An audit revealed the State University of New York (SUNY) system lacked an effective AI governance framework and documented policies and procedures related to the development and use of AI systems, according to the state Comptroller's Office.
The SUNY system's approach to AI tools and systems were assessed by New York state Comptroller Tom DiNapoli's office between January 2019 and October 2025. After the audit was conducted and before its release recently, SUNY instituted a systemwide artificial intelligence policy in April that addresses some of the issues noted in the audit.
"As the use and sophistication of AI systems have been growing, they have also given rise to a host of unintended consequences," the Comptroller's Office says, adding that
AI systems are "complex" and "pose unique challenges in accountability."
"Therefore, it is essential to establish governance structures over AI to ensure that its use is responsible, transparent, and accurate," DiNapoli's office continued, "and that it does not generate harmful, unintended consequences."
Here's what the audit revealed and what SUNY says about it.
What SUNY says about comptroller's AI audit
A SUNY spokesperson in a statement asserted the system "continues to demonstrate leadership in the responsible use of AI to support our students and advance groundbreaking research for the public good."
"Because the OSC report concluded its information-gathering in October 2025, it does not reflect SUNY’s significant progress and safeguards, including SUNY’s adoption last spring of a Systemwide Artificial Intelligence Policy Framework following months of engagement with campus leaders, faculty, staff, and researchers," the statement said.
"SUNY will continue to respond deliberatively and in real-time to the rapidly evolving world of AI and in collaboration with the Comptroller’s Office and other partners in State government,” it added.
What is the SUNY system currently using AI for?
According to the Comptroller's report, SUNY campuses have adopted AI in several capacities, including the following:
- Transcribing clinical notes during patient visits.
- Reading license plates and identifying parking violations in campus parking lots.
- Monitoring campus data to identify students at risk of dropping out.
- Automatically masking personally identifiable information from video evidence.
What improvements should the SUNY system make?
The audit found that the SUNY system had an ineffective AI governance framework, lacked a standard definition of AI and needed documented policies and procedures related to the development and use of AI. And while SUNY's Information Technology department did have certain safety and security policies in place, the policies didn't ensure AI use was identified, nor did they specifically address AI risks.
Additionally, at the time of the audit, SUNY did not maintain a formal inventory of its AI systems and did not have or require metrics to measure the performance of its AI systems. And while the agency said they provide AI training to their staff, the Comptroller's Office found that the training SUNY offers doesn't cover all of the AI risks.
"Given the speed with which AI technology is evolving, it is critical that SUNY Admin adequately supports campuses in their use of AI systems to protect against the broad range of potential risks," the comptroller's report states.
While the audit was being conducted, SUNY shared with the Comptroller's Office that they were working on a policy that would include a specific definition. The agency's systemwide AI policy was introduced on April 30, 2026, and includes a definition, responsible AI use rules and a requirement to occasionally review AI-related policies "to account for changes in AI technology, the regulatory environment, and campus operational practices."
How can certain SUNY schools improve their AI use?
Four SUNY schools that use AI — University at Albany in Albany, Stony Brook University on Long Island, Upstate Medical University in Syracuse and Onondaga Community College in Syracuse — were included in the comptroller's audit.
A main issue found across the board is that AI governance at each of these campuses "varies significantly," the audit noted. For example, some campuses have AI-specific policies, but none of the schools require or implement specific procedures to test their AI systems for accurate or biased outputs.
At the time of the audit, Upstate, Stony Brook and Onondaga had updated their policies or drafted new policies to address AI use, but they had yet to implement them. The Comptroller's Office, however, said Onondaga and Stony Brook's updates were "insufficient." And Albany said the university intended to use its existing policies to address AI risks.
When it comes to keeping an inventory of which AI tools the campuses use, only Stony Brook maintained one, according to the audit. However, the Comptroller's Office argued the school's inventory didn't include all of its tools.
Additionally, none of the schools included in the audit had conducted periodic reviews of their AI systems to ensure accuracy and appropriate performance. Only Onondaga's college had a written requirement for human oversight of its AI processes, and all of the schools' AI risk training varied. For example, Story Brook offered it, but it was not mandatory campus-wide and Albany provided guidance on AI risks, but didn't offer any training about it.
As part of SUNY's recently adopted AI policy, each SUNY institution is required to publish an AI policy of their own or update existing policies by Dec. 31, 2026.
How SUNY is responding to the audit's findings
In their initial response to the audit's findings in May, SUNY explained how their newly implemented AI policy resolved some of the issues found by the Comptroller's Office and said additional AI-related policies and procedures would continue to be developed.
"SUNY campuses and affiliates each have autonomy and systems customized to their needs," SUNY's response says. "Because of this, SUNY will continue with thoughtful planning and actions to adopt AI policies through our shared governance practices as appropriate."
All four of the SUNY institutions included in the audit provided responses as well, with Stony Brook, Upstate and Albany all agreeing with the recommendations set forth in the Comptroller's report.
Stony Brook says they will continue to develop and update their policies and provide guidance and oversight as necessary. Upstate asserts that they've recently approved new AI-specific policies as of late May. And Albany's Presidential Taskforce on AI Policies, which has been tasked with developing a "meaningful, campus-informed guide" for the campus' AI use, anticipates a final AI policy to be in place by October.
Onondaga's response included plans to apply the SUNY AI policy as well as charging their governance committees with developing updated policies and implementing risk management practices.
Emily Barnes covers state government for the USA TODAY Network-New York with a focus on how policy and laws impact New Yorkers' taxes, communities and jobs. Follow her on Instagram or X @byemilybarnes. Get in touch at ebarnes@usatodayco.com.
This article originally appeared on Rockland/Westchester Journal News: Audit reveals AI oversight gaps in State University of New York system
