The review by City Auditor Timothy O’Brien found Denver has no formal written process for handling AI regulations. The city’s Technology Services division also has limited controls to prevent employees from entering sensitive information into public AI tools, and auditors found no evidence that the city monitors all of its AI systems for accuracy and other problems.

In a test of the city’s data protections, auditors entered false, prohibited information into a publicly accessible AI system. The alert that city officials said should have appeared did not. Technology Services staff attributed the missing alert to a deployment problem that kept security updates from being installed on all city-owned computers, the audit said.

The city monitors Sunny, its AI-powered chatbot, but the audit found that practice has not been extended to every system. Denver officials told auditors that budget and staffing constraints have limited efforts to make AI governance part of the city’s information technology policies.

“AI keeps changing rapidly, and so staying on top of this is difficult,” said Merlin Namuth, the city’s chief information security officer. He said Denver is working to improve its practices as more AI systems come into use.

At DIA, auditors found no AI governance framework and no process for tracking employees’ use of public tools. Microsoft Copilot is the airport’s approved AI tool, but staff were also using seven other tools that had not been reviewed or approved, according to the report.

The airport’s policy allows employees to use approved external AI tools if they follow airport rules, record which tools they use and check AI-generated work for accuracy. But the audit said the policy does not explain how the airport identifies and manages risks from those tools. Airport officials said they consult with other airports about AI-related concerns.

The findings come as Denver continues to explore AI’s role in government. Mayor Mike Johnston launched the city’s first DenAI Summit in 2024 to discuss how the technology might improve efficiency and public services. The city later sought qualified AI vendors for government work.

DIA, one of the world’s busiest airports, is managing major construction and development projects intended to prepare it to serve 100 million passengers. O’Brien said the airport needs to move faster to set rules as it adopts AI, while protecting information and reducing risks.

Both the city and airport agreed to all recommendations from the audit committee. The report described AI as an evolving technology that can be difficult for public agencies to oversee, but the gaps it identified underscore the need for clear rules, security controls and accountability as government use grows.