City Safeguards Fail Security Test As Airport Employees Use Unapproved Artificial Intelligence Tools
by Mark Smiley
AI Oversight Concerns: A Denver audit found that employees at Denver International Airport were using seven unreviewed or unapproved artificial intelligence tools more frequently than the airport’s approved Microsoft Copilot platform. Auditors warned that the airport lacks a comprehensive AI governance framework.
As artificial intelligence rapidly transforms government operations, a new audit has revealed significant weaknesses in how the City and County of Denver and Denver International Airport oversee the emerging technology, raising concerns about data security, employee accountability, and the protection of sensitive information.
The audit, conducted by Denver Auditor Timothy M. O’Brien, found that the city has failed to fully implement safeguards governing artificial intelligence, while Denver International Airport has yet to establish a comprehensive framework for managing the technology. The findings are particularly troubling as government agencies increasingly rely on AI tools to improve efficiency, communicate with residents, and manage daily operations.
“We’re one of the first in the country to audit a municipality’s artificial intelligence use,” O’Brien said. “AI is evolving so quickly it is tough to keep pace. Both Denver and Denver International Airport have adopted AI. And both need to catch up to ensure AI use on their systems is safe, ethical, and secure.”
City’s AI Security Measures Fail Audit Test
Among the audit’s most concerning discoveries was a failure in Denver’s existing data-protection measures. Auditors successfully entered simulated prohibited information into a publicly accessible artificial intelligence system without triggering the security warning that city officials said should have appeared.
Technology Services personnel attributed the failure to a deployment problem that prevented security updates from reaching all city-owned computers. The incident demonstrated a potentially significant vulnerability in the city’s ability to prevent employees from inadvertently sharing confidential or sensitive information with outside AI platforms.
The audit also found that Denver lacks a centralized inventory of the artificial intelligence systems being used across city government. Instead, information about those systems is maintained in multiple disconnected locations, making it more difficult for officials to identify potential security threats, monitor performance, and ensure consistent oversight.
Although the city monitors the accuracy and performance of Sunny, its AI-powered chatbot designed to help residents navigate Denver’s website, auditors found no evidence that comparable monitoring practices were consistently applied to other AI systems.
Beyond the technical shortcomings, Denver has not formally incorporated artificial intelligence into its existing technology risk-management policies. While Technology Services officials have worked with the City Attorney’s Office to address regulatory concerns, those efforts have not been fully integrated into the city’s established information technology oversight procedures.
City technology leaders acknowledged that budget limitations and competing demands on staff time have delayed the development of more comprehensive AI policies.
“Once the city adds artificial intelligence rules in its IT policies, Technology Services can ensure there is meaningful AI oversight and city staff will have better clarity around allowable and safe AI use,” O’Brien said.
Airport Employees Using AI Tools Without Formal Approval
The findings at Denver International Airport revealed an even more fundamental problem: The airport’s Business Technologies Division has not established a formal artificial intelligence governance framework.
Despite Microsoft Copilot being the airport’s approved AI platform, auditors discovered that it ranked only eighth among AI tools used on the airport’s network. Seven other tools, which had not been reviewed or approved, were being used more frequently.
The discovery raises questions about what information airport employees may be entering into outside AI platforms and whether sufficient safeguards exist to protect sensitive airport operations and data.
Without a formal process to monitor the use of publicly available AI applications, airport officials have limited ability to identify potentially risky employee activity or prevent unauthorized information from being shared. Auditors warned that the absence of adequate oversight increases the possibility of security incidents involving the airport’s network.
The audit did not establish that a data breach had occurred. Rather, it identified weaknesses that could make such incidents more difficult to prevent or detect.
Airport officials also have not established consistent performance measurements to determine whether AI systems are functioning properly or delivering their intended benefits. Without those benchmarks, the airport may struggle to recognize operational problems, evaluate the effectiveness of AI investments, or identify emerging technological risks.
AI Expansion Planned
Despite Oversight Concerns
The timing of the audit is particularly significant because Denver International Airport intends to expand its use of artificial intelligence in the coming years.
According to the airport’s 2025 Vision 100 strategic plan, officials anticipate implementing additional AI technologies over the next three to five years. However, auditors found that the airport has not established the policies and procedures necessary to adequately evaluate the risks associated with that expansion.
Airport technology leaders have focused on developing guidelines describing acceptable AI use rather than creating a comprehensive governance program. Those guidelines, according to the audit, do not provide a formal process for evaluating AI-related risks.
The airport also lacks documented policies governing how outside vendors use artificial intelligence, potentially creating additional vulnerabilities when third-party companies interact with airport technology systems.
“Artificial intelligence is evolving too quickly for Denver International Airport to take years to adopt more AI tools and learn how to responsibly govern them,” O’Brien said. “I trust our recommendations help the airport move more quickly to minimize risks and better protect information.”
City And Airport Agree To Make Changes
Despite the shortcomings identified in the audit, both Denver’s Technology Services agency and Denver International Airport agreed with all recommendations issued by the Auditor’s Office.
The recommendations call for stronger oversight, more comprehensive policies, improved monitoring, and formal procedures to identify and manage risks associated with artificial intelligence.
The Auditor’s Office plans to conduct follow-up reviews to determine whether the agencies have implemented the recommended improvements.
The findings highlight a growing challenge facing municipal governments nationwide. Artificial intelligence offers opportunities to streamline public services, reduce administrative workloads, and improve communication with residents. However, adopting the technology without appropriate safeguards can introduce new security, privacy, and accountability concerns.
For Denver, the audit underscores the importance of establishing clear rules before artificial intelligence becomes even more deeply embedded in government operations.
The question now is whether city and airport officials can strengthen their oversight quickly enough to keep pace with a technology that continues to evolve.
