Question 1

How does an evidence record map to NIST AI RMF?

Accepted Answer

A Planisphere evidence record is the evidence layer for the MEASURE function and feeds the MANAGE function's risk-treatment decisions. The record captures the probe set, metrics, run conditions, drift delta, and a sha-256-pinned Merkle root, which internal or external compliance maps to MEASURE 2.1/2.3/2.4/2.5/2.13. The framework's GOVERN and MAP functions remain organizational work the record informs but does not perform; Planisphere supplies measurement, not the full RMF program.

Question 2

What's the difference between OMB M-25-21 and M-25-22?

Accepted Answer

M-25-21 governs federal agencies' own use of AI — it defines high-impact AI and the minimum practices (impact assessment, pre-deployment testing, monitoring, human oversight). M-25-22 governs how agencies acquire AI — anti-lock-in, performance and risk-monitoring contract clauses, and protection of government data. Both issued 2025-04-03 and replaced the prior M-24-10/M-24-18 pair. Planisphere produces measurement evidence relevant to the testing and monitoring obligations in both, without acting as a contracting or authorization authority.

Question 3

How does Planisphere map to the DoW Responsible AI tenets?

Accepted Answer

The DoD/DoW Responsible AI principles (responsible, equitable, traceable, reliable, governable) and the CDAO RAI Toolkit emphasize traceability and reliability of fielded models. Planisphere directly serves the traceable and reliable tenets: it produces a reproducible, sha-pinned record of how a fielded model behaves and whether it has drifted. It does not adjudicate the equitable or governable tenets, which are program-governance judgments; it supplies the measurement evidence those judgments rely on.

Question 4

What does the CDAO RAI Toolkit / GenAI Guardrails require for fielded models?

Accepted Answer

The CDAO RAI Toolkit guides teams through assessing and documenting AI risk across the lifecycle, and the GenAI guardrails push for testing, monitoring, and human oversight of fielded generative models rather than fixed numeric thresholds. The throughline is documented, repeatable evidence of behaviour over time. Planisphere produces that fielded-model behaviour-and-drift record; it is an input to the Toolkit's documentation, not a substitute for the program's own risk assessment.

Question 5

Did EO 14179 replace the Biden AI executive order?

Accepted Answer

Yes — EO 14179 ("Removing Barriers to American Leadership in AI," Jan 2025) revoked the prior administration's EO 14110 and reframed federal AI policy around innovation and reduced regulatory friction. It does not itself impose new private-sector testing mandates; the binding agency obligations now live in OMB M-25-21 and M-25-22. Treat the EO as the policy frame and the OMB memos as the operative requirements; Planisphere tracks the operative testing-and-monitoring duties.

Question 6

What is the AI Action Plan and does it create testing duties?

Accepted Answer

The AI Action Plan is the policy program flowing from EO 14179, emphasizing American AI leadership and lighter-touch regulation rather than prescriptive private-sector testing rules. Concrete, enforceable testing and monitoring duties for federal AI use come from OMB M-25-21 (high-impact minimum practices), not the Plan itself. Because policy here is moving, treat specifics as subject to change; Planisphere measures model behaviour against a fixed probe set regardless of which policy frame is current.

Question 7

Is ISO/IEC 42001 certification required for federal AI?

Accepted Answer

No US federal mandate currently requires ISO/IEC 42001 certification. It is a voluntary AI management-system standard (the AI analogue of ISO 27001) that agencies and vendors adopt to demonstrate governance maturity, and it increasingly appears in procurement expectations. Planisphere does not issue 42001 certification — only an accredited certification body can — but its reproducible measurement evidence supports the operational-control and monitoring clauses a 42001 audit examines.

Question 8

How does SHA-256 pinning make an AI audit record tamper-evident?

Accepted Answer

SHA-256 (FIPS 180-4) produces a fixed 256-bit digest where any change to the input — one bit in the model, probe set, or result — yields a completely different hash, and the function is collision-resistant. Pinning each artifact by its digest and binding them into a Merkle root means internal or external compliance recomputes the hashes and detects any alteration. That is what makes a Planisphere record tamper-evident: a third party can recompute the root and confirm nothing changed, without trusting the producer.

Question 9

What goes in an SBOM for a federal AI deployment?

Accepted Answer

A software bill of materials lists the components, versions, suppliers, and dependency relationships of the deployed system, typically in SPDX or CycloneDX, so consumers can track vulnerabilities and provenance. For an AI deployment the practice extends toward model and data lineage (sometimes called an AI-BOM), though that is still maturing. Planisphere does not generate your SBOM; it pins the audited model and probe set by hash so the thing measured is unambiguously identified alongside whatever SBOM you maintain.

Question 10

Is SCITT a final standard yet?

Accepted Answer

Not yet — SCITT (Supply Chain Integrity, Transparency, and Trust) is an emerging IETF architecture for registering signed records on a transparency service; its core documents are still progressing through standardization, so treat it as forward-looking rather than a settled requirement. The underlying idea — append-only, independently checkable evidence records — is what matters. Planisphere already produces Merkle-rooted, sha-pinned records compatible with that direction; it does not depend on SCITT being finalized.

Question 11

Is CMMC required now, or is it still being phased in?

Accepted Answer

CMMC is final and live: the 48 CFR DFARS final rule published 2025-09-10 and took effect 2025-11-10, so the requirement is real today and being phased into solicitations on a schedule. Phase 1 began with self-assessment levels; higher-assurance Level 2 certification in contracts ramps through later phases (into 2026). Planisphere does not perform a CMMC assessment — that is a self-assessment or a C3PAO's role — but it can supply reproducible model-behaviour evidence for AI components touching the relevant 800-171 controls.

Question 12

When does CMMC Level 2 certification become mandatory in contracts?

Accepted Answer

Level 2 third-party certification phases into DoD solicitations over the rollout that began when the rule took effect 2025-11-10, with the broader Level 2 certification requirement reaching contracts through 2026 under the phased schedule; the exact date for a given award depends on its phase and contracting officer. Check the specific solicitation. Planisphere provides AI-behaviour evidence supporting the underlying 800-171 controls; it does not grant or schedule the certification.

Question 13

What evidence does a C3PAO expect for AI under CMMC Level 2?

Accepted Answer

A C3PAO assesses your implementation of the NIST SP 800-171 controls protecting CUI — for AI components that means audit logging (AU), system integrity and monitoring (SI), access control, and configuration management evidence around the model and its data. The assessor wants documented, repeatable proof, not assertions. Planisphere can produce the reproducible model-behaviour record that backs the SI/AU-flavoured controls; the C3PAO renders the assessment verdict, Planisphere does not.

Question 14

How do I show AI model behavior evidence for NIST SP 800-171 controls?

Accepted Answer

Tie the model's behaviour to the relevant 800-171 control families — primarily Audit and Accountability (3.3.x) and System and Information Integrity (3.14.x) — with a documented, repeatable evaluation and a tamper-evident record. Planisphere generates that: a fixed probe set, recorded metrics, a re-run cadence for monitoring, and a sha-pinned record internal or external compliance can recompute. It evidences the controls; it does not assert full 800-171 compliance on your behalf.

Question 15

How do I get an ATO for a generative AI capability under the AI RCC pilots?

Accepted Answer

The path is the standard RMF (SP 800-37) lifecycle — categorize, select and implement controls, assess, and have an authorizing official accept the residual risk — applied to the generative-AI capability, with the AI Rapid Capabilities Cell pilots providing accelerated pathways. The differentiator for gen-AI is evidence that model behaviour is tested and monitored over time. Planisphere produces that reproducible behaviour-and-drift evidence for the assessment step; the ATO decision remains the authorizing official's.

Question 16

Does DFARS 252.204-7012 apply to AI systems handling CUI?

Accepted Answer

Yes — if a contractor's AI system stores, processes, or transmits Covered Defense Information / CUI, DFARS 252.204-7012 applies, requiring NIST SP 800-171 safeguarding and rapid (72-hour) cyber-incident reporting. The AI component is in scope like any other system touching CUI. Planisphere can supply reproducible behaviour evidence for the AI's 800-171-relevant controls; it does not handle incident reporting or assert full clause compliance for you.

Question 17

Is the HHS §1557 patient-care-decision-support-tools rule still in effect in 2026?

Accepted Answer

The 2024 §1557 rule includes a provision (effective 2025) barring discrimination through patient-care decision-support tools, requiring covered entities to make reasonable efforts to identify and mitigate discrimination risk from such tools — and that provision is the operative one for AI. Parts of the broader rule have faced litigation, so confirm current status for your situation, but the decision-support-tool nondiscrimination duty is what governs clinical AI. Planisphere supplies cohort-comparison evidence to support the mitigation effort; it does not provide legal advice on the rule's status.

Question 18

How do I audit a clinical algorithm for §1557 nondiscrimination?

Accepted Answer

Section 1557 requires reasonable efforts to identify and mitigate the risk that a decision-support tool discriminates on a protected basis, which in practice means measuring performance across protected cohorts and documenting the mitigation steps taken. Reproducible, comparable measurement across groups is the core evidence. Planisphere measures model behaviour across cohorts and emits a sha-pinned record of it; it surfaces disparity for your mitigation, it does not certify nondiscrimination or render a legal conclusion.

Question 19

What's the difference between §1557's algorithm provision and its gender-identity provisions?

Accepted Answer

They are distinct parts of the §1557 rule: the patient-care decision-support-tool provision targets discrimination via clinical algorithms and AI, while separate provisions address discrimination on the basis of sex including gender identity — different subjects, different legal histories, and different litigation exposure. The algorithm provision is the one relevant to AI auditing. Planisphere addresses only the decision-support-tool measurement; the gender-identity provisions are outside what it measures and are a legal matter for counsel.

Question 20

Does AI output have to meet FRE 702 reliability standards?

Accepted Answer

When AI output is offered through an expert, FRE 702 already governs the expert's reliance on it, and the 2023 amendment sharpened the court's gatekeeping over whether the opinion reliably applies its methods. Proposed FRE 707 would extend 702-style reliability scrutiny to machine output offered without an expert. Either way, reliability is the test. Planisphere's reproducible measurement helps meet that standard; it does not itself qualify as expert testimony or provide legal advice.

Question 21

What did the 2023 FRE 702 amendment change for expert testimony?

Accepted Answer

The 2023 amendment clarified two things: the proponent must show each admissibility requirement is more likely than not met (reinforcing the judge's gatekeeping role), and the expert's opinion must reflect a reliable application of the methodology to the facts — language aimed at overstated or unsupported expert conclusions. It raised the rigor on reliability. Planisphere produces reproducible evidence an expert can rely on; it does not replace the expert or render legal conclusions.

Question 22

Does FERPA let us put student records into an AI tutor?

Accepted Answer

FERPA allows sharing education records with a vendor only under an exception — most commonly the school-official exception, which requires the vendor perform a service the school would otherwise do, stay under the school's direct control, use the data only for authorized purposes, and not re-disclose it. An AI tutor that trains on or repurposes the records typically breaks that exception. Planisphere is designed to measure model behaviour without ingesting student records; it does not establish your FERPA basis or provide legal advice.

Question 23

How do we audit an AI admissions tool for Title VI disparate impact?

Accepted Answer

You audit it by measuring admission recommendations and error rates across racial and national-origin cohorts on a fixed, representative probe set, documenting any disparity and the mitigation taken — Title VI reaches both intentional discrimination and, through agency regulations, disparate impact. Reproducible cross-cohort measurement is the evidence. Planisphere produces that as a sha-pinned record without ingesting applicant PII where designed; it surfaces disparate impact for your review, it does not make the Title VI determination or give legal advice.

Question 24

What does a NIST AI RMF GOVERN program look like for a federal agency?

Accepted Answer

GOVERN is the cross-cutting function — 6 categories and 19 subcategories — that establishes the risk culture: policies, accountable roles (often the Chief AI Officer under M-25-21), inventory of AI uses, and processes that make MAP, MEASURE, and MANAGE repeatable. For a federal agency it is the documented program that ties AI risk handling to leadership and oversight. Planisphere lives in MEASURE, not GOVERN; it feeds the measurement evidence a GOVERN program oversees but does not itself constitute the governance structure.

Question 25

What ongoing-monitoring evidence does M-25-21 expect?

Accepted Answer

M-25-21 expects high-impact AI to be monitored after deployment so that performance degradation or drift is caught, mapping to NIST AI RMF MEASURE 2.4 (monitor functionality and behaviour in production). Useful evidence is a recurring, comparable evaluation against a stable probe set with a recorded delta between runs. Planisphere's single-business-day re-run cadence produces that drift delta as a reproducible artifact; it surfaces behaviour change, it does not decide the remediation.

Question 26

Which NIST AI RMF MEASURE subcategories can a third party evidence?

Accepted Answer

A third party can evidence the measurement-flavoured subcategories: MEASURE 2.1 (documented test sets, metrics, TEVV tools), 2.3 (performance under deployment-like conditions), 2.4 (in-production monitoring), 2.5 (validity, reliability, generalizability limits), and 2.13 (effectiveness of the TEVV process itself). Planisphere maps to each via the probe set, a reproducible fielded run, the re-run cadence, a documented coverage ceiling, and a bit-exact replay verdict. It does not cover human-subject (2.2), environmental (2.12), or the privacy/fairness adjudications of 2.10/2.11.

Question 27

Does NIST AI RMF require independent / third-party evaluation?

Accepted Answer

The AI RMF is voluntary and does not mandate a third-party evaluator, but MEASURE 1.3 calls for evaluation by parties independent of the development team where feasible, and many downstream regimes (e.g. NYC LL 144) do require independence. An external, reproducible audit is the strongest way to satisfy that framing. Planisphere runs as an independent instrument and emits a record anyone can recompute; it measures model behaviour and does not issue a certification.

Question 28

How do I prove pre-deployment testing for a federal AI system?

Accepted Answer

M-25-21 requires high-impact AI to be tested in a realistic context before deployment and re-evaluated over time. Proof means a documented, repeatable evaluation: a fixed probe set, recorded metrics, the conditions of the run, and a way for internal or external compliance to reproduce the result. Planisphere generates exactly that artifact — a bit-exact, reproducible fielded-fleet run with a sha-256-pinned, Merkle-rooted record a third party can recompute — which evidences the testing practice without certifying that the system is safe or compliant overall.

Question 29

What AI clauses must federal contracts include after Sept 2025?

Accepted Answer

M-25-22 directs agencies to build AI acquisitions around anti-vendor-lock-in terms, rights to performance and risk-monitoring data, protection of government data from being used to train vendor models without consent, and ongoing performance monitoring of the delivered system. Exact clause language flows through agency acquisition guidance and the FAR. Planisphere can supply the recurring, reproducible performance-and-drift evidence such monitoring clauses call for; it does not draft contract terms or render legal advice.

Question 30

How do I prevent AI vendor lock-in in a federal contract?

Accepted Answer

M-25-22's anti-lock-in posture favours portability: rights to your data and outputs, documented interfaces, the ability to export models or artifacts, and avoiding proprietary formats that trap you with one vendor. An independent, reproducible audit supports this because the evidence is vendor-neutral and recomputable by anyone. Planisphere emits a sha-pinned record a third party can verify without the vendor's cooperation; it measures behaviour and does not negotiate or certify the contract.

Question 31

What does OMB M-25-21 require for high-impact AI?

Accepted Answer

OMB M-25-21 (issued 2025-04-03) classifies an AI use as high-impact when its output is a principal basis for a decision with a legal, material, or safety effect on people. Such uses must satisfy seven minimum practices before deployment — including an AI impact assessment, pre-deployment testing in a realistic context, ongoing monitoring, and human oversight — or be discontinued. Planisphere supplies the measurement layer for the testing and monitoring practices: it produces a reproducible, sha-pinned record of how the model behaves; it does not itself make the high-impact determination or grant an authority to operate.

Question 32

What counts as "high-impact AI" under the federal AI memo?

Accepted Answer

Under M-25-21 an AI use is high-impact when its output serves as a principal basis for decisions or actions that have a legal, material, binding, or safety-relevant effect on rights or access to benefits — for example eligibility, medical, or safety determinations. The memo lists presumed categories and an agency Chief AI Officer makes the final call. Planisphere does not adjudicate that classification; once a use is designated high-impact, it measures the model's behaviour against a fixed probe set so the pre-deployment-testing and monitoring obligations have evidence behind them.

Question 33

How does SLSA provenance satisfy SSDF requirements?

Accepted Answer

The SSDF (NIST SP 800-218) Protect-Software (PS) practices call for protecting software and verifying its integrity; SLSA provenance — signed, verifiable build attestations — is a concrete way to evidence PS.3 (archive and protect each release) and PS.2 (provide a mechanism to verify integrity). Mapping SLSA build provenance to the PS practices gives auditors a machine-checkable chain. Planisphere applies the same provenance idea to the audit artifact itself: the record is signed and recomputable, so its integrity is verifiable independent of trust in the producer.

Question 34

How does ISO 42001 Annex A map to an AI audit?

Accepted Answer

Annex A lists roughly 9 control topics and ~42 AIMS controls — the auditable surface a 42001 assessor walks. The performance-evaluation and operational-monitoring controls map cleanly to reproducible model measurement: documented evaluation, monitoring over time, and evidence of effectiveness. Planisphere supplies that measurement artifact for the relevant Annex A controls; it does not cover the governance, policy, or human-resources controls, and it does not stand in for an accredited certification audit.

Question 35

Which NIST 800-53 controls cover AI audit logging?

Accepted Answer

The Audit and Accountability (AU) control family governs audit logging — AU-2 (event selection), AU-3 (record content), AU-6 (review/analysis), AU-9 (protection of audit information), and AU-10 (non-repudiation) are the load-bearing ones for an AI evidence trail. The Assessment/Authorization/Monitoring (CA) family covers the recurring re-assessment cadence. Planisphere's sha-256-pinned, Merkle-rooted record gives AU-9/AU-10-style tamper-evidence and non-repudiation for the measurement record; it complements, not replaces, the system's own audit logging.

Question 36

What is FedRAMP 20x and how does it change the authorization timeline?

Accepted Answer

FedRAMP 20x is the program's modernization push toward machine-readable, automated authorization — replacing slow document-centric reviews with continuously verifiable Key Security Indicators (KSIs) so authorization and continuous monitoring become faster and more data-driven. The aim is a shorter, evidence-rich path to authorization. Planisphere fits this direction by emitting reproducible, machine-verifiable evidence for the AI components; it supplies KSI-style monitoring artifacts, it does not grant the FedRAMP authorization.

Question 37

How do I produce machine-readable KSI / continuous-monitoring evidence?

Accepted Answer

Produce evidence as structured, automatically verifiable artifacts on a recurring cadence rather than as periodic prose — digitally signed, timestamped, and recomputable. For an AI system that means a repeatable evaluation with recorded metrics and a drift delta between runs. Planisphere's single-business-day re-run produces exactly that: a sha-pinned record internal or external compliance can machine-verify, aligned with the FedRAMP 20x KSI direction; it measures behaviour and feeds your ConMon, it does not replace it.

Question 38

What's the difference between an ATO and a FedRAMP authorization?

Accepted Answer

An ATO (Authority to Operate) is a single agency's risk-acceptance decision for a system under RMF (SP 800-37). A FedRAMP authorization is a standardized cloud-service authorization — via the program's baseline and continuous monitoring — that other agencies can reuse, avoiding a fresh review per agency. FedRAMP is essentially a reusable, cloud-specific ATO. Planisphere supplies measurement evidence that informs either decision; it is not itself an authorizing official.

Question 39

Is FedRAMP High enough for DoD, or do I also need an Impact Level?

Accepted Answer

Generally both: FedRAMP High covers the commercial cloud-security baseline, but DoD layers its own Impact Levels (IL2/IL4/IL5/IL6) under the Cloud Computing SRG for the sensitivity of the workload — IL5/IL6 add NSS and classification requirements FedRAMP High alone does not address. So FedRAMP High is often a prerequisite, not a substitute, for the IL you need. Planisphere measures AI behaviour inside whichever boundary applies; it does not assign your Impact Level.

Question 40

Which DoD Impact Level do I need — IL4, IL5, or IL6 — for my AI workload?

Accepted Answer

It tracks data sensitivity: IL4 covers CUI and non-critical mission data, IL5 covers higher-sensitivity CUI and unclassified National Security Systems, and IL6 covers information classified up to SECRET. The right level is set by the data your AI workload handles and the contracting requirement, not by the model itself. Planisphere runs the audit inside whichever accredited boundary applies, with no egress; it measures model behaviour and does not assign your Impact Level.

Question 41

What are the steps in the RMF (SP 800-37) authorization lifecycle?

Accepted Answer

RMF has seven steps: Prepare, Categorize the system, Select controls, Implement them, Assess their effectiveness, Authorize (the authorizing official accepts residual risk and issues the ATO), and Monitor continuously. It is a lifecycle, not a one-time gate — the Monitor step loops back. Planisphere maps to the Assess and Monitor steps for AI components, supplying reproducible behaviour evidence and a re-run cadence; it does not perform categorization or issue the authorization.

Question 42

How does SHA-256 pinning support continuous monitoring under RMF?

Accepted Answer

The RMF Monitor step requires ongoing assurance that the assessed system has not silently changed. Pinning the model, probe set, and results by SHA-256 and binding them into a recomputable root means each monitoring run is comparable to the last and any alteration is detectable. Planisphere's recurring, sha-pinned re-run gives the Monitor step tamper-evident, comparable evidence; it surfaces change, the authorizing official decides on re-authorization.

Question 43

Does auditing my model risk an ITAR deemed-export of the weights?

Accepted Answer

It can, if the model weights are ITAR-controlled technical data and the audit exposes them to a foreign person or a foreign location — that exposure is a deemed export. The mitigation is to keep the weights inside the controlled boundary and have only US persons and accredited systems touch them. Planisphere runs in-boundary with no egress so the audit itself need not move the weights; it measures behaviour locally, but the export determination on your specific artifacts is your counsel's call, not Planisphere's.

Question 44

Are AI model outputs considered ITAR or EAR controlled technical data?

Accepted Answer

It depends on the content and the model's purpose: outputs directly tied to USML defense articles can be ITAR technical data, while dual-use outputs may fall under the EAR (EAR99 or a CCL classification), and much general output is uncontrolled — classification is fact-specific. Recent AI-diffusion rules also reach certain model weights and compute. Planisphere does not classify your data under ITAR/EAR; it keeps the audit in-boundary so you can run it without an unintended export, and the legal classification stays with your export-control counsel.

Question 45

Are AI model weights subject to EAR export controls?

Accepted Answer

Some are — recent Commerce/BIS rules extend the Export Administration Regulations toward advanced AI model weights and the compute used to train them, alongside long-standing controls on dual-use technology (EAR99/CCL). Whether a specific model's weights are controlled is a fact- and threshold-specific classification that is still evolving, so treat it as a moving target. Planisphere keeps the audit inside your boundary so measuring the model does not itself trigger an export; it does not perform the EAR classification.

Question 46

Can I run a compliance audit on an air-gapped or SCIF AI system?

Accepted Answer

Yes — Planisphere's audit is designed to run with no network egress, which is what an air-gapped or SCIF deployment requires. The probe set and tooling execute locally against the model, and the resulting sha-pinned record can be carried out and verified offline. The point is that the audit needs no phone-home; Planisphere measures model behaviour inside the boundary and does not transmit the model or data outside it.

Question 47

How do I deploy AI evidence collection at IL5/IL6 without network egress?

Accepted Answer

Run the audit entirely inside the accredited boundary: the probe set, the model, and the compliance-check tooling sit on the same side of the air gap, and only the sha-pinned evidence record — not the model or sensitive data — needs to move, and even that can be hand-carried. Because the record is independently recomputable, an external compliance can later check it without ever touching the classified system. Planisphere collects behaviour evidence; the accreditation of the enclave itself remains the program's responsibility.

Question 48

Can a third party recompute my evidence record without my model?

Accepted Answer

Checking the record's integrity needs only the record: a third party recomputes the SHA-256 digests and the Merkle root to confirm nothing was altered, with no access to your model. Re-running the measurement from scratch would require the model and probe set, which stays inside your boundary. This separation is deliberate — integrity is publicly checkable while the model never leaves the enclave; Planisphere proves tamper-evidence, not model disclosure.

Question 49

Can a Medicare Advantage plan use AI to deny coverage?

Accepted Answer

CMS guidance (notably the 2024 MA rule and follow-on FAQs) is clear that an algorithm or AI tool cannot be the sole basis to deny or terminate coverage — a Medicare Advantage plan must base medical-necessity decisions on the individual patient's circumstances and applicable coverage criteria, with the tool only as an aid. AI may inform, not replace, the individualized determination. Planisphere can evidence how a utilization-management model behaves; it does not make or certify the coverage decision.

Question 50

How do I show my utilization-management algorithm assessed the individual patient?

Accepted Answer

You need a record that the determination turned on patient-specific clinical facts and coverage criteria, not solely a model score — documentation of the inputs, the clinician's individualized review, and the model's defined, bounded role. Reproducible evidence of how the model behaves on representative cases supports that the tool was an aid, not the decider. Planisphere measures and documents that model behaviour; the individualized clinical assessment and its record remain the plan's responsibility.

Question 51

When did the ONC HTI-1 predictive-DSI requirements take effect?

Accepted Answer

ONC's HTI-1 final rule published in early 2024, and the predictive-DSI transparency and intervention-risk-management requirements for certified health-IT carried a compliance date of 2025-01-01. Developers of certified Decision Support Interventions had to meet the source-attribute and risk-management expectations by then. Planisphere supplies measurement evidence relevant to the validation and monitoring elements; it does not certify your health-IT or set the compliance date.

Question 52

How do I demonstrate FAVES for a predictive DSI?

Accepted Answer

FAVES — fair, appropriate, valid, effective, and safe — is the quality bar HTI-1 attaches to predictive DSIs, and you demonstrate it with documented validation, performance measurement across relevant subpopulations, and ongoing monitoring rather than a single declaration. Reproducible, comparable evaluation evidence is the backbone. Planisphere measures the valid/effective/fair-relevant behaviour against a fixed probe set and tracks drift; clinical appropriateness and safety determinations remain the developer's and clinician's responsibility.

Question 53

How can an AI tool deployment audit produce one evidence record across HTI-1, §1557, FDA PCCP, and CMS at once?

Accepted Answer

Because these regimes share a common measurement core — does the model perform as claimed, across subpopulations, and has it drifted — one reproducible evaluation can produce evidence each regime reads against its own controls. Planisphere runs the probe set once and emits a single sha-pinned record that maps to HTI-1's validation attributes, §1557's nondiscrimination check, a PCCP's drift bounds, and CMS's individualized-assessment framing. It is one measurement, many mappings; it does not replace each regime's separate filing or determination.

Question 54

What are the 31 source attributes required for predictive DSI under HTI-1?

Accepted Answer

ONC's HTI-1 rule requires certified health-IT to surface 31 categories of "source attribute" information about predictive Decision Support Interventions — covering the model's purpose, development details, the data used, fairness and validation approach, and how it should be used and monitored — so clinicians can judge a prediction's trustworthiness. They function as a transparency label. Planisphere does not author your source attributes, but its reproducible validation-and-drift evidence supports the validation, performance, and ongoing-monitoring attributes.

Question 55

Do I have to keep HTI-1 source attributes updated, and how often?

Accepted Answer

Yes — the source attributes must reflect the DSI as it currently performs, so when the model, its data, or its validated performance changes, the attributes must be updated; HTI-1 frames this as ongoing rather than one-time, tied to the intervention's lifecycle. A recurring measurement helps you detect when an update is due. Planisphere's re-run cadence produces a drift delta that flags performance change; it informs when attributes need refreshing, it does not edit the attributes for you.

Question 56

What goes in an FDA Predetermined Change Control Plan (PCCP)?

Accepted Answer

A PCCP describes, in advance, the modifications you intend to make to an AI/ML device function, how you will implement them (the modification protocol), and the impact assessment showing the device stays safe and effective within those bounds — letting you update the model without a new marketing submission for changes inside the plan. The key is pre-specified, bounded change with monitoring. Planisphere's drift evidence shows whether the model stayed inside its declared bounds; it does not author or clear the PCCP.

Question 57

Can I update my AI model after 510(k) clearance without a new submission?

Accepted Answer

Yes, if the change falls within an FDA-authorized PCCP cleared with your device — modifications inside the predetermined protocol can be made without a new 510(k); changes outside it generally still require a new submission. The PCCP is what buys that flexibility. Planisphere helps by producing reproducible drift evidence showing whether updates stayed within the plan's bounds; the regulatory determination of what needs a new submission is FDA's and your regulatory team's.

Question 58

How do I prove my AI model hasn't drifted since validation?

Accepted Answer

You prove it by re-running the same fixed evaluation periodically and comparing results — a stable probe set, recorded metrics, and a documented delta between the validation baseline and each later run, with tamper-evident records. Planisphere does exactly this: its single-business-day re-run produces a bit-exact-comparable, sha-pinned drift delta against the baseline. It measures and documents drift; deciding whether a given drift is acceptable remains your clinical and regulatory call.

Question 59

Does my AI feature need FDA 510(k) or De Novo clearance?

Accepted Answer

If your AI feature meets the definition of a medical device (Software as a Medical Device) — intended to diagnose, treat, or inform clinical decisions in a way that makes it a device function — it generally needs clearance: a 510(k) if a predicate exists, or De Novo for a novel low-to-moderate-risk type with no predicate. Pure administrative or wellness features often fall outside. The device determination is FDA's; Planisphere supplies model-behaviour evidence for whichever pathway applies, it does not decide your regulatory status.

Question 60

What are the 10 Good Machine Learning Practice (GMLP) principles?

Accepted Answer

GMLP is a set of 10 guiding principles jointly issued by FDA, Health Canada, and the UK MHRA for AI/ML medical devices — spanning multidisciplinary expertise, good software and data practices, representative datasets, independence of training and test data, human-factors and clinically meaningful performance, and monitoring deployed models for performance and drift. They are principles, not a checklist with thresholds. Planisphere maps most directly to the performance-evaluation and deployed-model-monitoring principles via reproducible measurement; the others are development-practice commitments.

Question 61

Is an ambient AI scribe a HIPAA business associate, and what does the 2025 Security Rule NPRM change?

Accepted Answer

An ambient AI scribe vendor that creates, receives, maintains, or transmits ePHI on a covered entity's behalf is generally a business associate and needs a BAA. HHS's 2025 Security Rule NPRM proposes to modernize and strengthen safeguards — moving toward more mandatory technical controls — but it is a proposed rule, not yet final, so treat its specifics as not-yet-binding. Planisphere does not establish your BAA or HIPAA posture; it can measure AI behaviour without ingesting PHI where designed to.

Question 62

Does the proposed HIPAA Security Rule require encryption and MFA for AI systems?

Accepted Answer

The 2025 NPRM proposes to make a number of currently "addressable" safeguards mandatory — including encryption of ePHI and multi-factor authentication — and to add controls like network segmentation, which would reach AI systems handling ePHI. Because it is still a proposed rule, the requirements are not yet in force and may change before finalization. Planisphere measures model behaviour and is not the system of record for ePHI safeguards; confirm final requirements with counsel.

Question 63

Who is liable when a physician follows an AI recommendation that causes harm?

Accepted Answer

Under current FSMB guidance and state medical-board policy, the physician retains ultimate responsibility for patient care — using an AI tool does not transfer the standard-of-care obligation, so a physician who follows a recommendation remains accountable for the clinical judgment, with potential vendor liability a separate question. The tool informs, the physician decides. Planisphere can evidence how the AI tool behaves, which supports the physician's diligence, but it assigns no liability and provides no legal advice.

Question 64

What do state medical boards say about using AI in clinical decisions?

Accepted Answer

State medical boards, guided by FSMB's 2024 framework, generally treat AI as a tool that must not displace the physician's independent judgment: the physician stays responsible for the standard of care, must understand the tool's limits, and in some states must address patient transparency. Specifics vary by state. Planisphere supplies model-behaviour evidence supporting a physician's understanding of the tool; it does not substitute for board guidance or legal advice in a given state.

Questions.

Compliance pins.