Objective

To assess the State University of New York’s progress in establishing an appropriate artificial intelligence (AI) governance structure over the development and use of AI tools and systems. The audit covered the period from January 2019 through October 2025.

About the Program

AI-powered tools have an increasingly significant role in industry operations, including education, agriculture, health care and medicine, manufacturing, transportation, and government, thereby enabling entities to improve their operations. In recent years, the use of AI has rapidly gained popularity among public and private institutions. As the use and sophistication of AI systems have been growing, they have also given rise to a host of unintended consequences.

AI systems pose unique challenges in accountability because their inputs and operations are not always visible. The U.S. Government Accountability Office noted that a lack of transparency reduces effective oversight in identifying errors, misuse, and bias. Additionally, AI systems are frequently complex, making it difficult to detect and respond to these failures when they occur. Therefore, it is essential to establish governance structures over AI to ensure that its use is responsible, transparent, and accurate, and that it does not generate harmful, unintended consequences.

The State University of New York (SUNY) is the largest comprehensive system of public higher education in the nation, comprising 64 institutions, including research universities, academic medical centers, liberal arts colleges, community colleges, and colleges of technology. SUNY’s governing arm, SUNY System Administration (SUNY Admin), provides general oversight of operations for State-operated campuses and ensures their compliance with rules and regulations through policies and procedures. SUNY officials explained that SUNY’s authority over community colleges is limited to general supervision and the approval of curricula and academic programs. SUNY campuses have adopted AI to support operations, including transcribing clinical notes during patient visits, reading license plates and identifying parking violations in campus parking lots, monitoring campus data to identify students who are at risk of dropping out, and automatically masking personally identifiable information from video evidence.

Key Findings

SUNY Admin does not have an effective AI governance framework, a standard definition of AI, or documented policies and procedures related to the development and use of AI systems. While SUNY Admin’s organization-wide Information Technology (IT) policies establish requirements or guidance for IT governance, they do not ensure AI use is identified or specifically address AI risks, which encompass a broader range of concerns arising from the development and use of AI technologies. AI risks go beyond traditional information security risks and include bias and inaccuracies in AI algorithms and AI-specific governance concerns, such as insufficient human oversight, AI life cycle management, transparency and explainability in AI decision-making, and inventory management that identifies systems with AI capabilities.

Given the speed with which AI technology is evolving, it is critical that SUNY Admin adequately supports campuses in their use of AI systems to protect against the broad range of potential risks. Our sample of four SUNY campuses that have used AI—University at Albany (Albany), Stony Brook University (Stony Brook), Upstate Medical University (Upstate), and Onondaga Community College (Onondaga)—found that AI governance at the four campuses varies significantly. Some campuses have identified key risks and taken steps to address them, while others have not created or updated policies to address risks or taken other steps toward effective AI governance. For example, none of the campuses required or implemented specific procedures to test their AI systems to evaluate whether outputs were accurate or biased.

Several factors contributed to inconsistent and inadequate AI governance, including a lack of guidance for campuses and poor identification of AI technologies. These incomplete approaches to AI governance do not ensure that SUNY’s use of AI is accurate, unbiased, and transparent, and that it avoids disparate impacts. Furthermore, SUNY Admin should coordinate with campuses regarding AI governance and applicable requirements.

Key Recommendations

To SUNY Admin, Albany, Stony Brook, Upstate, and Onondaga:

• Implement policies to create an effective AI governance structure.
• Provide guidance and oversight as necessary to assist with the governance of AI systems.

To SUNY Admin:

• Coordinate with campuses, as appropriate, to identify relevant requirements and guidance to support the development of AI governance.