NSW audit finds limited visibility over council AI use

Bring the CIO, internal audit lead, purchasing manager and service owners together around the question of whether they can identify actual AI use. Ask how a newly embedded feature, employee subscription or internal assistant becomes visible, and what happens when no owner can answer. A bounded inventory reconciliation can compare a small application portfolio against configurations and purchasing records. Its value hypothesis is clearer accountability and fewer unknown data paths, not certified compliance. The Australian findings cannot estimate a U.S. customer's exposure. For smaller governments, scope the work to high-consequence services and establish a sustainable reporting owner before proposing continuous oversight.

Build an evidence-backed inventory that connects applications, features, data sources, identities and responsible teams. Prerequisites include read access to approved administrative settings, software records and release notices. Test discovery using known examples of embedded AI and internally developed tools; a questionnaire alone cannot establish completeness. Review model data use, permissions and retention for the selected systems. Design a proof of value around detecting seeded inventory discrepancies and routing them correctly without exposing sensitive employee or resident content. No preferred hosting architecture follows from this audit. Treat discovery outputs as controlled records and validate access before extending coverage.

Name a governance lead to resolve discrepancies and application owners to maintain individual records. Establish a reporting cadence, train staff on what to disclose, and provide a simple correction process. Dependencies include supplier cooperation, configuration access and reviewer capacity. Check governance decisions at onboarding, significant feature changes and renewal. Proposed acceptance requires an owner and evidence trail for every sampled system, resolution or documented escalation of all seeded discrepancies, and a completed change-notification exercise. These are proposed tests. Track overdue reviews and staff reporting burden; an inventory that cannot stay current can create false assurance despite an initially successful cleanup.