The Small Business Administration hasn’t finalized an artificial intelligence strategy, developed a generative AI policy or completed a host of other federally required governance components despite piloting several models of the emerging technology, according to the agency’s inspector general.
In a management advisory made public Monday, SBA’s OIG credited the agency with taking “initial steps” to comply with AI directives laid out by the Office of Management and Budget.
But the watchdog said the SBA didn’t have an exhaustive AI strategy, hadn’t implemented a process to identify high-impact use cases, and hadn’t convened its AI governance board.
“Without a comprehensive AI strategy with an active governing board, SBA could deploy or rely on AI tools without sufficient oversight, transparency, or safeguards,” the advisory said.
The SBA has struggled to keep up with OMB requirements for AI reporting, posting its first-ever use case inventory in March — two months after this year’s deadline. The Government Accountability Office in May admonished the SBA for “not consistently” following federal reporting requirements.
The House Small Business Committee joined the pile-on later that month, advancing a bill to require the SBA to deliver an annual report on its AI use.
SBA management told the OIG that it has focused on improvements to IT infrastructure, cloud computing and network reliability over the past year, paving the way for the adoption of more advanced tools.
The OIG’s advisory made the case that those technology investments are more likely to be successful if the agency puts in place “appropriate governance over AI use” and fully complies with federal AI requirements.
With that in mind, the watchdog delivered four policy-related recommendations to the SBA: finish the AI governance board charter and bring agency officials together to manage implementation; finalize and publish AI strategy and compliance plans, per OMB guidelines; create a process to evaluate and update policies on IT, data, privacy and cybersecurity; and establish a generative AI policy with safeguards included.
The inspector general also pushed the agency to create and follow a process for collecting all AI use cases across the SBA, and update the inventory “at least annually.” And it recommended the SBA develop a process to better identify high-impact AI use cases.
The advisory paid special attention to SBA shortcomings on the high-impact classification, zeroing in on a pilot program — not listed in its inventory — aimed at detecting fraud in pandemic assistance loans.
The agency signed a $300,000 deal with Palantir in January, which federal contracting documents referred to as “SBA Fraud Prevention Pilot and Bootcamp.” In July, the SBA said it was expanding its work with Palantir through “ongoing efforts to identify, investigate, and help prosecute fraud in pandemic-era small business relief programs.”
“OIG believes this falls under OMB’s definition of a high-impact use,” the advisory said. “When we spoke to SBA managers about this issue, they said this particular use case did not qualify as high impact, even though the model would be potentially flagging loans as fraudulent.”
Per the advisory, the SBA agreed with and resolved all six of the OIG’s recommendations. The watchdog said it will close them out once agency management shares evidence of implementation.
In a response letter to the OIG, SBA Deputy CIO Douglas Robertson acknowledged that the agency hasn’t completed every OMB requirement, but said the agency “is actively working to establish and mature the governance, policy, and risk management structures necessary to support responsible AI adoption while appropriately balancing innovation, operational needs, safety, privacy, security, and public trust.”