{"resourceId":"ny-osc-nyc-oti-ai-governance-followup-20260827","versions":[{"version":"external-07ca7887016c823d3511a8b3da4af7f14eeefbc68d4844e328f669b3f9499653","resource":{"id":"ny-osc-nyc-oti-ai-governance-followup-20260827","title":"NY OSC follow-up (2025-F-17): NYC OTI only partially implemented all three AI governance recommendations","organization":"New York State Office of the State Comptroller — Division of State Government Accountability","sector":"Government audit / municipal AI governance oversight (state comptroller)","geography":"New York City agencies (OTI); transferable caution for state enterprise AI programs","publishedAt":"2026-08-27","publicationDate":"2026-08-27","eventDate":"2026-08-27","sourceName":"New York State Office of the State Comptroller","sourceLabel":"Artificial Intelligence Governance (Follow-Up), Report 2025-F-17 (August 2026)","sourceUrl":"https://www.osc.ny.gov/files/state-agencies/audits/pdf/sga-2026-25f17.pdf","evidenceClass":"government-audit","outcomeClass":"cautionary","topics":["governance-procurement","operating-model","data-security","accessibility-workforce"],"finding":"OSC's August 2026 follow-up (Report 2025-F-17) finds the NYC Office of Technology and Innovation only partially implemented all three recommendations from the 2023 AI governance audit (assessed as of April 2026). Progress includes the AI Action Plan and related guidance, but critical framework elements remain incomplete—notably a complete inventory of AI tools, requirements for approving AI use, and procedures to ensure data quality and monitor accuracy, bias, and acceptable use. Comptroller DiNapoli's public summary (via GovTech Sep 2 coverage) likewise stresses incomplete inventory, inconsistent citywide standards, and no formal public-complaint process for AI systems.","sledRelevance":"State comptroller scrutiny showing that action plans and annual algorithmic reporting can coexist with unfinished inventories and standards—directly challenging any reading of NASCIO's 98% enterprise-policy figure as proof of oversight completion. Why now: not archived; newly relevant beside the 2026-09-28 NASCIO survey's governance-maturity narrative; jurisdictional limit: NYC municipal program, not a 50-state mandate.","evidence":"Opened the OSC PDF via curl (SLED-research-bot/1.0) and pdftotext; confirmed August 2026 Report 2025-F-17; extracted partial-implementation status for all three recommendations and gaps on inventory, approval requirements, and accuracy/bias monitoring. Cross-checked GovTech 2026-09-02 independent reporting of DiNapoli's statement.","architectureImplications":"Enterprise AI programs need a living system inventory and approval workflow wired into procurement/IdP—not only principles documents.","governanceImplications":"Partial implementation years after initial findings shows governance debt accumulates; states should demand inventory completeness metrics and public feedback channels, not Action Plan checkbox counts alone.","securityPrivacyImplications":"Without accuracy/bias monitoring procedures, harmful or biased outputs can persist undetected across agencies using divergent ad hoc controls.","caveats":"Audit targets NYC OTI (local), not New York State executive agencies (a prior OSC state AI guidance audit is already archived); follow-up assesses implementation as of April 2026; OTI cites Local Law 35 reporting progress while structural gaps remain.","streamIds":["state-government","local-government"],"roles":{"sales":"Frame OSC's NYC OTI follow-up as a caution that AI Action Plans and annual tool reports can still leave inventories, approval rules, and bias monitoring unfinished—useful when a state cites policy adoption alone. Discovery should ask for inventory completeness percentage, who can block an unapproved AI tool, and whether a public complaint channel exists. Bounded engagement: an AI governance gap assessment against the three OSC recommendations. Unsupported claims include that NYC findings prove every state program is noncompliant, or that Local Law 35-style reporting equals effective oversight.","engineering":"Fit is an enterprise AI inventory and approval workflow integrated with procurement and identity systems, plus monitoring hooks for accuracy/bias. Architecture should register tools before production access and emit evidence for auditors. Prerequisites: authoritative inventory schema, agency reporting mandate, monitoring metrics. Constraints: NYC-specific legal context; follow-up as of April 2026. Proof of value is a complete inventory sample and demonstrated block of an unapproved tool—not Action Plan completion percentages.","delivery":"Delivery stands up inventory data collection, approval SLAs, bias/accuracy monitoring procedures, and a public feedback path. Dependencies: central digital office, agencies, auditors, legal. Ownership of inventory accuracy sits with the central AI governance office with agency data stewards. Acceptance criteria: known-production tools registered; documented approval; monitoring procedure in force. Risks include checkbox Action Plans, divergent agency DIY controls, and confusing municipal findings with statewide statutory duties."},"roleDetails":{"sales":{"customerProblem":"Leaders claim AI governance progress while auditors still find incomplete inventories and monitoring.","stakeholders":["CIO/CAIO","Agency AI leads","Comptroller/auditor liaisons","Procurement","Public advocates"],"discoveryQuestions":["What share of production AI tools are in the inventory?","Who can stop an unapproved AI use?","What accuracy/bias monitoring is mandatory?","Is there a public AI complaint channel?"],"valueHypothesis":"Closing OSC-style gaps (inventory, approval, monitoring) reduces audit and harm risk before agentic scale-up.","potentialEngagement":"Governance gap assessment mapped to OSC's three recommendations and current Action Plan.","unsupportedClaims":["NYC findings equal every state's status","Annual algorithmic reporting equals oversight","Action Plan completion proves inventory completeness","Partial implementation means no progress"]},"engineering":{"fit":"Mandatory AI tool registry + approval workflow + monitoring evidence store.","architectureIntegration":"Procurement/IdP hooks to registry to risk tier to monitoring metrics to auditor export.","prerequisites":["Inventory schema","Agency reporting mandate","Approval authority","Metric definitions"],"constraints":["NYC legal context","Follow-up scope as of April 2026","Cross-agency data quality"],"security":"Protect registry contents; control admin rights; log changes to approved tools.","proofOfValue":["Inventory completeness audit sample","Demo block of unapproved tool","Monitoring report for one high-risk system"]},"delivery":{"work":"Collect agency inventories; implement approval SLA; write bias/accuracy procedures; stand up feedback channel.","dependencies":["Central digital/OTI equivalent","Agencies","Legal","Auditor liaison"],"ownership":"Central AI governance office owns inventory completeness; agencies own system-level monitoring.","skillsAdoption":"Train agency AI leads on registry fields and monitoring evidence expectations.","governanceCheckpoints":["Inventory completeness review","Approval workflow go-live","Quarterly monitoring sample","Public feedback process launch"],"acceptanceCriteria":["All known production tools registered","Written approval required pre-production","Monitoring procedure adopted"],"risks":["Action Plan theater","Agency DIY divergence","Misapplying NYC duties to state statutes"]}},"retrievedAt":"2026-09-29T22:20:35-05:00","enrichedAt":"2026-09-29T22:20:35-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Incomplete citywide standards leave agencies and the public without consistent channels to contest AI-affected decisions; workforce guidance remains fragmented across agencies.","procurementImplications":"Procurement should require inventory registration and ongoing accuracy/bias monitoring as contract deliverables—addressing gaps OSC still finds unfinished.","operatingModelImplications":"Central digital/OTI-style offices must convert Action Plan milestones into mandatory agency controls with enforcement, not optional guidance.","sourceVerification":{"responseId":"curl-nyosc-2025-f-17-20260929T222035","openedUrl":"https://www.osc.ny.gov/files/state-agencies/audits/pdf/sga-2026-25f17.pdf","referenceExcerpt":"All three of the initial report's audit recommendations were partially implemented.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}