DHS AI policy waiver: what the revised directive says

A new DHS AI policy waiver lets the department's chief AI officer set aside almost any requirement in its internal AI directive, including bans on prohibited uses. FedScoop reported the change on October 21, 2026, and related coverage followed the next day. Critics say the revision opens a major loophole in how the department uses AI for surveillance-sensitive work, and no public DHS response appeared in the coverage available for this story.

The directive is numbered 139-08, and the current text is labeled Revision 01 in a DHS PDF. The chief AI officer may grant a waiver only if the exception remains consistent with law, regulation and governmentwide policy. MeriTalk quotes the directive as allowing a waiver of "any requirement of this Directive and implementing policy, including prohibited uses of AI at DHS." Any waiver must come with documented technical and operational reasons, MeriTalk reports.

Why critics call the waiver a loophole

The strongest objections concern process. According to FedScoop, the chief AI officer can waive any provision without independent review by privacy or civil-rights offices, without notice to Congress or the public, and without a set expiration date. A time-limited exception forces a second look when it lapses. An open-ended one can become standing practice without anyone voting on it.

Levinson-Waldman, as quoted by FedScoop, said: "A loophole big enough to drive a truck through." Just Security argues that the waiver authority creates an enormous loophole in the existing guidance. Its analysis centers on DHS's AI inventory and the limits of federal AI transparency law, which matters because an inventory is one of the few public windows into what the department runs. A list of tools shows what DHS uses. It does not show whether a waiver removed the rules that would otherwise apply.

The directive still bans unlawful or improper systemic, indiscriminate, or large-scale monitoring and tracking of individuals, according to FedScoop and Hoodline. The prior version, Revision 00, was issued in January 2025 and barred AI uses such as improper large-scale surveillance, according to a January 2025 DHS PDF. The open question is whether that protection holds when the same document lets one official waive any requirement, prohibited uses included.

What else the revision changes

Beyond the waiver, MeriTalk reports that the revision adds rules for sharing AI assets, prioritizes domestically developed technology and changes the language on human oversight. The coverage does not spell out the new oversight wording, so readers should check the directive text before deciding how much human review actually changed.

The emphasis on domestic technology fits a broader pattern. FedScoop has reported on an earlier DHS memo that restricted commercial generative AI tools in favor of internal tools such as DHSChat. Steering staff toward in-house systems gives the department more direct control over what it deploys, which makes the waiver question more consequential for the tools it chooses.

Timeline: when the DHS AI directive took effect

The sources agree on some dates and disagree on others:

  • January 2025: Revision 00 is issued and bars AI uses such as improper large-scale surveillance.
  • September 2026: The revised directive takes effect, according to FedScoop.
  • October 2026: FedScoop says the directive was released "earlier this month."
  • October 21, 2026: FedScoop publishes its report.
  • October 22, 2026: Related coverage follows.

MeriTalk says the directive was "quietly issued last month," which would put its release in September. The two accounts do not match, and the coverage does not resolve the gap. The timing matters because it determines how long the waiver authority has existed without public notice.

How ICE data contracts fit the story

Hoodline describes the policy as arriving as ICE expands data contracts nationwide. That framing connects the directive to people who live with data-driven immigration enforcement. The sources do not detail those contracts, their dollar values or which AI tools they involve, so treat the link as reporting rather than an established account of how any specific system will be used.

The people most directly affected are those subject to DHS and ICE data-driven enforcement, along with civil-liberties groups and privacy advocates who depend on oversight of federal surveillance. Federal contractors that sell AI tools to DHS may also face shifting compliance expectations. That point is an inference, not a reported finding.

The wider fight over federal and state AI rules

The DHS change is separate from the fight over preempting state AI laws, but both concern who sets the rules. Executive Order 14365, signed December 11, 2025, directed a Justice Department task force to challenge state AI laws, according to CASRAI. In Congress, a discussion draft called the Great American AI Act would preempt state laws on how AI models are developed for three years, as Broadband Breakfast reports. That draft has not been filed as a bill.

Military AI is drawing similar scrutiny. Researchers at Google DeepMind quit over US and Israeli military AI work, and the Army's proposed ECHOTRIBBLE AI program raises related questions. These cases involve different agencies and different rules, but they share a question: who approves AI uses in sensitive settings, and how visible those decisions remain.

What to watch next and what readers can do

Routine consumers have no direct action to take. Anyone who wants to follow the story can start with the directive and the reporting around it:

  • Read the DHS directive PDF and find the waiver section, the prohibited-uses list and the human oversight language.
  • Watch for DHS's annual AI inventory and any waiver reporting, and check whether waivers come with the documented technical and operational reasons the directive requires.
  • Look for DHS to clarify whether any waivers have been issued. FedScoop reports the department has not said.
  • If your company sells AI tools to DHS, ask your compliance team how the revision affects your contracts.

The next signals will be concrete. A DHS statement answering the criticism, a published waiver or a letter from lawmakers would tell the public far more than the directive's wording alone. Congress has not reported any action on the waiver provision. Whether DHS publishes its waiver decisions will shape how much trust the public can place in the directive.