Homeland Security’s updated AI inventory raises more questions than it answers

The Department of Homeland Security posted an updated AI inventory this week, reflecting its implemented risk management practices for high-impact use cases and other changes. 

The inventory comes months past the April 3 deadline set by the Office of Management and Budget. While sources said it’s better late than never, some of the changes outlined raised more questions than they answered. 

“DHS deserves credit for revisiting its AI inventory rather than just letting it gather dust for a year,” said Tom Bowman, policy counsel for the Center for Democracy & Technology’s Security and Surveillance Project. “But the revisions themselves are puzzling and uneven.” 

OMB distinguishes high-impact use cases from others due to their ability to serve as a principal basis for decisions or actions that have a legal, material, binding or significant effect on rights or safety. DHS has more than 50 high-impact use cases in various stages of deployment. 

High-impact use cases must meet several requirements, including pre-deployment testing, impact assessments, adverse impact monitoring, adequate human training, appropriate fail-safes that minimize harm, consistent appeal processes, and options for end users to submit feedback.  

If a high-impact use case was not compliant with the minimum practices by April 3, OMB directed agencies to “safely discontinue” it. 

“We should all have pretty big questions about what was happening between April and July for these use cases that previously did not have information about the risk management practices that were in place,” said Quinn Anex-Ries, a senior policy analyst focused on equity and civic tech at CDT.

DHS did not respond to a request for comment prior to publication. 

“At the end of the day, this shouldn’t be a box-checking exercise just to make OMB happy,” Anex-Ries added. “It should really be a reflection of an agency doing their due diligence to make sure that a tool is used safely, following the risk management practices that they’re legally obligated to follow under OMB’s guidance.”

Altered impact statuses

In the updated AI inventory, DHS altered some of the impact statuses of use cases compared to the version it posted in January. 

A few uses were walked back from their high-impact designation to “presumed high-impact but determined not.” Customs and Border Protection made the change for its “Traveler Self-Service Mobile Identity” use case. The DHS unit did not provide a justification for the downgrade and erased the previously filled-in risk management sections. 

“This may be the most troubling entry in the set,” Bowman said. “CBP had previously done the work, but then deleted the evidence of it.”

OMB directs agencies to review presumed high-impact use cases and encourages agencies to identify additional context-specific risks that are associated with the given use case. OMB does not, however, require these use cases to meet the same standards as high-impact ones. 

“The moment DHS decides a system is lower risk than it first thought, the file gets thinner,” Bowman said. “The determination that requires the most explanation is the one that comes with the least.”

DHS did give a justification for its downgrade of the “Consular Consolidated Database” use case, explaining that the outputs are not a principal basis for any decision or action and serves as an advanced search function for Visa applicant data. The tool is used by U.S. Citizenship and Immigration Services officers during screenings of Visa applications, tapping facial recognition technology to detect fraud.

“A written justification is the minimum standard every downgrade should meet,” Bowman said. “They are inconsistent in applying this … and it makes it really, really difficult to understand what’s going on behind the scenes.”

The only use case to get bumped up to a high-impact classification was the Transportation Security Administration’s screening tool, called “Answer Engine.” While DHS did not give a justification for the upgrade, it did provide information into its risk management practices.

“This is one place where the inventory got more honest,” Bowman said. “It shows that this reclassification process can work.” 

The use case went live June 11, months past OMB’s deadline requiring high-impact use cases to have the appropriate risk management practices. DHS said an appeal process, which is one of the required risk management practices, was not applicable. 

Bowman said the decision represented another “inconsistency” in how DHS approached filling out the inventory. 

“This is one where this could result in somebody being denied the freedom to travel or denied their personal liberty and being detained or held,” Bowman said. “It feels like we have multiple people that are checking over the work and not doing the same thing, yet both signing off on it.”  

Modified deployment statuses 

Another trend found in the updated AI inventory is modified deployment statuses for use cases. 

Immigration and Customs Enforcement moved its “License Plate Capture and Analysis” tool back to a pilot, though it did not offer a justification for the change. The agency did, however, remove any information about the high-impact use case’s risk management. 

“It deleted every safeguard field,” Bowman said. “Admittedly, those fields all previously read ‘in-progress,’ which is thin, but this leaves more questions than it answers.”

High-impact use cases that are in pilot phases are exempt from the minimum risk management practices so long as the program is limited in scale and duration, among other requirements, per OMB’s guidance. DHS said its license plate capture tool became operational in September 2025.

Even for pilots, minimum risk management practices are supposed to be “applied where practicable,” according to OMB. 

ICE also modified its “Real-Time Language Translation Services” use case, developed with Microsoft Azure, from pre-deployment to deployment, but the inventory identifies a deployment start date of June 2025. The previous inventory did not contain a date for when the tool went live.

“To DHS’s credit, this entry is what a good disclosure looks like,” Bowman said, pointing to the agency’s disclosure of the vendor, risks associated and mitigation practices.

“The uncomfortable part is that a high-impact tool used in immigration interviews was operational for a full year before the public inventory said so,” Bowman added. “ICE — intentionally or not — hid this from the public.”

Retired and deleted use cases 

Among DHS’s changes to its inventory were retired and removed use cases. 

The agency deleted its entry for a TSA use case called “AskTSA” that served as an assistant for human agents in categorizing queries and summarizing customer concerns. The tool had been deployed since December 2024. A justification did not accompany the removed use case.

“The inventory gives you a sense of what they are willing and/or able to reveal,” said Valerie Wirtschafter, a Brookings Institution fellow focused on artificial intelligence and emerging technology. “It’s a window in, but it also shows the variability in who’s filling these out, too.”

Four use cases have been retired since the agency put out its 2025 inventory in January. One was used by the Coast Guard and referred to as “FLIR 280 HD.” The high-impact tool was used for detection of distressed persons in water. While the previous inventory identified the tool as in a pilot phase, it has been operational since September 2024. 

CBP also retired a “not high-impact” source code development tool, though it did not provide a start date. The use case had previously been identified as in a “pre-deployment” phase. 

“As I look through that inventory, it looks like ‘let’s throw spaghetti against the wall and see what sticks,’” said Wade Billings, one of the founders of the D.C.-based think tank Theia Institute, which focuses on emerging technologies, cybersecurity, AI ethics and governance. “That’s where organizations, both private and public, are going through right now: determining what is appropriate for use and what isn’t.” 

Two of the other retired use cases come from ICE, and both were labeled as high-impact. ICE’s “Hurricane Score” was used to evaluate case information for noncitizens that remain in their communities while cases are processed instead of being held in an immigration facility. The tool would score these people from one to five, with higher scores indicating that an individual may try to depart secretly and evade detection. The use case was first deployed in February 2019. 

“My guess is it didn’t actually help them in the way that they intended for it to,” Wirtschafter said. “Building a predictive model of somebody’s potential to abscond based on demographic and behavioral variables are the kind of things that have been the results of high-level controversies in other nations.” 

The other AI use case retired by ICE was an AI-assisted resume screening tool that was first deployed in January 2026.  

“The problem is there is bias in AI systems, and that bias is causing ageism, racism and all kinds of isms,” Billings told FedScoop. 

AI-powered resume screening tools also lead to candidates reworking resumes in order to meet certain markers that the systems prefer. 

“Unless you know how to play the game, unfortunately you’re sidelined,” Billings said. “That is unfair.”

The tool’s retirement comes amid scrutiny of ICE’s rapid workforce expansion and vetting processes. 

“Other agencies can learn a lot from what DHS is attempting to do here because a lot happens in the span of a year that is important for the public to learn sooner than an entire calendar year later,” Anex-Ries said. “At the same time, there are challenges that DHS is facing around how to do this in a robust and thorough way.”