evidoria

← Back to browse

Good practice Imported

Ontario's Auditor General Exposes Shadow AI and Governance Gaps Across the Public Service

Canada · Toronto · See the Canada profile · See the Toronto profile

Evidence: Observational / pre–post Top 25% 73/100 · Ask Evidence Copilot about this practice

A May 2026 audit found roughly 12,000 Ontario public servants visited unsecured AI websites, only 3% completed AI training, and hospital AI transcription tools 'hallucinated' — a rare quantified, independent look at how a major government's AI rollout performs in practice.

about 12,000
OPS employees who visited AI-related websites (April-August 2025)
about 400
Distinct AI-related websites visited (April-August 2025)
about 60 %
Visited AI websites classified unsafe or unsecured (April-August 2025)
3 %
Staff who completed the voluntary Responsible Use of AI training
6 %
Staff genAI use accounted for by the OPS's own approved secure tool
5
Recommendation areas issued by the Auditor General
Ontario's Auditor General Exposes Shadow AI and Governance Gaps Across the Public Service Ontario's Auditor General Exposes Shadow AI and Governance Gaps Across the Public Service

Details

Promoter
Office of the Auditor General of Ontario / Ontario Ministry of Public and Business Service Delivery and Procurement
Period
Audit period Jan–Nov 2025; report released May 2026
Keywords
governance, internal operations, cybersecurity, healthcare

Context

The Office of the Auditor General of Ontario's special report, Use of Artificial Intelligence in the Ontario Government, released 12 May 2026, examined how the province's Industrialize Artificial Intelligence Across Ontario (2024) strategy played out in practice across the Ontario Public Service between January and November 2025.

Results

Key quantified findings include about 12,000 OPS employees visiting roughly 400 different AI-related websites between April and August 2025, of which about 60% were classified unsafe or unsecured, only 3% of staff completed the voluntary Responsible Use of AI training, the OPS's own approved secure generative-AI tool accounted for just 6% of staff genAI use, and an AI medical-transcription AI Scribe tool piloted with Ontario doctors was found to fabricate clinical content.

Conclusions

The Auditor General issued five recommendation areas covering cybersecurity and training, measurement and adoption, fairness and bias detection, procurement practices, and strategic governance, after a review of procurement found limited validation of vendor security and bias testing before deployment, making the report a rare independent, quantified, government-wide audit of AI adoption that documents gaps rather than success metrics.

Implementation

Indicative cost
Low (< €50k)
Time to results
Short (< 1 year)
Staffing & skills
Office of the Auditor General of Ontario (independent audit body), Ontario Ministry of Public and Business Service Delivery and Procurement (subject of review)

Conditions for success

  • Access to administrative telemetry, such as web-traffic and training-completion records, across the whole Ontario Public Service enabled a quantified, government-wide audit rather than a sample survey.
  • Independent auditor status allowed publication of gaps, including unsafe site use, low training completion and a hallucinating AI tool, without a stake in defending programme outcomes.

Common failure modes

  • Only 3% of staff completed the voluntary AI training and the OPS's own secure generative-AI tool accounted for just 6% of staff genAI use, indicating weak adoption of safe channels.
  • An AI medical-transcription tool piloted with doctors was found to fabricate clinical content.
  • A procurement review found limited validation of vendor security and bias testing before deployment.

Commonly funded by

National / regional programmes

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Attachments

Similar practices you may find useful