The Small Business Administration (SBA) has not yet finalized an AI strategy, developed a generative AI policy or established governance processes, despite piloting several AI models, according to a September 30 FedScoop report on a management advisory made public on Monday by the agency’s inspector general. 

The Office of Inspector General (OIG) did not identify a reason for the gaps. Its findings show that SBA had taken some initial steps toward implementing federal AI requirements but had not put the required governance structures and processes in place. SBA had also not convened its AI governance board or established a process to identify high-impact AI use cases. 

An earlier review by the Government Accountability Office (GAO) found that staff turnover, gaps in documentation and limited agencywide processes had contributed to problems with AI-use reporting.

The findings come as SBA pilots several AI applications. According to the report, the agency published its first AI use-case inventory in March, two months after the federal reporting deadline. The inspector general found that the inventory did not include a pilot designed to detect fraud in pandemic assistance loans.

SBA Needs Broader Visibility Into AI Use

According to FedScoop, the inspector general recommended that SBA establish a process to collect all AI use cases across the agency and update its inventory at least annually. It also recommended a process for consistently identifying high-impact AI uses and documenting decisions about whether a use case meets that definition.

The inspector general said the system could potentially flag loans as fraudulent and indicated that the use case met the Office of Management and Budget’s definition of high-impact AI. SBA managers had determined that it did not qualify as high impact.

The watchdog also recommended that SBA evaluate and update its policies covering information technology infrastructure, data, privacy and cybersecurity, and develop a generative AI policy with safeguards and oversight mechanisms.

SBA agreed with all recommendations and proposed corrective actions. The inspector general said the recommendations can be closed once the agency provides evidence that the actions have been implemented, according to the report.

Data Governance Becomes Part of AI Oversight

For chief data officers (CDOs), the findings highlight the importance of knowing where AI is being used, what data those systems rely on and how higher-risk use cases are identified. An organization-wide AI inventory can provide visibility into those deployments and help connect AI oversight with existing data governance processes.

The SBA recommendations also show why AI governance cannot be separated from data, privacy and cybersecurity policies. CDOs can help establish processes for documenting AI use cases, identifying the data involved and assigning responsibility for how that data is used.

For organizations expanding AI use, AI governance provides a framework for connecting AI deployment with data, privacy, risk and accountability.