DHS AI Waiver Authority Lets One Official Override Any Prohibition
What happened
The Department of Homeland Security released an updated AI use directive in September 2026, largely continuing its 2025 predecessor but with governance changes that carry significant downstream risk. As reported in What's new in Homeland Security's updated AI policy, the revised directive creates a new waiver authority. It allows the agency's chief AI officer to exempt any requirement from the policy's coverage. This includes outright prohibitions on mass surveillance and tracking. No independent review from privacy or civil rights offices is required. No congressional notice is triggered. Waivers carry no expiration date. The update also strips out language on equity and sustainability, and narrows the chief privacy officer's formal role in protecting civil liberties. New open-source code-sharing requirements were added, aligned with OMB Memorandum M-26-04: Increasing Public Trust in AI Through Unbiased AI Principles. For vendors selling AI products and services to DHS, these changes alter the compliance environment significantly.
Why it matters
- ·Vendors with DHS contracts may face new obligations or reduced protections. The waiver mechanism means prohibited uses that once anchored procurement contracts as hard limits can now be activated for specific programs. This can occur without public notice, requiring contract and scope reviews.
- ·The weakening of privacy officer oversight at DHS removes a check that enterprise vendors often relied on. That check helped assess whether a federal customer's AI use was within acceptable civil liberties bounds. Its removal raises reputational and liability exposure for vendors whose tools are used in waived programs.
- ·The removal of equity language reduces the formal basis for bias and fairness audits within DHS programs. This could affect how vendors structure their own NIST AI Risk Management Framework (AI RMF 1.0) and Playbook obligations when selling into federal markets.
Stay ahead of stories like this
Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Review all active and pending DHS contracts to identify whether any AI use case was previously constrained by the directive's prohibited-use list, and assess what it means if that constraint can now be waived without notice.
- ☐Ask your legal and procurement teams whether existing contract language requires DHS to notify your organization if a waiver is granted that changes the permitted scope of your AI tools or data.
- ☐Update your vendor due diligence questionnaire for federal agency customers to include questions about internal waiver mechanisms that could expand AI use into areas your acceptable-use policies prohibit.
- ☐Assess whether your organization's AI risk disclosures to boards or investors accurately reflect the possibility that federal customers may operate your tools under waived prohibitions.
- ☐If your organization provides AI tools used in DHS border, immigration, or law enforcement programs, brief your chief privacy officer on the weakened oversight structure and document the risk assessment.
What to watch next
Vendors should monitor whether other federal agencies adopt similar waiver structures in their own AI directives. This is especially important in law enforcement and intelligence contexts where civil liberties oversight is most consequential. Congressional interest in the DHS waiver mechanism may produce oversight hearings or legislative proposals that impose external limits on agency AI policy changes. The White House Artificial Intelligence Oversight Framework and future OMB Memorandum M-26-04: Increasing Public Trust in AI Through Unbiased AI Principles guidance may signal the administration's views. Specifically, whether it considers unchecked agency waiver authority consistent with its own stated AI governance commitments.