On August 27, New York State Comptroller Thomas DiNapoli released a follow-up audit of how New York City governs its use of AI. The original audit, in February 2023, found that city agencies had no rules or guidance on how to actually use AI, so each agency had worked out its own approach. It made three recommendations to the city’s Office of Technology and Innovation.
As of April 2026, all three recommendations were partially implemented. None was finished.
The city has made progress. According to Route Fifty’s reporting on the audit, it has written definitions of AI, published preliminary guidance on generative AI, set up a citywide steering committee, and started a risk-assessment process for AI tools.
The gaps are familiar. The city still doesn’t keep a complete inventory of the AI tools its agencies use. It has no consistent citywide standards and no formal process for the public to raise concerns about AI systems. Some sampled agencies have no AI-specific policies at all. Others rely on rules written for other purposes, such as the NYPD’s surveillance technology policies. Risk assessments happen on a consultative or voluntary basis, and agencies report their own AI tools.
The Office of Technology and Innovation said it is reviewing the recommendations. It pointed to a record number of algorithmic tools documented in this year’s annual report under Local Law 35, which requires agencies to disclose the tools they use. City Hall has said a new Office of Algorithmic Accountability is moving ahead with six budgeted positions. It was due by June, and no further announcement has been made.
Three years, three recommendations, none finished.
Why voluntary is the weak point
A self-reported inventory counts what agencies choose to report. A record number of tools in the annual report could mean better reporting, more AI, or both. From the outside, there’s no way to tell which. A voluntary risk assessment happens when someone thinks to ask for one.
New York City is large, but the pattern isn’t unique to it. Any organization where departments buy and run their own technology faces the same problem: the central office writes the guidance, and the departments decide how much of it applies to them.
Questions for any organization with many departments
- Is your AI inventory built from self-reporting, or checked against purchasing records, contracts, and network data?
- Is a risk assessment required before a tool goes live, or only available on request?
- Does every department have an AI policy, or are some relying on rules written for other technology?
- Where does a resident or an employee take a complaint about an AI-assisted decision?
- When an auditor’s recommendations come back partially done, who owns finishing them?
The follow-up found the same gaps as the first audit, with more structure around them.
Sources