The Department of Homeland Security’s updated artificial-intelligence policy retains restrictions on certain uses of AI but gives the department’s chief AI officer authority to waive requirements in the directive. That includes restrictions on AI-enabled mass surveillance, raising questions about what safeguards remain when the official responsible for AI policy can set its requirements aside.
The directive took effect in September 2026 and is largely in line with the 2025 version in scope and overall content, according to FedScoop. It retains a ban on using AI for unlawful or improper systemic, indiscriminate or large-scale monitoring, surveillance or tracking of individuals. The 2025 directive also barred relying on AI outputs as the sole basis for law-enforcement actions or for denying government benefits, FedScoop previously reported.
The significant change is the authority to waive those requirements. FedScoop reports that the chief AI officer may waive any provision, including prohibited uses, without independent review by privacy or civil-rights offices, notice to Congress or the public, or a specified expiration date. The waiver must still be consistent with law, regulation and government-wide policy, according to Just Security.
Advocates Call the Waiver a Loophole
Rachel Levinson-Waldman identified the waiver authority as a central concern, telling FedScoop that it could allow officials to justify policy conflicts rather than resolve them.
Tom Bowman told FedScoop, “a rule that comes with its own off switch is not a rule.” He also warned that an AI model developed for one DHS mission could be reused by another component for a different purpose, without the privacy and civil-rights justification that applied to its original use.
Equity Language Stripped, Open-Source Push Added
The update also changes the policy’s emphasis: it removes or edits language promoting equity and referring to underserved communities, environmental efficiency and sustainability, FedScoop reported. Separately, it directs DHS to share custom-developed code, AI models, use cases and related data within the department and across the federal government, and to release and maintain that code as open-source software in a public repository.
Bowman told FedScoop that the open-source preference could improve transparency if DHS follows through. The outlet also noted a change in how the policy describes the chief privacy officer’s role: the revised language raises a question about whether that officer is responsible for ensuring AI does not erode privacy protections or for confirming compliance with established guardrails.
A Widening AI and Surveillance Footprint
The policy update lands as DHS's AI footprint keeps expanding. The department's latest AI use-case inventory contained 158 active applications, and that inventory classifies six Immigration and Customs Enforcement use cases and 19 Customs and Border Protection use cases as actively deployed, high-impact AI systems, according to Just Security's review of the data.
A separate 2019 CBP biometric pilot also had a documented data-security failure. The Department of Homeland Security inspector general reported that subcontractor Perceptics transferred traveler images to its own company network without CBP’s knowledge or authorization and that approximately 184,000 images were compromised. That incident concerned unauthorized handling of data, not DHS’s current waiver authority, according to the DHS Office of Inspector General.
ICE has been busy on the procurement side too. The agency awarded Thomson Reuters Special Services a five-year data-and-analytics agreement with a ceiling of $125 million, running through September 29, 2031, Biometric Update reported. The outlet noted the contract's justification described continuous monitoring of as many as one million people or entities, automated alerts, graph-based analysis and model-based risk scoring. The Thomson Reuters award followed ICE's abandonment of a proposed sole-source acquisition after what the agency called industry feedback, and ultimately drew just one bid. It came separately from a roughly $45.8 million contract ICE awarded Palantir Technologies in June to modernize Homeland Security Investigations' case-management and analytics systems, per the same outlet.
A Pattern DHS Has Been Building For Years
The shift from pilot programs to full governance frameworks has been underway at DHS for a while. The department moved from appointing a chief AI officer and issuing an early roadmap for piloting AI in investigations, disaster planning and officer training toward today's more formalized rules, according to the Brennan Center for Justice. DHS also built out a roughly 50-person AI Corps through a hiring surge, the Brennan Center noted, even as the Government Accountability Office found the department's public accounting of its AI use incomplete and lacking a cohesive method for identifying which programs actually rely on the technology.
The current directive itself traces back to a 2025 policy that superseded a statement issued by then-Secretary Alejandro Mayorkas in August 2023, FedScoop has reported. The 2025 version was issued in January 2025, before an Office of Management and Budget memorandum from April 2025 directing federal agencies to pursue AI innovation while identifying high-impact uses and disclosing minimum safeguards, according to Just Security's reporting on the memo. Just Security also noted that the 2025 OMB memo dropped an earlier requirement that agencies measure and mitigate bias in their AI systems.
