From the State Government edition of September 19, 2026
Ontario auditor finds 94% of GenAI use on unapproved sites and thin Copilot adoption controls
Office of the Auditor General of Ontario · Provincial government — AI governance, workforce GenAI, health AI procurement (transferable to U.S. states) · Ontario, Canada (transferable scrutiny pattern for U.S. state OPS/CIO controls; legal regime differs)
- Publisher
- Auditor General of Ontario — Performance Audit 2026: Use of Artificial Intelligence in the Ontario Government
- Original publication
- 2026-05-12
- Source retrieved
- 2026-09-20
- Event date
- 2026-05-12
What happened
In its May 12, 2026 special report, Ontario's Auditor General concluded the Ministry of Public and Business Service Delivery and Procurement lacked consistently effective processes to manage AI across the Ontario Public Service. From April 22 to August 18, 2025, other popular GenAI websites comprised 94% of tracked OPS GenAI usage versus ~6% for the only approved tool, Microsoft Copilot Chat; only 3% of staff (1,800 of 55,000) had completed non-mandatory Responsible Use of AI training as of August 2025; staff could reach numerous unsafe/unsecured AI sites; and Copilot's Enterprise Data Protection could be bypassed via non-default browsers. The audit also criticized inadequate evaluation of AI Scribe vendors (including hallucinations in testing) and incomplete bias testing for the Document Verification Service. Cautionary for U.S. states: approved-tool programs without blocking, KPIs, and mandatory training can leave most usage outside the secure path.
Why it matters
Transferable operating warning for state CIOs and shared-services leaders: publishing an approved Copilot/Gemini path is insufficient if telemetry shows the workforce still prefers consumer GenAI and training remains optional.
Evidence and measured results
Signed audit PDF: 94% vs 6% GenAI usage split (Apr 22–Aug 18, 2025); Copilot Chat only approved GenAI website with Enterprise Data Protection when accessed correctly; no KPI targets/reporting for Copilot adoption (Rec. 2); browser bypass risk (Rec. 3); 3% training completion, training not mandatory (Rec. 1); unsafe/unsecured sites ~60% of sampled AI sites by Defender score; AI Scribe RFB testing showed hallucinations/inaccuracies and weak bias evaluation; DVS bias testing incomplete; Ministry agreed with recommendations addressed to it.
Limitations and uncertainty
Ontario provincial audit—not U.S. state law. Fieldwork through Nov 2025; release May 12, 2026 (outside same-week freshness but newly relevant and absent from stream archive). Ministry response claims later Copilot user growth (~23,000 monthly) after fieldwork—treat as auditee reply, not re-audited outcome. AI Scribe findings concern broader public-sector health procurement optional VOR.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-20; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- States with approved GenAI tools still face unmanaged consumer-tool usage, optional training, and weak adoption KPIs—creating privacy and security exposure.
- Stakeholders
- State CIO / CISO
- Shared services / enterprise IT
- Workforce learning leaders
- Central procurement
- Discovery questions
- What share of GenAI traffic hits approved vs consumer tools?
- Is responsible-use training mandatory before access?
- Can staff bypass enterprise data-protection by changing browsers?
- How are AI vendors tested for hallucination and bias before award?
- Value hypothesis
- A time-boxed shadow-GenAI telemetry and control gap assessment can quantify approved-tool leakage before a privacy incident forces emergency blocking.
- Potential engagement
- 4–6 week controls diagnostic: measure usage mix, training completion, browser enforcement, and procurement evaluation gaps against Ontario-style audit criteria.
- Unsupported claims
- That any U.S. state matches Ontario's 94%/6% split
- That blocking consumer GenAI automatically improves service outcomes
- Re-audited confirmation of post-fieldwork Copilot user growth claims
Pre-sales engineering
Role takeaway
- Fit
- Enterprise GenAI control plane: allowlisting, browser/tenant binding, DLP, telemetry, and training gates—plus stronger vendor evaluation harnesses for hallucinating systems.
- Architecture and integration
- Enforce approved Copilot/Gemini only via managed identity/browser; block high-risk GenAI domains on managed endpoints; pipe usage metrics to monthly KPI dashboards.
- Prerequisites
- Device management and web filtering authority
- Defensible GenAI allowlist definitions
- Training LMS integration before license grant
- Constraints
- Ontario legal/policy context differs from U.S. states
- Some research uses may need governed exceptions
- Health AI Scribe findings are broader-public-sector optional VOR
- Security
- Treat unapproved GenAI upload paths as data-loss channels; monitor for sensitive prompt content and credentialed vs anonymous Copilot sessions.
- Proof of value
- Approved-tool share of GenAI usage rising with targets
- Training completion ≥ defined threshold
- Documented block list and exception log for unsafe AI sites
Delivery
Role takeaway
- Work
- Remediate audit-style gaps: site blocking, mandatory training, adoption KPIs, browser enforcement, and AI procurement test scripts.
- Dependencies
- Cybersecurity operations
- Identity/browser standards owners
- L&D / mandatory training policy
- Procurement / vendor-of-record teams
- Ownership
- Ministry/agency digital and cyber leads jointly; procurement owns vendor evaluation upgrades.
- Skills and adoption
- Staff need secure-tool habits; cyber teams need GenAI-specific DLP patterns; procurers need hallucination/bias test literacy.
- Governance checkpoints
- Monthly approved-vs-unapproved usage KPI
- Training compliance reports
- Pre-award AI vendor evaluation gate
- Acceptance criteria
- Unsafe GenAI sites blocked on managed devices
- Mandatory AI-risk training with refreshers
- Written Copilot/approved-tool adoption targets reported to management
- Risks
- Shadow use on personal devices
- False sense of security from allowlists alone
- Vendor self-attestation without live testing
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Secure GenAI architectures must enforce approved tenants/browsers, block high-risk consumer GenAI endpoints on managed devices, and instrument adoption KPIs—otherwise Enterprise Data Protection features are bypassed in practice.
Governance
Who approves, reviews and stays accountable for outcomes?
Shows governance theater risk: approved-tool policy without mandatory training, blocking, and management KPIs. Also flags cross-agency procurement (Supply Ontario AI Scribe VOR) where self-attestation outweighed live evaluation of hallucination/bias controls.
Security and privacy
What data, permissions and controls need testing?
Documents concrete data-exfiltration paths via unapproved GenAI websites and Copilot use outside Edge/OPS credentials; elevates GenAI shadow IT to a cybersecurity and privacy control failure, not merely a productivity preference.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Optional AI training completed by only 3% of staff undermines equitable, safe workforce adoption; residents are indirectly exposed via Document Verification Service and clinician AI Scribe pathways flagged for bias/hallucination gaps.
Procurement
What should contracts, pricing and exit terms secure?
Demonstrates that AI RFBs relying on vendor self-attestation and light live testing can miss hallucinations and bias mitigations—states should weight technical evaluation and post-award monitoring more heavily for GenAI.
Operating model
Which teams own the service once it runs?
Approved-tool operating models fail without enforcement, mandatory training, and management KPIs; shadow GenAI becomes the de facto operating model.
Publication history
- 2026-09-19State Government · Issue 143 resources
Stable resource ID: ontario-auditor-general-ai-ops-audit-20260512