Finding AI policy and standards sources

A policy claim is only as reliable as the document behind it. Start by naming the type of document, because each comes from a different place and carries different weight: a law passed by Congress, a regulation issued by an agency, an executive order signed by the President, guidance published by an agency, or a standard developed by a standards organization. Then check four things on the original text: when it was published, whom it applies to, its status (draft, final, under revision, or revoked), and whether a later document replaced it. This page walks through those checks using NIST's AI Risk Management Framework, read today. It is general information, not legal advice.

Five types of documents

• Legislation: laws enacted by Congress, published as public laws and compiled by subject in the United States Code. For example, 15 U.S.C. 9401(3) defines "artificial intelligence" for the chapter on the National Artificial Intelligence Initiative; the Government Publishing Office's 2024 edition credits it to Pub. L. 116-283, division E, section 5002, enacted January 1, 2021.
• Executive orders and other presidential actions: directions to the executive branch, signed by the President, posted by the White House, and published in the Federal Register with an executive order number.
• Regulations: binding rules issued by agencies, published in the Federal Register and compiled in the Code of Federal Regulations (CFR). Export controls are an example: the Export Administration Regulations (EAR), issued by the Commerce Department's Bureau of Industry and Security (BIS), are 15 CFR parts 730 to 774.
• Agency guidance: frameworks, profiles, and guidelines that an agency publishes, often for voluntary use. The AI RMF is one.
• Standards: documents developed through standards organizations. NIST says its AI "zero drafts" will be submitted "into the private sector-led standardization process" for development into voluntary consensus standards, and its standards page quotes the AI RMF Roadmap's list of related international standards, such as ISO/IEC 22989 and ISO/IEC 24028.

A news article, a fact sheet, or a company blog post can point you to one of these, but it is not the document itself.

Worked example: the NIST AI Risk Management Framework

Find the issuing page. NIST's framework page says the AI RMF was released on January 26, 2023, and is "intended for voluntary use." It lists companion documents (a Playbook, a Roadmap, and Crosswalks), a Generative AI Profile released July 26, 2024 (NIST-AI-600-1), and a concept note for a critical infrastructure profile released April 7, 2026.

Pin the exact document. The publication page gives the report number, NIST AI 100-1, the publication date, January 26, 2023, and a permanent identifier, doi.org/10.6028/NIST.AI.100-1 (external site: doi.org). Its abstract opens: "As directed by the National Artificial Intelligence Initiative Act of 2020 (P.L. 116-283)." Cite the report number and DOI.

Check status and versions. The PDF's "Update Schedule and Versions" section calls the framework "a living document," expects a review with formal community input "no later than 2028," and uses two-number versions: the first number changes only with major revisions, minor revisions add ".n" (for example, 1.1), and changes are tracked in a Version Control Table. As of October 1, 2026, the framework page also states: "The AI RMF 1.0 is being revised as part of the White House AI Action Plan." So 1.0 is the published version and a revision is under way; reload the page before citing "the current AI RMF."

Separate drafts from final text. The page lists prior documents, including a concept paper (December 13, 2021) and two drafts (March 17 and August 18, 2022). NIST's standards page lists newer ones, such as an initial public draft of NIST AI 300-1 (July 29, 2026), with input considered through September 16, 2026. A draft shows what an agency proposed, not what it adopted.

Note the jurisdiction. The AI RMF is guidance from a U.S. federal agency and is described as voluntary. Whether another document, such as a contract or a state law, makes any part of it binding on a particular organization is a separate question.

Names, addresses, and dates can change

On September 29, 2026, the President signed an executive order titled "Inaugurating the Era of Super Intelligence." It directs executive agencies, "to the maximum extent permitted by law," to use "Super Intelligence" and "SI" in place of "Artificial Intelligence" and "AI" in non-statutory documents. It says that nothing in that section requires changing previously issued regulations, presidential actions, or other historical documents, and it defines the new terms by reference to the statutory definition at 15 U.S.C. 9401(3).

That one order has three dates. It was signed on September 29, the Federal Register's public inspection copy (EO 14434) was filed on October 1, and that copy says it is "scheduled to be published in the Federal Register on 2026-10-02."

NIST's pages show the effects. A NIST topic page says NIST is "working to update its communications to incorporate the term 'super intelligence' as directed." The former address of NIST's AI standards page now redirects to a "Super Intelligence Standards" page, marked "Updated September 30, 2026." The page at nist.gov/caissi names the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), while items published earlier use Center for AI Standards and Innovation (CAISI). The AI RMF publication page still uses its original title. When you search agency sites, try both sets of terms and keep the URL you actually read.

Check for a superseding document

A compilation can reprint text that is no longer in effect. The 2024 edition of the U.S. Code on govinfo reproduces Executive Order 14110 of October 30, 2023 as a note under 15 U.S.C. 9401; the page read today does not mention any revocation. The Federal Register's record for that order lists: "Revoked by: EO 14148, January 20, 2025." For executive orders, check the Federal Register's disposition notes.

For regulations, use a compilation that states its currency date. On October 1, 2026, the eCFR reported Title 15 as up to date as of September 30, 2026. BIS's own EAR viewer, which draws on the eCFR, says it "is not an official legal edition" and asks anyone relying on it for legal research to confirm findings in the official editions.

For guidance and standards, look for version numbers, "supersedes" or "withdrawn" notices, and the issuing body's list of prior documents.

When you need professional advice

Finding the text is research. Deciding how it applies to a particular product, export, contract, or person depends on the facts and calls for a qualified attorney. For export questions, BIS also offers consultations with its export counselors. USASI does not track legal obligations, and nothing in this catalog is legal advice (disclaimer).

What you can do next

• Open the NIST record and the record for Dioptra, NIST's open-source test platform for AI models.
• Browse organizations that are standards bodies or public institutions.
• See how the catalog orders sources by preference and records dates (methodology, dates, reviewed date).
• For any policy claim, write down six things: document type, issuing body, signing or publication date, jurisdiction, status, and any later document that replaced it.

Sources

All read on October 1, 2026.

• NIST: AI Risk Management Framework (external site: nist.gov); Artificial Intelligence Risk Management Framework (AI RMF 1.0), publication page (external site: nist.gov) and PDF (NIST AI 100-1) (external site: nvlpubs.nist.gov); Super intelligence (external site: nist.gov); Super Intelligence Standards (external site: nist.gov) (reached from www.nist.gov/artificial-intelligence/ai-standards); CAISSI (external site: nist.gov)
• The White House: Inaugurating the Era of Super Intelligence (external site: whitehouse.gov) (September 29, 2026)
• Office of the Federal Register: public inspection copy of EO 14434, document 2026-20321 (external site: public-inspection.federalregister.gov) and its API record (external site: federalregister.gov); API record for Executive Order 14110 (external site: federalregister.gov)
• U.S. Government Publishing Office, govinfo: 15 U.S.C. 9401, United States Code, 2024 edition (external site: govinfo.gov)
• Bureau of Industry and Security: Export Administration Regulations (EAR) (external site: bis.gov)
• eCFR: Title 15 currency data (external site: ecfr.gov) and 15 CFR 730.1 (external site: ecfr.gov) (developer API)