Attachment 1: Artificial Intelligence Use Compliance and Risk Management Plan

Artificial Intelligence (AI) Use Compliance and Risk Management Plan Purpose: Use this when a contractor plans to use, may use, or later proposes to use AI in contract performance, but the primary deliverable is not the development or delivery of an AI system.

1. Background

Name of AI tool/system:
Contractor using the AI:
Subcontractor or service provider, if any:
Contract task/function supported:
Describe how AI will be used in contract performance:
Is AI use required to perform the work, or optional?
RequiredOptionalUnknown
AI classification:
Generative AI
Agentic AIClassical/Predictive Machine LearningComputer Vision Natural Language Processing
Reinforcement LearningOther: [Insert]
Is this use limited to contractor internal operations?
YesNo

Will the AI touch Government information, systems, identities, networks, or operations? YesNoUnknown
Was the AI system procured to support this particular contract per requirements in the Statement of Work?

2. Who owns and supports this use?
Contractor AI owner:
Contractor technical support contact:
Contractor privacy/security contact:
CDC/HHS program office using or receiving outputs:
Expected users:
Contractor staff only
CDC/HHS staffPublic usersBeneficiaries, patients, applicants, regulated entities, or other external partiesOther: [Insert]

3. Tool background

Tool or product name:[Insert]
Developer/vendor:[Insert]
Is the AI technology open-source, proprietary, Government-furnished, or other?☐ Open-source☐ Proprietary/commercial☐ Government-furnished☐ Contractor-developed☐ Subcontractor-provided☐ Other: [Insert] If the system uses an LLM or foundation model, what is the primary model?[Insert] Who provides the LLM/foundation model?[Insert]
What model options are available?[Insert]
Does it require an API key?☐ Yes☐ No☐ Unknown
Attach or link, if available:☐ Model card☐ System card☐ Data card☐ Vendor security documentation☐ Evaluation summary☐ Terms of service☐ Privacy/data retention policy☐ Audit-log documentation 4. Where is it hosted and authorized?
Hosting environment:☐ Contractor environment☐ Commercial SaaS☐ FedRAMP-authorized cloud☐ CDC/HHS environment☐ Local/offline environment☐ Other: [Insert] Where is the system hosted?[Insert country/region/cloud/provider] Is the product directly FedRAMP authorized or available through a FedRAMP-authorized instance?☐ Yes☐ No☐ Not applicable☐ Unknown If no, is it undergoing FedRAMP authorization?☐ Yes☐ No☐ Unknown