{"resourceId":"fort-worth-ai-audit-governance-20260227","versions":[{"version":"external-decd571e4ee9ac09efd0f0bf02c19eda9015af1010efda13b18f545fa8f554a6","resource":{"id":"fort-worth-ai-audit-governance-20260227","title":"Fort Worth Internal Audit finds AI governance in place but usage hard to track","organization":"City of Fort Worth Department of Internal Audit","sector":"Municipal internal audit of citywide AI governance and use","geography":"Fort Worth, Texas, United States","publishedAt":"February 27, 2026 Artificial Intelligence Audit (Project #2025.011)","publicationDate":"2026-02-27","eventDate":"2026-02-01","sourceName":"City of Fort Worth Internal Audit","sourceLabel":"Government performance audit of municipal AI policy, inventory survey, and controls","sourceUrl":"https://www.fortworthtexas.gov/files/assets/public/v/1/internal-audit/documents/fy2026/2026-2-27-artificial-intelligence-audit-2025.011.pdf","evidenceClass":"government-audit","outcomeClass":"mixed","topics":["governance-procurement","data-security","operating-model","accessibility-workforce"],"finding":"Fort Worth's Feb. 27, 2026 Artificial Intelligence Audit (FY2025 plan; scope Oct 1, 2023–Mar 31, 2025 with later activity as needed) concludes management made efforts toward proper AI governance: a GENAI policy effective Dec 18, 2023 updated Dec 19, 2025 into an AI and GENAI Policy; an AI Governance Charter (Sept 19, 2025); and AI Governance Board and AI Review Committee first meetings in February 2026. Survey/interview work found most departments (18 of 27) used AI tools and/or AI-integrated software, with ChatGPT the most used; auditors did not identify uses of AI with protected confidential/PII/PHI/proprietary information in sampled work, and saw users reviewing/verifying outputs and disclosing AI use to supervisors. Still, auditors concluded tracking AI usage can be difficult because it is hard to differentiate AI from human work, and stressed mandatory training, communicated policy updates, and keeping governance bodies operational. Why now: same-week municipal chatbot launches make documented city audit findings on shadow tracking and committee oversight newly actionable.","sledRelevance":"U.S. city auditor package showing both governance scaffolding and the practical limit of inventorying generative AI—core local-government accountability content.","evidence":"Fort Worth AI Audit PDF Feb 27, 2026: 18 of 27 departments used AI; GENAI policy 2023 updated Dec 2025; Governance Board/Review Committee first met Feb 2026; no sampled protected-data misuse found; tracking AI vs human work difficult; training/policy/governance continuity emphasized.","architectureImplications":"Interpretation: Mix of consumer LLMs and embedded tools (including Prepared Assist in public-safety communications) requires different controls than a single enterprise bot.","governanceImplications":"Interpretation: Charter plus Board/Review Committee is necessary but insufficient without continuous inventory and training—auditors flag monitoring as the hard part.","securityPrivacyImplications":"Interpretation: Policy forbids unprotected sensitive inputs; specialized 911 platforms still handle sensitive data—segregate consumer LLMs from those workflows.","caveats":"Audit scope largely through March 2025 with selected later review; self-survey nonresponse (four departments); software cost optimization deferred; policing/EMS AI tools appear in exhibits but this edition uses the audit for citywide governance, not as a public-safety operations study.","streamIds":["local-government"],"roles":{"sales":"Before pitching another municipal chatbot seat, Fort Worth's audit shows councils already expect written AI policy, a governance board, and evidence staff verify outputs. Lead with inventory and training work packages; do not claim the audit proves any vendor product safe. Unsupported: guaranteed compliance or that 18/27 department usage equals successful resident AI.","engineering":"Fit is policy-plus-inventory controls across heterogeneous tools (ChatGPT, Copilot, Gemini, domain systems). Architecture needs an intake FactSheet/risk review path for new tools and logging where feasible. Constraints: consumer AI is hard to meter; committee capacity; Texas training certification timing. Security: block sensitive prompts into consumer models; keep 911 AI on purpose-built platforms.","delivery":"Stand up or refresh AI Review Committee workflows, complete department inventories, push mandatory awareness training, and sample AI-assisted work for disclosure/verification. Ownership: IT Solutions chairs governance; departments own use cases. Risks: paper policy without monitoring and shadow AI growth."},"roleDetails":{"sales":{"customerProblem":"Departments already use AI while councils demand accountable governance and inventories.","stakeholders":["City Auditor/Audit Committee","CIO/CISO","City Manager","Department directors","Council"],"discoveryQuestions":["Is there a living AI inventory?","Who approves new AI tools?","How is consumer ChatGPT blocked from sensitive data?","What training is mandatory?"],"valueHypothesis":"Governance and inventory engagements reduce untracked AI risk better than adding seats without controls.","potentialEngagement":"90-day AI inventory, policy gap assessment, and committee operating cadence—explicitly not a chatbot implementation sale.","unsupportedClaims":["Audit certifies any vendor","18/27 usage proves ROI","No sensitive-data risk citywide","Tracking problem is solved"]},"engineering":{"fit":"Citywide AI governance stack: policy, charter, review committee, and tool intake—not a single product.","architectureIntegration":"Request → FactSheet/risk review → approve/deny → department use with disclosure → periodic audit samples.","prerequisites":["Updated AI/GENAI policy","Committee charter","Department survey channel","Sensitive-data classifications"],"constraints":["Hard-to-meter consumer AI","Survey nonresponse","Training certification dependencies","Mixed embedded vs standalone tools"],"security":"Separate consumer LLMs from 911/PHI platforms; require supervisor disclosure for high-criticality outputs.","proofOfValue":["Inventory completeness trend","Committee throughput","Policy exception count","Training completion rate"]},"delivery":{"work":"Refresh inventory, route new tools through review, sample AI-assisted artifacts, and keep Board/Committee meetings on calendar.","dependencies":["IT Solutions","HR (policy/training)","City Attorney","Department AI users"],"ownership":"AI Governance Board sets decisions; departments execute; Internal Audit provides periodic assurance.","skillsAdoption":"Train staff to disclose AI assistance and verify outputs before reliance.","governanceCheckpoints":["Quarterly inventory update","Committee review of new tools","Annual policy refresh","Audit follow-up"],"acceptanceCriteria":["Inventory covers responding departments","First-meeting cadence sustained","Sensitive-data incidents remain zero in samples","Training assigned citywide"],"risks":["Shadow AI","Stale 2023 advisory lingering beside 2025 policy","Committee fatigue","False assurance from no-exception samples"]}},"retrievedAt":"2026-09-25T03:23:44Z","enrichedAt":"2026-09-25T03:23:44Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Interpretation: Mandatory AI-aware cybersecurity training and clear disclosure norms are workforce controls, not optional extras.","procurementImplications":"Interpretation: New AI purchases should pass the same review as other systems; defer cost-optimization questions to the planned software audit.","operatingModelImplications":"Interpretation: Board + Review Committee + department stewards is the operating model; tools proliferate faster than monitoring.","sourceVerification":{"openedUrl":"https://www.fortworthtexas.gov/files/assets/public/v/1/internal-audit/documents/fy2026/2026-2-27-artificial-intelligence-audit-2025.011.pdf","referenceExcerpt":"tracking AI usage can be difficult, as it is sometimes hard to differentiate AI from work of an employee/human.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}