Determinations, Exceptions, and Waivers

Before the detail — Artifact: section 5 of the record. Status of what follows: binding where M-25-21 applies; the exception register is common baseline elsewhere.

Prompt first: four shells and an applicability map

Here is Meridian's AI inventory - ten systems [paste
ai-inventory.yaml] - and the release-decision record template's
section 5.

1. Draft four document SHELLS, one each, with a signer line and the
   fields the text below names:
   a. rebuttal of a presumed high-impact determination (addressed to
      the CAIO)
   b. pilot authorization (the four conditions as fields)
   c. commercial exception (gate skipped, evidence level accepted,
      owner, expiry, compensating measure)
   d. federal waiver (recertification date, report date, public
      summary text)
2. Draft a table: system id / which of a-d could apply / why.
   Mark EVERY applicability NEEDS-OWNER. Do not decide whether any
   system is high-impact; Lesson 1.3's tier record decides that.

The shells are the agent’s; the applicability is not. Which of the ten systems touches the federal contract, which is a pilot, which owner will sign an exception — each is a fact the register holds and a decision the tier record made, and an agent that “helpfully” assigns the waiver to the resume screener has just made a determination it has no authority to make.

Four documents, four signers

Section 5 is short in the finished record — for MU-AI-004 it reads “not presumed high-impact; no exceptions open; no federal waiver applies; nothing published” — but each of those clauses stands for a document that could exist, and the four are not interchangeable:

DOCUMENT                       SIGNER                       SAYS
rebuttal of a presumed         the use-case owner, in       "this use does not meet
  high-impact determination      writing to the CAIO          the definition, because"
pilot authorization            the pilot sponsor, with      "limited, tracked, opted
                                 the CAIO's certification     into, practices applied"
commercial exception           the system's risk acceptor   "this gate is skipped at
                                                              this evidence level until"
federal waiver                 the CAIO, and no one else    "a minimum practice is
                                                              waived; here is why; public"

Legend: CAIO is the agency’s Chief AI Officer; “use-case owner” is the program official the register names. Meridian’s federal-facing system sits under a contract that incorporates the federal requirements, so the agency determines applicability and its CAIO holds the federal signatures; Meridian prepares the evidence each document needs. The other nine systems see only the third instrument. Choosing the wrong document is an audit finding by itself: an “exception” on a high-impact federal use is a waiver by another name, missing its signer and its public summary.

Rebutting a presumed determination

M-25-21 (OMB’s April 2025 memo governing federal AI use) presumes certain uses high-impact — Lesson 1.3 covered the principal-basis test and the presumed list. A use on that list is high-impact until a written notice to the CAIO (the agency’s Chief AI Officer) says otherwise and says why. The rebuttal is a determination, not an exception: it argues the definition does not apply, it does not ask to skip a gate. Its evidence is section 1 — purpose, who is affected, what the output is the principal basis for. If the argument needs the word “usually” (“the score is usually reviewed by a recruiter”), it is not a rebuttal; it is a description of a high-impact system with an oversight condition. An unwritten assumption that a use is not high-impact is rediscovered at assessment, when the clock is worst.

The pilot authorization

The memo exempts a pilot from the minimum practices on four conditions: limited scale and duration; certified by the CAIO and centrally tracked; opt-in or opt-out for affected people where possible; and the practices applied where practicable. All four are fields in the document, and the first is the one that erodes — a pilot that is renewed is not limited in duration, and a pilot that added users is not limited in scale. The record’s decision line carries PILOT-ONLY for exactly this case, with the same valid-through date as any other decision. A pilot without a written end is a production system with a cheaper name.

The commercial exception: what an AI exception adds

Exceptions with an owner and an expiry are taught elsewhere — Zero Trust 6.4 (a separate training in this series: exceptions expire, owners named) and Federal Delivery 6.4 (the POA&M holds the exceptions) — and this lesson does not reteach the register. What is different about an AI exception is two fields. It names the gate it skips: not “the evaluation” but which gate in section 3 — the attempt curve, a subgroup slice, the target-system run. And it names the evidence level it accepts in place of the gate: “approved on local-run evidence for the sealed set; target-system run due by the expiry.” An exception that says “testing deferred” has skipped every gate at once and accepted no level, which is not an exception but an unsigned approval. The compensating measure is usually a condition from section 4 tightened — a smaller audience, a recruiter in the loop.

The waiver, the discontinue rule, and what becomes public

The federal waiver is the fourth document and the one with the most rules attached. Under M-25-21 a waiver of a minimum practice is signed by the CAIO and is non-delegable; it is recertified annually; it is reported to OMB (the White House office that issues federal IT policy) within 30 days; and the agency publishes a summary of its waivers — or a public statement that none exist. Around the waiver sits the discontinue rule: a high-impact use that does not meet the minimum practices and holds no waiver “must safely discontinue.” There is no fifth state where a non-compliant system keeps running quietly; the choices are compliance, a signed waiver, a certified pilot, or a safe stop.

Then the part that is a leadership obligation, not a paperwork one. The 2025 inventory guidance makes the agency’s use-case inventory a public CSV at agency.gov/ai, and the waiver summaries are public. A federal-facing AI system is, by design, a system the public can look up, and a waiver on it is a public statement that a safeguard was set aside and who signed for that. M-25-22 (OMB’s April 2025 memo on federal AI procurement) adds the contract side: sunset criteria and the closeout transfer of data and derived assets, so the end of the use is written before the start. The handoff artifact is section 5 itself — the clause the agency’s package cites. Commercial readers have no public register and no discontinue rule; the exception register is voluntary and internal, and that is the not-equivalent line for this seam. Enterprise policy on which gates may ever be waived belongs to the leadership training planned for AI adoption; here, section 5 records which instrument covers one system.

Stop and escalate when someone proposes an “exception” for the federal-facing system on a minimum practice — that is a waiver, only the CAIO can sign it, and drafting it as an internal exception is not a shortcut but a discontinue-rule violation with a paper trail.

Practice status — among organizations that gate AI releases, commercial and federal

Scale: required | common baseline | strong optional | reference-shop (seen only at organizations that publish their own practice) | emerging

Key takeaway

Section 5 is four documents that are not interchangeable: a rebuttal argues the definition and goes to the CAIO in writing; a pilot runs on four conditions with a written end; a commercial exception carries the owner and expiry taught elsewhere plus two fields that are new — the gate it skips and the evidence level it accepts; and the federal waiver is the CAIO’s alone, recertified annually, reported within 30 days, and public, with the discontinue rule waiting for any high-impact use that holds none of them. Leadership’s part is knowing that the inventory and the waivers are public. Lesson 5.5 runs the gate that produces the decision all of this attaches to.

LEADERSHIP DECISION   know which of the ten systems can carry which
                      instrument, and that a federal waiver is public
                      and yours to obtain from the CAIO, not to sign
PRACTITIONER ACTION   draft the four shells with the agent, let the
                      tier record decide applicability, and write
                      every exception with its gate and evidence level
SUCCESS MEASURE       zero systems found running under an instrument
                      nobody signed - the discontinue-rule finding
                      avoided