From the Local Government edition of September 24, 2026
Fort Worth Internal Audit finds AI governance in place but usage hard to track
City of Fort Worth Department of Internal Audit · Municipal internal audit of citywide AI governance and use · Fort Worth, Texas, United States
- Publisher
- City of Fort Worth Internal Audit
- Original publication
- February 27, 2026 Artificial Intelligence Audit (Project #2025.011)
- Source retrieved
- 2026-09-25
- Event date
- 2026-02-01
What happened
Fort Worth's Feb. 27, 2026 Artificial Intelligence Audit (FY2025 plan; scope Oct 1, 2023–Mar 31, 2025 with later activity as needed) concludes management made efforts toward proper AI governance: a GENAI policy effective Dec 18, 2023 updated Dec 19, 2025 into an AI and GENAI Policy; an AI Governance Charter (Sept 19, 2025); and AI Governance Board and AI Review Committee first meetings in February 2026. Survey/interview work found most departments (18 of 27) used AI tools and/or AI-integrated software, with ChatGPT the most used; auditors did not identify uses of AI with protected confidential/PII/PHI/proprietary information in sampled work, and saw users reviewing/verifying outputs and disclosing AI use to supervisors. Still, auditors concluded tracking AI usage can be difficult because it is hard to differentiate AI from human work, and stressed mandatory training, communicated policy updates, and keeping governance bodies operational. Why now: same-week municipal chatbot launches make documented city audit findings on shadow tracking and committee oversight newly actionable.
Why it matters
U.S. city auditor package showing both governance scaffolding and the practical limit of inventorying generative AI—core local-government accountability content.
Evidence and measured results
Fort Worth AI Audit PDF Feb 27, 2026: 18 of 27 departments used AI; GENAI policy 2023 updated Dec 2025; Governance Board/Review Committee first met Feb 2026; no sampled protected-data misuse found; tracking AI vs human work difficult; training/policy/governance continuity emphasized.
Limitations and uncertainty
Audit scope largely through March 2025 with selected later review; self-survey nonresponse (four departments); software cost optimization deferred; policing/EMS AI tools appear in exhibits but this edition uses the audit for citywide governance, not as a public-safety operations study.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-25; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Departments already use AI while councils demand accountable governance and inventories.
- Stakeholders
- City Auditor/Audit Committee
- CIO/CISO
- City Manager
- Department directors
- Council
- Discovery questions
- Is there a living AI inventory?
- Who approves new AI tools?
- How is consumer ChatGPT blocked from sensitive data?
- What training is mandatory?
- Value hypothesis
- Governance and inventory engagements reduce untracked AI risk better than adding seats without controls.
- Potential engagement
- 90-day AI inventory, policy gap assessment, and committee operating cadence—explicitly not a chatbot implementation sale.
- Unsupported claims
- Audit certifies any vendor
- 18/27 usage proves ROI
- No sensitive-data risk citywide
- Tracking problem is solved
Pre-sales engineering
Role takeaway
- Fit
- Citywide AI governance stack: policy, charter, review committee, and tool intake—not a single product.
- Architecture and integration
- Request → FactSheet/risk review → approve/deny → department use with disclosure → periodic audit samples.
- Prerequisites
- Updated AI/GENAI policy
- Committee charter
- Department survey channel
- Sensitive-data classifications
- Constraints
- Hard-to-meter consumer AI
- Survey nonresponse
- Training certification dependencies
- Mixed embedded vs standalone tools
- Security
- Separate consumer LLMs from 911/PHI platforms; require supervisor disclosure for high-criticality outputs.
- Proof of value
- Inventory completeness trend
- Committee throughput
- Policy exception count
- Training completion rate
Delivery
Role takeaway
- Work
- Refresh inventory, route new tools through review, sample AI-assisted artifacts, and keep Board/Committee meetings on calendar.
- Dependencies
- IT Solutions
- HR (policy/training)
- City Attorney
- Department AI users
- Ownership
- AI Governance Board sets decisions; departments execute; Internal Audit provides periodic assurance.
- Skills and adoption
- Train staff to disclose AI assistance and verify outputs before reliance.
- Governance checkpoints
- Quarterly inventory update
- Committee review of new tools
- Annual policy refresh
- Audit follow-up
- Acceptance criteria
- Inventory covers responding departments
- First-meeting cadence sustained
- Sensitive-data incidents remain zero in samples
- Training assigned citywide
- Risks
- Shadow AI
- Stale 2023 advisory lingering beside 2025 policy
- Committee fatigue
- False assurance from no-exception samples
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Mix of consumer LLMs and embedded tools (including Prepared Assist in public-safety communications) requires different controls than a single enterprise bot.
Governance
Who approves, reviews and stays accountable for outcomes?
Charter plus Board/Review Committee is necessary but insufficient without continuous inventory and training—auditors flag monitoring as the hard part.
Security and privacy
What data, permissions and controls need testing?
Policy forbids unprotected sensitive inputs; specialized 911 platforms still handle sensitive data—segregate consumer LLMs from those workflows.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Mandatory AI-aware cybersecurity training and clear disclosure norms are workforce controls, not optional extras.
Procurement
What should contracts, pricing and exit terms secure?
New AI purchases should pass the same review as other systems; defer cost-optimization questions to the planned software audit.
Operating model
Which teams own the service once it runs?
Board + Review Committee + department stewards is the operating model; tools proliferate faster than monitoring.
Publication history
- 2026-09-24Local Government · Issue 194 resources
Stable resource ID: fort-worth-ai-audit-governance-20260227