{"resourceId":"denver-dia-ai-governance-audit-2026-10-22","versions":[{"version":"external-189ea733b37129cde5f8cddb97835547e602ffd74d691a0c202332c322038198","resource":{"id":"denver-dia-ai-governance-audit-2026-10-22","title":"Denver Auditor: Denver International Airport has no AI-governance framework","organization":"City and County of Denver Auditor's Office / Denver International Airport","sector":"Public airport technology governance","geography":"Denver, Colorado, United States","publishedAt":"October 22, 2026","publicationDate":"2026-10-22","eventDate":"2026-10-22","sourceName":"Denver Auditor's Office","sourceLabel":"Official Artificial Intelligence Governance performance-audit summary and findings page","sourceUrl":"https://www.denvergov.org/Government/Agencies-Departments-Offices/Agencies-Departments-Offices-Directory/Auditors-Office/Audit-Services/Audit-Reports/Artificial-Intelligence-Governance","evidenceClass":"government-audit","outcomeClass":"cautionary","topics":["governance-procurement","data-security","operating-model"],"finding":"Denver Auditor Timothy O'Brien's Oct. 22, 2026 performance audit of city Technology Services and Denver International Airport, conducted in accordance with generally accepted government auditing standards, found that Technology Services' AI-governance framework needs improving and that Denver International Airport has no AI-governance framework. For the airport, auditors found it had not added AI-specific processes and roles and responsibilities to its technology policies, procedures and processes; had not refined the vendor-management risk process to include AI-systems risks; and had not developed comprehensive safeguards for employee AI use. City Technology Services had not fully formalized AI governance in its technology policies, had not set up a central AI inventory and had not measured and monitored the AI systems it uses. DIA agreed to recommendations that include establishing an AI risk-management process and policy, with implementation dates including Dec. 31, 2026 and March 31, 2027; updating the Architecture Roundtable Committee charter so it reviews AI systems and is the central coordinating body for AI governance; adding AI intake questions and risk thresholds to vendor management; adding AI-specific language to contract templates; creating AI-use monitoring policy and continuous-review procedures; training Business Technologies staff; tracking each AI system's model accuracy after deployment; developing data-loss-prevention controls to block input of sensitive and confidential data into public AI systems; creating a centralized inventory of approved and denied AI systems; collecting stakeholder feedback; and writing a decommissioning policy. The audit does not assess the accuracy or operational benefit of any particular airport AI product. It is included now because recent transportation editions covered overseas airport operations announcements while naming U.S. airport independent evaluation and governance as a gap, and this official audit URL was not in the stream archive.","sledRelevance":"This is a U.S. public-airport government audit of AI controls, directly relevant to airport authorities and to the stream's scrutiny pass. It shows that an airport already using AI can still lack a framework, inventory, vendor-risk treatment, employee-use safeguards and post-deployment accuracy tracking. Transferable as a controls checklist; Denver's agreed dates are not themselves proof those controls now exist.","evidence":"Official Denver Auditor AI Governance audit page including the Oct. 22, 2026 auditor's letter, Finding 2 statement that DIA has no AI-governance framework, the three supporting airport gaps, generally accepted government auditing standards language, and numbered DIA recommendations with agree and implementation-date fields.","architectureImplications":"Airport technology groups should attach AI risk assessments, an approved/denied inventory, vendor-intake questions, post-deployment accuracy monitoring and data-loss prevention blocking of sensitive prompts to existing architecture-review and vendor-onboarding paths—including a named coordinating committee—rather than deploying tools outside that control plane.","governanceImplications":"Absence of a framework is itself an audit finding. Agencies should not treat AI use as governed merely because an IT department exists; roles, risk thresholds, incident definitions and decommissioning rules need to be written and assigned.","securityPrivacyImplications":"Recommended airport controls include data-loss prevention against putting sensitive and confidential data into public AI systems, vendor-risk treatment for AI products, and a formal definition of AI-related incidents. The summary does not quantify any past data-loss event.","caveats":"The audit letter is dated Oct. 22, 2026, before this edition's preferred freshness window; it is used because it newly addresses a named U.S. airport governance-evaluation gap and was not archived. The public page summarizes findings and recommendations; the selected evidence is the official findings page that was opened. Implementation dates run into 2027, so recommendations were agreed, not verified as completed. City Technology Services findings apply to municipal IT as well as the airport; this resource focuses on the airport finding for stream fit.","streamIds":["transportation"],"roles":{"sales":"Sales framing: Denver's Oct. 22, 2026 performance audit found Denver International Airport has no AI-governance framework—missing AI-specific roles in technology policy, AI risks in vendor management and safeguards for employee AI use—while city Technology Services also lacked a complete inventory and performance monitoring. For U.S. airport-authority buyers, the value is a controls assessment and a remediation roadmap, not a new passenger-facing model. DIA agreed to recommendations with implementation dates into 2026 and 2027. The audit does not evaluate the accuracy of any particular airport AI product.","engineering":"Engineering framing: the airport findings point to missing control-plane pieces rather than a specific model: annual and change-triggered AI risk assessments, an inventory of approved and denied AI systems, vendor-intake questions and risk thresholds, contractual AI intellectual-property language, post-deployment accuracy tracking and data-loss prevention to block sensitive inputs to public AI tools. Integrate those checks into existing architecture-review and vendor-onboarding workflows, including the Architecture Roundtable Committee the auditor asked to become the coordinating AI-governance body. Transfer the control pattern, not Denver's unimplemented future dates, to other airports.","delivery":"Delivery framing: delivery should stand up the agreed artifacts—risk-management policy, inventory, vendor-process updates, staff training, monitoring procedures and decommissioning rules—against the published implementation dates, several of which fall on Dec. 31, 2026. Dependencies include airport Business Technologies, legal review of contracts and coordination with citywide technology policy. Acceptance is completed policies plus a populated inventory and evidence that public AI tools cannot receive sensitive data, not a new chatbot launch. Risks include shadow AI use continuing until data-loss prevention and an approved/denied list actually reach staff."},"roleDetails":{"sales":{"customerProblem":"An airport may already be adopting AI tools while lacking a governance framework, vendor-risk treatment for AI and safeguards against staff pasting sensitive data into public systems—the exact gaps Denver's auditor reported at DIA.","stakeholders":["Airport CEO and Board","Airport Business Technologies / CIO","Airport legal and procurement","City auditor or internal audit","Operations and customer-experience teams using AI tools"],"discoveryQuestions":["Is there a written airport AI-governance framework and inventory of approved and denied tools?","Do vendor intake and contracts ask AI-specific risk questions?","What stops staff from entering sensitive data into public AI systems?","Who reviews model accuracy after deployment, and how often?"],"valueHypothesis":"An independent AI-governance assessment and remediation plan can close the same control gaps the Denver auditor named before an airport scales more passenger-facing or operational AI.","potentialEngagement":"An airport AI-controls review mapped to this audit's recommendations: inventory, vendor-risk, data-loss prevention, post-deployment accuracy tracking, training and decommissioning.","unsupportedClaims":["That any specific DIA AI product is inaccurate or harmful","That Denver has already implemented the 2026–2027 recommendation dates","That city Technology Services findings are identical to every airport's situation"]},"engineering":{"fit":"Fits airport technology organizations that have begun adopting AI but have not yet formalized risk assessments, inventories, vendor-risk questions or output monitoring.","architectureIntegration":"Add AI review to the architecture committee, tag AI-capable systems in the asset inventory, extend vendor onboarding with AI-risk questions and install data-loss prevention that blocks sensitive inputs to public AI tools.","prerequisites":["System of record for assets that can hold an AI inventory","Vendor-management process to extend","Authority to update contract templates","Logging that can support post-deployment accuracy review"],"constraints":["Auditor recommendations are not a technical reference architecture","Implementation dates extend into 2027","Public summary does not list DIA's current AI tools"],"security":"Priority controls called out for the airport include data-loss prevention against sensitive data in public AI systems, vendor AI-risk treatment and ongoing review of AI use; city-side recommendations also mention defining AI security incidents such as prompt injection and data exfiltration.","proofOfValue":["Populated approved/denied AI inventory available to staff","Completed AI risk assessments on a stated cycle","Evidence data-loss prevention blocks sensitive public-AI inputs","Documented post-deployment accuracy tracking for each in-use system"]},"delivery":{"work":"Stand up the agreed policy artifacts, inventory, vendor-process changes, training, monitoring and decommissioning procedures against a dated remediation plan.","dependencies":["Airport Business Technologies capacity","Legal review of contract language","Coordination with citywide technology policy","Operations stakeholders who must provide feedback on AI uses"],"ownership":"The auditor assigned airport recommendations to DIA's Business Technologies Division, with airport leaders and legal named for AI-use monitoring policy review. The auditor remains the independent reviewer, not the operator.","skillsAdoption":"Recommendation 2.9 calls for regular AI-systems training for all Business Technologies staff; broader airport staff still need to know which tools are approved or denied.","governanceCheckpoints":["Adopt a written AI risk-management policy","Update architecture-committee charter","Publish the approved/denied inventory","Verify data-loss prevention and vendor-process changes before further AI scale"],"acceptanceCriteria":["Finding 2 gaps have corresponding written procedures","Inventory exists and is scheduled for regular update","Sensitive-data data-loss-prevention control is tested","No claim is made that operational AI accuracy was audited—this report did not do that"],"risks":["Shadow AI use until the inventory and data-loss prevention are real","Agreement without implementation before 2027 dates","Confusing a controls audit with a product-performance evaluation"]}},"retrievedAt":"2026-11-07T22:11:01-06:00","enrichedAt":"2026-11-07T22:16:11-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Without employee-use safeguards and training, staff may put confidential data into public tools or rely on unapproved AI. The audit requires Business Technologies training and an inventory accessible to airport employees; it does not evaluate passenger-accessibility impacts of airport AI.","procurementImplications":"Recommendations call for AI-specific vendor-intake questions, risk-tolerance thresholds, ongoing vendor evaluation, AI language in standard IT contract templates and tracking of vendors that include AI in their products. Those are concrete procurement changes other airports can copy.","operatingModelImplications":"DIA is expected to make its architecture committee the coordinating AI-governance body, inventory tools, monitor use continuously and decommission systems formally—moving from ad hoc adoption to a controlled operating model. Those steps were agreed, not confirmed complete.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://www.denvergov.org/Government/Agencies-Departments-Offices/Agencies-Departments-Offices-Directory/Auditors-Office/Audit-Services/Audit-Reports/Artificial-Intelligence-Governance","referenceExcerpt":"Denver International Airport has no AI-governance framework.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}