendor review, but federal guidance does not itself create a Hazen mandate.
- Proposed response
- Adapt relevant pilot, data flow, security and procurement questions to the actual vendor and contract.
- Proposed response owner
- IT and Procurement with Cybersecurity and Legal
- Review trigger
- A new AI vendor, material platform change, updated GSA guidance or contract renewal
- Last source review
- November 14, 2026
- U.S. Environmental Protection AgencyWater sector resource collection
Cybersecurity Planning
- What the source says
- EPA collects cybersecurity planning resources for water and wastewater systems, including incident response and a procurement checklist. This is not a new AI regulation.
- Proposed Hazen implication
- AI vendors and integrations should fit within existing utility cyber resilience, incident response and procurement practices.
- Proposed response
- Include AI vendors and integrations in existing cybersecurity and procurement review where utility projects require it.
- Proposed response owner
- Cybersecurity with utility project leads
- Review trigger
- A utility security requirement, new integration, incident response change or EPA resource update
- Last source review
- November 14, 2026