Re: Request for Information—Regulatory Reform on Artificial Intelligence

To Whom It May Concern:

I submit this comment in response to OSTP’s Request for Information on regulatory reform for artificial intelligence (AI). I write as a professor of economics at George Mason University and a senior fellow at the Mercatus Center. I study regulation and institutional design and engage with tribal leaders on economic development and public administration.

Summary

This comment proposes regulatory and guidance actions that agencies can implement without new legislation.^[1] It focuses on a tribes-as-states parity, identity assurance, and targeted steps that reduce compliance costs and speed responsible AI adoption by tribal governments. It adopts a simple three-tiered data rule: (1) personal data protected by existing privacy law, (2) tribe-designated nonpublic cultural knowledge accessed by license, and (3) public information that remains open. For infrastructure, it favors “security by control”—customer-managed encryption keys, auditable access logs, and choice of on-prem, sovereign-enclave, or major-cloud hosting—rather than rigid data-location mandates.

Priority Reforms (Owner, Lever, Metric)

1. Tribes-as-states parity in AI governance (cross-cutting).

Set a default parity rule: When AI policy grants states discretion or streamlined pathways, tribes receive the same treatment unless a statute clearly provides otherwise. Update program manuals and grant guidance to reflect parity and to avoid routing everything through states.

Owner: OSTP and the Office of Management and Budget (OMB). Lever: policy memorandum and OMB guidance. Metric: number of programs with parity language; time to approval for tribal applications versus states.

2. Identity assurance using tribal systems (security, interoperability).

Recognize tribal identity providers that meet National Institute of Standards and Technology (NIST) digital-identity assurance standards and accept tribe-issued digital credentials for federal relying parties. Provide technical assistance so tribes can operate identity services that meet the specifications.

Owner: Department of Homeland Security (DHS) with NIST and Department of the Interior (DOI)/the Bureau of Indian Affairs (BIA). Lever: DHS/NIST implementation guidance; DOI/BIA technical assistance. Metric: number of approved tribal identity providers; adoption by federal relying parties.

3. Programmatic primacy for tribal operations (cooperative-federalism parity).

For AI systems used by tribal governmental agencies and tribally controlled entities, federal programs should recognize tribal AI governance policies as the primary compliance framework in Indian Country, so long as those policies align with the NIST “AI Risk Management Framework”^[2] and applicable federal privacy and security baselines. Agencies should update program manuals to avoid duplicative state requirements, accept tribal policy attestations in lieu of state signoffs, and use reciprocity checklists to speed approvals. 

Owner: OMB and OSTP; DOI/BIA, Indian Health Service (IHS), Department of Justice (DOJ), Department of Housing and Urban Development (HUD)/Bureau of Indian Education. Lever: guidance and reciprocity checklist. Metric: approval time for tribal policies; number of programs that publish primacy or reciprocity language.

4. Paperwork Reduction Act fast-track for small tribal AI pilots (organizational factors; lack of clarity).

Create a categorical, time-limited fast-track under the Paperwork Reduction Act (PRA) for tribal AI pilots that use de-identified data and standard disclosures. Publish model consent and plain-language notices that tribes can adopt without legal drafting.

Owner: OMB. Lever: generic clearance and template notices. Metric: median PRA approval time for tribal pilots; number of pilots launched.

5. Security by control, not location—FedRAMP reciprocity with strong customer controls.

Create an expedited FedRAMP^[3] path for cloud AI services that are used by tribal governments and that must interoperate with federal systems. Require customer-managed encryption keys, auditable access logs, data portability, and residency options—such as on-premise, sovereign enclave, or major cloud—so tribes choose the model that fits risk and cost. Use shared security packages, authorization to operate (ATO) reciprocity, and short checklists sized for small agencies.

Owner: General Services Administration/FedRAMP with NIST. Lever: FedRAMP baseline and reciprocity bulletin; control checklist. Metric: number of tribal ATOs using reciprocity; days from submission to authorization; percent using customer-managed key (CMK)/bring-your-own key (BYOK).

6. Clarify grant and procurement rules for AI-as-a-Service (regulatory mismatch). 

Clarify, in Federal Acquisition Regulation (FAR) and OMB A-130 guidance, that tribes may use federal grant funds to procure AI-as-a-Service directly when solutions rely on open and consensus standards. Avoid duplicative state intermediation and reduce cost. 

Owner: OMB with the Office of Federal Procurement Policy. Lever: A-130 clarification and FAR class deviation or guidance. Metric: number of tribal procurements approved; reduction in average procurement cycle time.

7. Tribal data control framework—tiered, rights-based approach.

Adopt a tiered framework that distinguishes: (A) personally identifiable tribal citizen data covered by existing privacy law; (B) designated nonpublic cultural or traditional knowledge explicitly identified by a tribe as restricted, treated as confidential intellectual property licensed by contract; and (C) public information and general knowledge, which remains open to research and journalism. Publish model licenses and templates for tier B that allow authorization, conditions, and pricing, while leaving public information unaffected.

Owner: OSTP, National Telecommunications and Information Administration (NTIA), DOI, and DOJ. Lever: model licenses and explanatory guidance. Metric: number of tier B licenses; turnaround times; compliance audit results.

8. Model interagency data-sharing templates (data practices; testing and validation). 

Publish model agreements for privacy-preserving data exchange across health, housing, courts, and administration. Align with HIPAA and 42 C.F.R. Part 2; include standard de-identification and audit provisions; reference tribal law where applicable; write for nonlawyers. Ensure templates are consistent with the tiered data framework.

Owner: NTIA, HHS/IHS, DOI, and DOJ. Lever: joint model memoranda of understanding and technical appendices. Metric: number of executed agreements; time to signature; audit pass rates.

Why Tribal Context Matters

Federal programs often route through states, but tribes do not fit that template. They need direct paths to acquire, test, and govern AI tools in clinics, schools, courts, land offices, and public safety. They also need predictable data rules across DOI, HHS, HUD, NIST, and NTIA. Without clarity, agencies and vendors stall, and pilots die.

Pilot Proposal: Tribal AI Innovation Cohort

Coordinate a cohort of 14 early-adopter tribes to test the reforms in this comment. Commit to the parity rule, the PRA fast-track, FedRAMP reciprocity with customer controls, and the tiered data framework. Track simple metrics: time to deployment, cost to comply, and measurable service improvements, such as days to schedule a clinic visit or days to complete a housing application. Publish metrics quarterly.

Implementation Details

Publish model documents within 90 days. Name a point of contact at each agency. Hold quarterly office hours for tribes and vendors. Track and publish timelines and error rates. Keep forms short. Avoid bespoke waivers when a model template solves the problem.

Closing

These steps remove friction without changing statutes. They speed responsible AI use where it delivers the most value per dollar. I would welcome the chance to participate in an OSTP roundtable with DOI, HHS, HUD, NIST, OMB, and tribal leaders to finalize templates and timelines.