{"resourceId":"nyc-oti-cannot-monitor-shadow-ai-use-20261006","versions":[{"version":"external-fb67eed25635283332462e7d208585b544e7ceb07654df64d6906df49fb0253f","resource":{"id":"nyc-oti-cannot-monitor-shadow-ai-use-20261006","title":"NYC tech office tells Council it cannot technically monitor employees' 'shadow' AI use; Office of Algorithmic Accountability still being staffed","organization":"New York City Office of Technology and Innovation","sector":"Municipal AI governance and oversight","geography":"New York City, New York, United States","publishedAt":"October 6, 2026","publicationDate":"2026-10-06","eventDate":"2026-10-05","sourceName":"amNewYork","sourceLabel":"Local news report","sourceUrl":"https://www.amny.com/politics/nyc-ai-cyberattacks-safeguards/","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["governance-procurement","data-security","accessibility-workforce","operating-model"],"finding":"amNewYork reported that at the Oct. 5 Council AI hearing, OTI deputy commissioner Sarah Milstein said the city has distributed an AI contract rider and that its Microsoft contract bars training on city worker data, but acknowledged on shadow AI that 'we are not in a technical position to monitor that.' The Office of Algorithmic Accountability has six funded positions and no director yet; Speaker Menin said it was supposed to be operating by June. NYU's Julia Stoyanovich said Local Law 144 produced two complaints and no penalties in three years. The administration opposed a 24-hour public AI-incident disclosure deadline.","sledRelevance":"The largest U.S. city publicly admitted it cannot see staff use of unapproved AI tools, a governance gap most smaller governments share but rarely state.","evidence":"Reporting on sworn hearing testimony; quotes attributed; no OTI data on actual shadow-AI prevalence.","architectureImplications":"Shadow-AI visibility requires network/CASB or endpoint telemetry the city says it lacks; contract riders cover procured tools only.","governanceImplications":"Enforcement capacity, not new law, is the binding constraint per expert testimony; oversight office behind schedule.","securityPrivacyImplications":"Constituent data could enter outside tools via personal accounts; Microsoft contract bars model training on city worker data.","caveats":"Archive already holds an Oct. 5 hearing report (thecityreporter) on vendor testimony and OTI's lack of power over private AI; this source is first-time and adds the shadow-AI, staffing and enforcement admissions. Testimony, not audit.","streamIds":["local-government"],"roles":{"sales":"Sales framing: NYC's own tech office said it cannot monitor shadow AI, which validates a bounded conversation about visibility and sanctioned alternatives rather than more policy. Discovery should ask what data classes worry agencies most and whether the AI contract rider is reusable. Avoid implying NYC is buying monitoring tools; the testimony shows a gap, not a procurement. Smaller cities can use this admission to justify inventories and approved-tool programs.","engineering":"Engineering framing: Visibility into unapproved AI requires egress, SaaS discovery or endpoint controls tied to identity, plus a sanctioned enterprise tool that removes the incentive to go around policy. The Microsoft no-training clause shows contract terms are the main existing control. Any design must respect labor and privacy constraints on employee monitoring and should start with discovery rather than blocking.","delivery":"Delivery framing: The practical work is staffing the oversight office, operationalizing the contract rider and defining how agencies report AI use. Ownership sits with OTI and the algorithmic accountability office. Acceptance should be measured by a named director, published rules and a first agency inventory, not by statements of compliance. Risk: enforcement remains thin, as Local Law 144's record suggests."},"roleDetails":{"sales":{"customerProblem":"City cannot see or police employee use of outside AI tools that may touch constituent data.","stakeholders":["OTI","Office of Algorithmic Accountability","City Council technology committee","Agency CIOs","DCWP"],"discoveryQuestions":["What telemetry exists today for SaaS/AI discovery?","Is the AI contract rider mandatory for all agencies?","When will the oversight director and rules be in place?"],"valueHypothesis":"Discovery tooling plus sanctioned tools could reduce unmanaged data exposure; prevalence unmeasured.","potentialEngagement":"Shadow-AI discovery assessment for one agency paired with approved-tool guidance.","unsupportedClaims":["That NYC plans to buy monitoring","Measured shadow-AI prevalence","That Local Law 144 failures apply to all AI rules"]},"engineering":{"fit":"Relevant to large governments with federated agencies and enterprise Microsoft tenancy.","architectureIntegration":"SaaS discovery via proxy/CASB logs mapped to an AI inventory; enterprise genAI as sanctioned path.","prerequisites":["Identity-integrated network logs","Agency AI inventory","Labor/privacy review of monitoring"],"constraints":["Employee-monitoring limits","Agency autonomy","NY law on incident disclosure timing"],"security":"Constituent data leakage to unmanaged tools; contract no-training clauses.","proofOfValue":["Discovery run quantifies AI domains reached","Sanctioned tool adoption measured","Rider coverage across new contracts"]},"delivery":{"work":"Staff oversight office, finalize rules, define agency AI reporting and discovery approach.","dependencies":["Hiring","Rulemaking","Agency cooperation"],"ownership":"OTI and Office of Algorithmic Accountability.","skillsAdoption":"Hire staff combining AI expertise and government knowledge; agency AI-lead training.","governanceCheckpoints":["Director named","Rules published","First agency inventories submitted"],"acceptanceCriteria":["Oversight director appointed and six roles filled","Shadow-AI discovery baseline produced for at least one agency","Rider attached to all new software contracts"],"risks":["Monitoring triggers labor objections","Enforcement stays nominal","Incident-disclosure dispute stalls Council bill"]}},"retrievedAt":"2026-10-09T22:16:27-05:00","enrichedAt":"2026-10-09T22:30:00-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"City does not yet know AI workforce effects; hiring AI-plus-government expertise is hard.","procurementImplications":"AI contract rider covers IP, security, privacy and city data in software purchases.","operatingModelImplications":"OTI and the Office of Algorithmic Accountability share assessment duties; DCWP routes frontier-model complaints to state AG.","sourceVerification":{"openedUrl":"https://www.amny.com/politics/nyc-ai-cyberattacks-safeguards/","referenceExcerpt":"we are not in a technical position to monitor that","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}