City and airport lack strong artificial intelligence governance

City and airport lack strong artificial intelligence governance

Published on October 22, 2026

Lea el artículo en español(PDF, 151KB)

DENVER - While the City and County of Denver needs to improve its artificial intelligence governance framework, the Denver International Airport still needs to create one, according to a groundbreaking new audit from Denver Auditor Timothy M. O'Brien, CPA.

"We're one of the first in the country to audit a municipality's artificial intelligence use," Auditor O'Brien said. "AI is evolving so quickly it is tough to keep pace. Both Denver and Denver International Airport have adopted AI. And both need to catch up to ensure AI use on their systems is safe, ethical, and secure."

An AI-governance framework outlines the people responsible for managing AI and the system of rules, practices, and processes they must rely on to carry this out.

The City and County of Denver's Technology Services and Denver International Airport agreed with all our recommendations, showing their commitment to addressing this important technological issue.

Technology Services: information monitoring

Technology Services needs to better evaluate and measure how its AI systems affect the city.

The agency has only partial data-protection controls to block city staff from typing or uploading private or sensitive data into public AI systems. In our review of the city's data-protection controls, we successfully entered false, prohibited information into a publicly-accessible AI system and did not receive an alert that the city says should appear. Technology Services staff said a "deployment issue" prevented the application of security updates to all city-owned computers.

The city's Sunny chatbot helps visitors find information on the city's website. The city monitors Sunny's issues and accuracy of responses, but we did not find evidence the agency is monitoring all AI systems similarly.

Technology Services does not have a single source of record for its AI inventory. Having inventory information across multiple, disconnected systems makes it harder for Technology Services to manage AI use safely, ensure consistent oversight, and reduce potential risks to the city.

Technology Services: policies and procedures

The city has not included AI in its "Technology Risk Management" policy and has not integrated AI governance into its IT policies. Because Technology Services is in the beginning stages of adopting AI across the city, the agency has not developed and documented its AI risk-management process.

While Technology Services leaders work with the City Attorney's Office to monitor, address, document, and maintain AI risk-management efforts that meet regulatory requirements, these efforts are not part of the agency's formal IT risk-management process. The city also has no formal, written process for handling AI regulations.

Technology Services leaders said they have not prioritized including AI governance in their IT policies because of budget and time constraints.

"Once the city adds artificial intelligence rules in its IT policies, Technology Services can ensure there is meaningful AI oversight and city staff will have better clarity around allowable and safe AI use," said Auditor O'Brien.

Denver International Airport: AI usage and impact

Denver International Airport Business Technologies Division does not have an AI governance framework. Consequently, it does not have a formal process for monitoring airport staff's use of publicly-available AI tools. Microsoft Copilot - the airport's approved AI tool - is only the eighth most used AI tool. Airport employees are using seven other unreviewed or unapproved AI tools on the airport's network. Because there is no AI-use monitoring process, there is an increased risk of staff sharing unauthorized or sensitive information and an AI incident occurring on the airport's network.

The airport cannot effectively evaluate the operational impact of AI systems because it does not have defined performance metrics and ongoing monitoring. The airport has limited ability to detect system-performance issues, control deficiencies, and emerging risks.

Denver International Airport: policies and procedures

The airport's IT policies and procedures do not formally include AI governance in its processes. Business Technologies leaders have prioritized creating AI acceptable-use guidelines over formalizing their AI-governance program, but the guidelines do not evaluate AI-related risks.

Business Technologies does not have documented policies for managing vendor's AI use and does not have procedures for assessing and monitoring AI risks. Staff may not have the guidance and enforcement mechanisms needed to govern AI systems in use on the airport's network, exposing the airport to multiple risks.

The airport's 2025 "Vision 100" strategic plan says the airport intends to implement AI tools in the next three to five years.

"Artificial intelligence is evolving too quickly for Denver International Airport to take years to adopt more AI tools and learn how to responsibly govern them. I trust our recommendations help the airport move more quickly to minimize risks and better protect information," said Auditor O'Brien.

We will conduct a follow-up audit of Technology Services and Denver International Airport to track their progress.

AUDITOR TIMOTHY O'BRIEN, CPA
Denver Auditor

Denver Auditor's Office

201 W. Colfax Ave. #705 Denver, CO 80202
Email: [email protected]
Call: 720-913-5000
Follow us on Facebook Connect with us on X

• Auditor