New York State's Comptroller Thomas P. DiNapoli issues the second in a series addressing the use of Artificial Intelligence (AI) in New York Government. This a 2023 audit of New York City’s AI Governance

On April 3, 2025, New York States Comptroller Thomas P. DiNapoli reported that New York State’s centralized guidance and oversight of agencies’ use of Artificial Intelligence (AI) is inadequate and creates a risk that the technology could be used irresponsibly. The Comptroller concluded that "Improved Guidance" is needed for State Agencies using AI to avoid risks. 

The audit looked at the state’s overall AI policy and how AI was used at four state agencies: the Office for the Aging (NYSOFA), the Department of Corrections and Community Supervision (DOCCS), the Department of Motor Vehicles (DMV), and the Department of Transportation (DOT).

The audit, the second in a series on AI Use in New York Government, follows a 2023 audit of New York City’s AI Governance.

“New York state agencies are using AI to monitor prisoners’ phone calls, catch fraudulent driver’s license applications, assist older adults, and support government services,” DiNapoli said. “Our audit found insufficient central guidance and oversight to check that these systems are reliable and accurate, and no inventory of what AI the state is using. This audit is a wake-up call. Stronger governance over the state’s growing use of AI is needed to safeguard against the well-known risks that come with it.”

While the state has moved to implement AI systems, guardrails for these technologies have not kept pace. Without adequate guidelines and oversight, AI systems that are meant to help expedite and expand services can, for example, expose data to unintended sources and create inequalities in decision-making and the delivery of services.

In New York State, use of AI is governed by the Office of Information Technology Services (ITS), which issued its Acceptable Use of Artificial Intelligence Technologies Policy (AI Policy) in January 2024. The AI Policy requires agencies to assess the risks in the AI systems they use. DiNapoli’s audit highlights a disconnect between the state’s eight-page AI Policy and how agencies understand AI and their responsibilities. While New York’s AI Policy gives an overview of responsible AI use, it lacks any detailed guidance on its implementation and instead simply directs agencies to federal guidelines for further information.

A major problem with the AI Policy is that it leaves agencies free to determine what is, or is not, responsible use of AI. Conflicting and confusing guidance regarding use of confidential information with AI systems as well as lack of staff training also create opportunities for inadvertent noncompliance and contribute to concerns about unintended uses and consequences.

The U.S. Government Accountability Office (GAO) has cautioned that AI “has the potential to amplify existing biases and concerns related to civil liberties, ethics, and social disparities,” but the state’s AI Policy contains only two sentences dedicated to bias management, failing to address both the data used to set up AI systems and the monitoring of already implemented systems for fairness and equity.

ITS also does not have an inventory of AI systems in use by state entities and is still developing a process for creating one, more than a year after releasing the AI Policy and. Officials told auditors they become aware of AI systems when an agency makes a procurement request or reaches out for support, leaving it to them to determine whether the system they are using is AI and has to follow the state’s AI Policy. That was the case with NYSOFA, which had an AI system, but did not know the system fell under the AI Policy.

Knowing what AI systems are in use, how they’re being used and what data they’re drawing from is critical to ensuring this technology is being used ethically and responsibly.

Finally, ITS officials said state entities are responsible for their own AI review, risk assessments, reporting and compliance with the AI Policy requiring human oversight of AI systems and outcomes. There is, however, no mechanism for ITS to ensure these are done or done properly.

Agencies Use of AI 

Auditors found that while NYSOFA, DOCCS, and DOT use ITS’ definition of AI, they do not have in-house policies or specific procedures to govern how AI is authorized, developed or used, for ensuring the data is unbiased and reliable, or have formal requirements of human oversight. DOT has an AI working group that first met in June 2024, but it has not yet issued any formal policies.

DMV does have internal policies to assess AI risks and oversee its use, but no specific procedures to ensure these policies are carried out. It also has an AI Governance Committee and created its own definition of AI, but exempted its facial recognition software - which it said it did not consider to be an AI system - from AI oversight. It has not consulted with ITS on that decision, although ITS’ definition of AI explicitly considers a system using computer vision (i.e., that gathers information from digital images) and making recommendations based on that data to be AI.

DMV and DOT provided an informal inventory of the AI they have in use or in development. None of the agencies maintained a formal AI inventory.

DOCCS uses AI software that monitors inmates’ phone calls to ensure inmates are only making calls as authorized. DOCCS’ contract bars use or sharing of this information without its consent and owns the recordings. However, the agency does not have a plan for addressing potential AI risks, and the contract does not address reducing biases to decrease the possibility that an inmate could be unfairly or unnecessarily subjected to further investigation. The vendor explained to auditors how it mitigates biases in the system, but it was not clear if those efforts work because DOCCS does not monitor or measure the system’s error rates.

NYSOFA uses a voice-activated device that acts as an AI companion to combat social isolation and loneliness and foster independence among older people. It initiates conversations and remembers what users say. NYSOFA shared satisfaction surveys with auditors that reported a 95% reduction in loneliness among those using the device in 2023.

NYSOFA was uncertain if its use of the device met the definition of AI under the AI Policy, which it does. The policy requires human oversight by the agency, however since the devices are provided directly to users, the only human oversight is the user. NYSOFA officials said the quality of the product’s interactions is open to interpretation, based on each user’s experience. They also said the vendor is responsible for ensuring the device’s responses are accurate and appropriate, although that is not written into their contract, and NYSOFA does not conduct a review to check. When asked about data security and privacy of the data generated, NYSOFA stated that the developers of the product own the performance metric data and recorded data, and that the vendor can use and access this data. NYSOFA officials did not know if the vendor was allowed to use the data to build or improve other systems elsewhere.

The vendor for the system auditors reviewed at DOT stated that the system does use AI for other clients, but the way it was implementing the technology for DOT did not include AI. Ultimately, there was insufficient information to determine if the example case was in fact AI. However, DOT is piloting three AI systems.

None of the agencies have conducted periodic reviews or audits of their AI systems to determine if they are accurate, reliable, and free of biases. Only DMV has a policy requiring such a review. In addition, while the agencies have trained staff on using their AI systems, none have trained employees on the risk of inaccuracies or biases in AI.

Recommendations 

The audit made seven recommendations, including that ITS strengthen its AI Policy by including guidance for agencies on adopting AI, work with agencies to support their responsible use of AI, and implement training. The recommendations for the other agencies included creating AI governance structures and policies and coordinating with ITS. The audit also recommended that DMV review its facial recognition system with ITS to determine if it’s complying with the state’s AI Policy.

Agencies Responses 

ITS stated that it was reviewing the recommendations and considering improvements and was creating training materials on AI for state entities. NYSOFA, DOCCS and DOT generally agreed with the recommendations and said they would create IT governance and consult with ITS. DMV generally disagreed with the findings, but agreed with the recommendations. Their full responses are available in the audit.

DiNapoli's audit, along with a previous audit of New York City AI governance, underscores the importance of independent oversight to ensure that AI governance is appropriately designed and complied with by agencies. DiNapoli will be advancing a bill to the state legislature that would require regular, independent audits of state agencies' AI governance and their development, use, and management of AI tools and systems. If enacted, the legislation would help safeguard against risks and improve the likelihood that AI technologies are used responsibly, ethically and transparently.

Audit 
Office of Information Technology Services, New York State Office for the Aging, Department of Corrections and Community Supervision, Department of Motor Vehicles, Department of Transportation: New York State Artificial Intelligence Governance

Related Audit 
NYC Office of Technology and Innovation: Artificial Intelligence Governance (Feb. 2023)

Items selected from blogs posted on the Internet through the week ending April 4, 2025

 

Is There a Robot in Your Future? Recent developments in humanoid robots are grabbing plenty of global attention. Here are some intriguing robot developments and why we all need to pay attention. READ MORE   2 More States Ban DeepSeek From State Devices, Citing Risks Alabama and Oklahoma are the latest states to block AI tools with overseas ties from being used on government devices. Concerns include a lack of security as well as data collection and storage practices. READ MORE Pennsylvania’s GenAI Pilot: Efficiency by the Numbers The Pennsylvania Generative AI Pilot Program report revealed that the technology can save employees time — on average, 95 minutes a day — and simplify tasks, but human nuance remains essential for effective use. READ MORE   With Industry, FedRAMP 20x Looks to Accelerate Cloud Adoption The U.S. General Services Administration’s Federal Risk and Authorization Management Program, known as FedRAMP, will develop and implement a new approach to authorizations to make them easier and cheaper. READ MORE   Report: Privacy-Enhancing Tech Protects Government Data Data plays an essential role in governance, and a new report from the Open Technology Institute illuminates an urgent need for public-sector adoption of technologies that help enable secure use of data. READ MORE Building for the Future: Public Sector Workforce Technology Trends With increasing pressure on public sector leaders, technology is transforming workforce safety, efficiency, and resilience. DOWNLOAD THE REPORT On-demand webinar: Experts break down how to: Automate records management and free up staff time; Cut down on records requests with a self-service portal; Stay compliant—without added complexity Watch now  Reflecting on Detroit's Return as a City of Hope A land of opportunity decades ago, Detroit fell into decline, but its revival is heartening. READ MORE   Hopes for Offshore Wind Are Blowing Away Legal challenges, economic factors and Trump administration policies are all creating problems for commercial wind farms. READ MORE   President Turns Toward Forced Treatment of Homeless Individuals The administration is shifting resources away from Housing First, the long-established approach of getting individuals into supportive housing as the first priority. READ MORE   Texas to Spend Billions Addressing Water Shortage Legislators have made water a priority this session, with the state falling short of ever-increasing demand. Ideas for addressing the problem range from conservation to desalination. READ MORE Streamline operations, free up resources for a safer community Smarter technologies to streamline operations, reduce costs, and free up resources for what matters most. Get your guide. Where Are State DOGE Groups? A Map of Efficiency Initiatives A Government Technology tracker of the evolving landscape of state government efficiency initiatives, distinguishing between those directly inspired by federal DOGE directives and independent programs. READ MORE   What the FedRAMP Updates Mean for States and Localities   Security experts are currently tuned in to FedRAMP program changes and the potential impact on the way businesses work with government agencies. Some outcomes from its emerging 20x initiative will likely take time to become clear. READ MORE   Boulder City, County Use Tech to Bring Aid to Coloradans In separate endeavors with the technology company AidKit, Boulder County and the city of Boulder are simplifying how they deliver financial relief to residents, child-care providers and nonprofits. READ MORE   Report: Local Governments Face Stiff Obstacles on Web Access As DOGE-driven cuts target services for people with disabilities, a new report finds that local government officials have bought into the concept of more accessibility. Even so, those officials see significant hurdles. READ MORE   Opinion: AI Laws Should Empower Innovation, Not Stifle It The Virginia governor's veto of a measure that would have regulated artificial intelligence, and the revision of an AI governance bill in Texas, signal a potentially noteworthy juncture in the creation of such policy. READ MORE  What's Behind the Push to Revive Nuclear Power? Increasing demand for power is leading lawmakers to promote an energy source that's languished for decades. READ MORE

New York States' Freedom of Information Law does not require the creation of records not in existence or not in the possession of the entity

The New York City Department of Citywide Administrative Services [DCA] denied Petitioners' FOIL requests for records pursuant to New York State's Freedom of Information Law, Public Officers Law §§84-90, seeking "[a] list containing the name, race, gender, current salary, current job title, city start date, salary on city start date, [and] title start date, of all employees of" several City agencies over a period of 10 years. Petitioners appealed DCAS' decision.

Supreme Court directed DCAS to produce certain records Petitioners had demanded of that entity. Supreme Court also denied a motion submitted by the Respondent Fire Department of the City of New York [FDNY] involving certain records Petitioners sought from FDNY.

 The Appellate Division "unanimously modified, on the law" with respect to the extent of the court's Supreme Court's denying the petition with respect to the FOIL requests Petitioners had submitted to DCAS. The Appellate Division sustained DCAS's denial of Petitioner's FOIL requests and, citing Matter of Oustatcher v Clark, 217 AD3d 478, opined that DCAS's rejection of the Petitioners' FOIL request was not "affected by an error of law".

Observing that Supreme Court had improperly ordered DCAS to produce information possessed by a different agency, the Financial Information Systems Agency [FISA], the Appellate Division explained that FOIL does not require an agency "to prepare any record not possessed or maintained by" that agency and DCAS's witness had given unrebutted testimony that several of the eight categories of requested information were maintained in a separate database by FISA, not DCAS. Thus, said the court, DCAS was "under no obligation" to provide the information held be FISA and Supreme Court improperly required DCAS to undergo a process that would constitute the creation of a new record. 

Addressing another aspect of Petitioners'  FOIL request, the Appellate Division observed that Petitioners had also sought FDNY "... records[] pertaining to cases initiated by the Bureau of Investigations and Trials ('BIT[S]')" . . . , including . . . details of all BIT[S] cases initiated against members of the FDNY, with a breakdown of each case identified by: [c]ase number; [b]ureau . . . ; [i]nfractions charged; [r]ace of charged party; [g]ender of charged party; [d]isposition of the case; and [d]iscipline imposed on charged party.".

The Appellate Division said Supreme Court "properly concluded that compliance with this aspect of the demand set out in Petitioners' FOIL request would constitute the "creation of a new record" as FDNY's witness gave unrebutted testimony that the database containing BITS case records does not contain race and gender information and to match BITS information with employees' races and genders contained in an independent database would entail much more than a simple manipulation of computers to transfer existing records.

Click HERE to access the Appellate Division's decision posted on the Internet.

Applying for accidental disability retirement benefits

 The Petitioner, a police officer, applied for accidental disability retirement benefits. His application was denied by the New York State Employees' Retirement System. Following a hearing, a Hearing Officer sustained the System's denial of Petitioner's application, finding that the underlying incident and injuries sustained by Petitioner arose from risks inherent in the performance of his duties as a police officer and, thus, did not constitute an accident for purposes of accidental disability retirement. 

The Executive Deputy Comptroller adopted the Hearing Officer's decision and Petitioner initiated a CPLR Article 78 proceeding challenging the Executive Deputy Comptroller's decision. The Appellate Division affirmed the Executive Deputy Comptroller's determination, opining:

1. As the applicant, Petitioner bore the burden of establishing that his disability was the result of an accident within the meaning of the Retirement and Social Security Law;

2. The Executive Deputy Commissioner's determination that Petioner's disability was not the result of an accident will be upheld if supported by substantial evidence in the record as a whole;

3. An event which is a risk inherent in the work performed is not an accident for purposes of [accidental disability retirement] benefits"; and, 

4. An event that is not a risk inherent in one's job must be a sudden, unexpected occurrence in order to amount to an accident.

 As the Court of Appeals explained, "a precipitating event that could or should have reasonably been anticipated by a person in [petitioner's] circumstances is not an accident for purposes of [accidental disability retirement] benefits". Thus, "an injury which occurs without an unexpected event as the result of activity undertaken in the performance of ordinary employment duties, considered in view of the particular employment in question, is not an accidental injury".*

Consequently, "where the injury-causing event constitutes a risk inherent in a police officer's duties, it is not unexpected and, thus, not an accident" Petitioner's application was denied upon a finding that the incident did not constitute an accident within the meaning of Retirement and Social Security Law §363. 

* See 2024 NY Slip Op 06234

Click HERE to access the Appellate Division's decision posted on the Internet.

Providing an accommodation of a disability not strictly necessary for an employee’s performance of essential job functions may still be reasonable

Plaintiff, a teacher, appealed a decision by the United States District Court, Northern District of New York, granting a Central School District's [CSD] motion for summary judgment dismissing Plaintiff's claim that the CSD had violated the Americans with Disabilities Act [ADA] when it failed to provide her with a reasonable accommodation for her disability. 

Plaintiff conceded that "notwithstanding her disability-related pain", she was able to perform the essential functions of her job “regardless of the alleged denial of her accommodation” by CSD. Accordingly, the federal district court held that she failed to satisfy her burden of proving that she was entitled to a reasonable accommodation within the meaning of ADA.

Such a ruling, said the United States Circuit Court, Second Circuit, was error, noting "A straightforward reading of the ADA confirms that an employee may qualify for a reasonable accommodation even if she can perform the essential functions of her job without the accommodation". Further, opined the Court, "an ability to perform the essential functions of the job is relevant to a failure-to accommodate claim, but it is not dispositive". 

The Circuit Court's decision noted that Plaintiff had worked for CSD for approximately 20 years and has suffered "for decades from post-traumatic stress disorder" [PTSD] related to sexual harassment and sexual assault by a supervisor in her former workplace and her PTSD symptoms "affected her neurological functioning, interfered with her ability to perform daily tasks, induced a stutter that impedes communication, and caused nightmares so severe she has awakened vomiting." 

Following a change in school administration, CSD began prohibiting teachers from leaving school grounds during preparation periods. When Plaintiff attempted to do so despite the new policy, she was reprimanded for insubordination and was told that "the documentation [Plaintiff] had on file was insufficient to establish her right to a reasonable accommodation". 

Rather than provide additional documentation, Plaintiff took paid sick leave and then requested leave pursuant to the Family and Medical Leave Act [FMLA].  Upon Plaintiff's return from FMLA leave, CSD granted her one of her requested breaks in the morning, plus a break in the afternoon on days when a school librarian could watch her students but when a librarian was unavailable, Plaintiff was unable to take an afternoon break. 

Viewing the evidence in the light most favorable to Plaintiff, the Circuit Court's decision noted that Plaintiff had "used breaks to compose herself away from the workplace", an environment that tended to trigger her symptoms. 

The Circuit Court of Appeals concluded that the District Court erred by holding that an employee’s ability to perform the essential functions of her job without a reasonable accommodation is fatal to her failure-to-accommodate claim. Vacating the lower court's judgment, the Circuit Court remanded the matter to the District Court "for further proceedings" consistent with its opinion. 

Click HERE to access the Circuit Court's decision posted on the Internet.