{"resourceId":"ontario-auditor-general-ai-ops-audit-20260512","versions":[{"version":"external-400a5008597f5a1851b257745b0a44646640bddb999214baae116409d7d849ba","resource":{"id":"ontario-auditor-general-ai-ops-audit-20260512","title":"Ontario auditor finds 94% of GenAI use on unapproved sites and thin Copilot adoption controls","organization":"Office of the Auditor General of Ontario","sector":"Provincial government — AI governance, workforce GenAI, health AI procurement (transferable to U.S. states)","geography":"Ontario, Canada (transferable scrutiny pattern for U.S. state OPS/CIO controls; legal regime differs)","publishedAt":"2026-05-12","publicationDate":"2026-05-12","eventDate":"2026-05-12","sourceName":"Auditor General of Ontario — Performance Audit 2026: Use of Artificial Intelligence in the Ontario Government","sourceLabel":"Independent government audit (provincial)","sourceUrl":"https://auditor.on.ca/en/content/specialreports/specialreports/en26/2026_AI_EN.pdf","evidenceClass":"government-audit","outcomeClass":"cautionary","topics":["data-security","governance-procurement","accessibility-workforce","operating-model"],"finding":"In its May 12, 2026 special report, Ontario's Auditor General concluded the Ministry of Public and Business Service Delivery and Procurement lacked consistently effective processes to manage AI across the Ontario Public Service. From April 22 to August 18, 2025, other popular GenAI websites comprised 94% of tracked OPS GenAI usage versus ~6% for the only approved tool, Microsoft Copilot Chat; only 3% of staff (1,800 of 55,000) had completed non-mandatory Responsible Use of AI training as of August 2025; staff could reach numerous unsafe/unsecured AI sites; and Copilot's Enterprise Data Protection could be bypassed via non-default browsers. The audit also criticized inadequate evaluation of AI Scribe vendors (including hallucinations in testing) and incomplete bias testing for the Document Verification Service. Cautionary for U.S. states: approved-tool programs without blocking, KPIs, and mandatory training can leave most usage outside the secure path.","sledRelevance":"Transferable operating warning for state CIOs and shared-services leaders: publishing an approved Copilot/Gemini path is insufficient if telemetry shows the workforce still prefers consumer GenAI and training remains optional.","evidence":"Signed audit PDF: 94% vs 6% GenAI usage split (Apr 22–Aug 18, 2025); Copilot Chat only approved GenAI website with Enterprise Data Protection when accessed correctly; no KPI targets/reporting for Copilot adoption (Rec. 2); browser bypass risk (Rec. 3); 3% training completion, training not mandatory (Rec. 1); unsafe/unsecured sites ~60% of sampled AI sites by Defender score; AI Scribe RFB testing showed hallucinations/inaccuracies and weak bias evaluation; DVS bias testing incomplete; Ministry agreed with recommendations addressed to it.","architectureImplications":"Secure GenAI architectures must enforce approved tenants/browsers, block high-risk consumer GenAI endpoints on managed devices, and instrument adoption KPIs—otherwise Enterprise Data Protection features are bypassed in practice.","governanceImplications":"Shows governance theater risk: approved-tool policy without mandatory training, blocking, and management KPIs. Also flags cross-agency procurement (Supply Ontario AI Scribe VOR) where self-attestation outweighed live evaluation of hallucination/bias controls.","securityPrivacyImplications":"Documents concrete data-exfiltration paths via unapproved GenAI websites and Copilot use outside Edge/OPS credentials; elevates GenAI shadow IT to a cybersecurity and privacy control failure, not merely a productivity preference.","caveats":"Ontario provincial audit—not U.S. state law. Fieldwork through Nov 2025; release May 12, 2026 (outside same-week freshness but newly relevant and absent from stream archive). Ministry response claims later Copilot user growth (~23,000 monthly) after fieldwork—treat as auditee reply, not re-audited outcome. AI Scribe findings concern broader public-sector health procurement optional VOR.","streamIds":["state-government"],"roles":{"sales":"Sales framing: Ontario's auditor quantified what many U.S. states fear—approved Copilot at ~6% of GenAI use while unapproved sites hit 94%, with only 3% trained. Engage state CIO/CISO, shared-services, and workforce leaders who have an allowlist but weak telemetry. Position a shadow-GenAI control assessment—not a claim that blocking alone raises productivity. Unsupported: that U.S. agencies match Ontario's exact percentages or that Copilot is the only viable approved tool.","engineering":"Engineering framing: Fit is DLP/web filtering, browser/tenant enforcement for approved Copilot/Gemini, usage telemetry versus allowlists, and mandatory training gates. Integrate Defender-style site risk scoring and break-glass exceptions with logging. Prerequisites: authoritative GenAI allowlist, device management, and KPI definitions for approved-tool adoption. Constraints: provincial findings; health AI Scribe VOR is a related but distinct procurement surface; legal blocking authorities differ by U.S. state.","delivery":"Delivery framing: Work is a control remediation program—block unsafe GenAI sites, mandate training, set Copilot/approved-tool KPIs, and harden browser paths—plus procurement evaluation upgrades for AI vendors. Ownership typically spans CIO/CISO, workforce L&D, and central procurement. Acceptance should include usage mix shifting toward approved tools, training completion rates, and documented vendor evaluation against hallucination/bias tests. Risks: over-blocking legitimate research; KPI gaming; ignoring agency-owned AI systems outside web GenAI."},"roleDetails":{"sales":{"customerProblem":"States with approved GenAI tools still face unmanaged consumer-tool usage, optional training, and weak adoption KPIs—creating privacy and security exposure.","stakeholders":["State CIO / CISO","Shared services / enterprise IT","Workforce learning leaders","Central procurement"],"discoveryQuestions":["What share of GenAI traffic hits approved vs consumer tools?","Is responsible-use training mandatory before access?","Can staff bypass enterprise data-protection by changing browsers?","How are AI vendors tested for hallucination and bias before award?"],"valueHypothesis":"A time-boxed shadow-GenAI telemetry and control gap assessment can quantify approved-tool leakage before a privacy incident forces emergency blocking.","potentialEngagement":"4–6 week controls diagnostic: measure usage mix, training completion, browser enforcement, and procurement evaluation gaps against Ontario-style audit criteria.","unsupportedClaims":["That any U.S. state matches Ontario's 94%/6% split","That blocking consumer GenAI automatically improves service outcomes","Re-audited confirmation of post-fieldwork Copilot user growth claims"]},"engineering":{"fit":"Enterprise GenAI control plane: allowlisting, browser/tenant binding, DLP, telemetry, and training gates—plus stronger vendor evaluation harnesses for hallucinating systems.","architectureIntegration":"Enforce approved Copilot/Gemini only via managed identity/browser; block high-risk GenAI domains on managed endpoints; pipe usage metrics to monthly KPI dashboards.","prerequisites":["Device management and web filtering authority","Defensible GenAI allowlist definitions","Training LMS integration before license grant"],"constraints":["Ontario legal/policy context differs from U.S. states","Some research uses may need governed exceptions","Health AI Scribe findings are broader-public-sector optional VOR"],"security":"Treat unapproved GenAI upload paths as data-loss channels; monitor for sensitive prompt content and credentialed vs anonymous Copilot sessions.","proofOfValue":["Approved-tool share of GenAI usage rising with targets","Training completion ≥ defined threshold","Documented block list and exception log for unsafe AI sites"]},"delivery":{"work":"Remediate audit-style gaps: site blocking, mandatory training, adoption KPIs, browser enforcement, and AI procurement test scripts.","dependencies":["Cybersecurity operations","Identity/browser standards owners","L&D / mandatory training policy","Procurement / vendor-of-record teams"],"ownership":"Ministry/agency digital and cyber leads jointly; procurement owns vendor evaluation upgrades.","skillsAdoption":"Staff need secure-tool habits; cyber teams need GenAI-specific DLP patterns; procurers need hallucination/bias test literacy.","governanceCheckpoints":["Monthly approved-vs-unapproved usage KPI","Training compliance reports","Pre-award AI vendor evaluation gate"],"acceptanceCriteria":["Unsafe GenAI sites blocked on managed devices","Mandatory AI-risk training with refreshers","Written Copilot/approved-tool adoption targets reported to management"],"risks":["Shadow use on personal devices","False sense of security from allowlists alone","Vendor self-attestation without live testing"]}},"retrievedAt":"2026-09-19T22:05:10-05:00","enrichedAt":"2026-09-20T03:09:32+00:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Optional AI training completed by only 3% of staff undermines equitable, safe workforce adoption; residents are indirectly exposed via Document Verification Service and clinician AI Scribe pathways flagged for bias/hallucination gaps.","procurementImplications":"Demonstrates that AI RFBs relying on vendor self-attestation and light live testing can miss hallucinations and bias mitigations—states should weight technical evaluation and post-award monitoring more heavily for GenAI.","operatingModelImplications":"Approved-tool operating models fail without enforcement, mandatory training, and management KPIs; shadow GenAI becomes the de facto operating model.","sourceVerification":{"openedUrl":"https://auditor.on.ca/en/content/specialreports/specialreports/en26/2026_AI_EN.pdf","referenceExcerpt":"up 94% of OPS staff’s usage, while Microsoft Copilot Chat made up 6%.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}