DHS posts late AI inventory with thinner risk files

FedScoop’s read of the updated Department of Homeland Security AI inventory is the uncomfortable one: DHS did more disclosure, but not consistently enough for the disclosure to do its job. The inventory arrived months after OMB’s April 3 deadline for high-impact AI use cases to meet minimum risk-management practices or be safely discontinued. DHS then filled in many of those risk-management fields, while also walking back some impact designations and sunsetting others.

That matters because “high-impact” is not a decorative label. Under OMB’s framework, these are systems whose outputs can serve as a principal basis for decisions or actions with legal, material, binding, or significant effects on rights or safety. FedScoop reports DHS has more than 50 such use cases in different deployment stages. The minimum practices include pre-deployment testing, impact assessments, adverse-impact monitoring, human training, fail-safes, appeal processes, and user feedback paths. Those are the controls that tell outsiders whether the agency has treated a system as operational infrastructure or as a spreadsheet with better adjectives.

The weakest part of the update is the downgrade trail. Customs and Border Protection changed “Traveler Self-Service Mobile Identity” from high-impact to “presumed high-impact but determined not,” did not provide a justification, and removed previously completed risk-management sections, according to FedScoop. DHS did provide a justification for another downgrade, the “Consular Consolidated Database” use case, saying its outputs are not a principal basis for a decision or action and that it functions as an advanced search tool for visa applicant data.

That inconsistency is the story. A downgrade may be legitimate. Not every AI-adjacent tool is a high-impact system, and agencies should not over-classify just to avoid criticism. But the moment an agency lowers the risk label, the explanation becomes more important, not less. DHS has prior inventory credibility problems too: GAO found in 2024 that DHS did not verify whether each inventory entry was correctly characterized as AI and that one of two cybersecurity entries was not AI at all (https://www.gao.gov/products/gao-24-106246). So the practical Monday question is simple: if the risk label changes, where is the record that lets counsel, oversight staff, and affected program offices trust the change?