The U.S. Government Accountability Office has found that the Office of Management and Budget’s guidance on federal artificial intelligence use does not adequately address privacy risks, leaving gaps in how agencies protect sensitive personal data including biometric information used in identity verification systems.
The report, publicly released on March 26 under the title “Artificial Intelligence: OMB Action Needed to Address Privacy-Related Gaps in Federal Guidance” (GAO-26-107681), identifies 10 major privacy-related risks and challenges associated with government AI deployment. OMB’s existing guidance fully addresses only two of those challenges, the GAO found, with the remaining eight partially or inadequately covered.
Among the gaps, the GAO cited insufficient direction on evaluating and auditing AI systems that process sensitive information, a lack of standards for separating sensitive data from training datasets, and the absence of standardized performance metrics for privacy protections. The report also flagged inadequate guidance on transparency around user consent mechanisms and on privacy considerations in AI procurement.
Federal agencies have been expanding their use of AI in identity verification and public-facing service delivery. The findings come as government-wide platforms such as Login.gov have adopted biometric verification methods, and as agencies move toward digital-first models for benefits access and citizen authentication. Congress has separately requested a GAO review of TSA’s AI and biometric technologies, and the White House has ordered a broad review of federal biometric data programs.
The GAO recommended that OMB update its AI guidance to specify known privacy-related risks, issue best practices for AI model evaluation and auditing, provide direction on sensitive data separation, establish performance metrics and transparency standards, and integrate AI-specific considerations into privacy impact assessments.
OMB’s current government-wide AI policy, outlined in Memorandum M-26-04, focuses on increasing public trust through unbiased AI principles. The GAO’s findings suggest that the memorandum does not go far enough in addressing how agencies should handle the privacy implications of AI systems that collect, process, or store personal and biometric data.
The audit adds to a growing body of oversight activity focused on federal use of biometrics and AI. The GAO has previously examined federal agency adoption of facial recognition tools, finding that several agencies had not performed full privacy and accuracy assessments of the technology.
Sources: GAO, ExecutiveGov
–
By Cass Kennedy
