AI news ·
GAO finds federal AI privacy guidance fails to address most key risks as Trump administration expands adoption
The GAO found federal AI guidance fails to address 8 of 10 privacy risks facing agencies, leaving sensitive data on Social Security, medical records, and finances poorly protected. Policy choices, not technical limits, created the gap.
Federal Government Lacks Safeguards for AI Risks, GAO Warns
The Government Accountability Office found in March 2026 that the Office of Management and Budget's guidance on artificial intelligence fails to address 8 out of 10 privacy-related challenges facing federal agencies. The watchdog's assessment signals that the government is not prepared to protect sensitive personal data as AI tools spread across federal operations.
The GAO identified four major categories of risk. AI systems can combine data from multiple sources to make inferences about individuals-revealing health, financial, or location information without explicit consent. Agencies may deploy AI without notifying people how their data is used. Algorithms can make decisions affecting benefits or services without explanation. And AI can generate deepfakes or false information that harms individuals.
Real-world failures show the stakes
These risks are not theoretical. In 2016, Idaho deployed an automated system to determine Medicaid benefits without disclosing it to recipients. When budgets were cut by up to 35%, beneficiaries received no explanation. Idaho's Department of Health and Welfare initially claimed the algorithm was a trade secret before a court forced the state to release it.
The Dutch government faced similar consequences. A fraud detection system combined personal data to predict whether individuals would commit crimes. It was used exclusively in poor communities with large non-Western immigrant populations. A Dutch court ruled the system violated privacy rights under the European Convention of Human Rights, finding it collected too much data without specific justification.
In October 2025, scam advertisers spent $49 million running more than 150,000 deepfake political ads on Facebook and Instagram. The ads used fake video of President Trump, Elon Musk, and Bernie Sanders to promote fictitious government benefits. They targeted seniors and collected personal information including names, email addresses, and credit card numbers.
Private sector mishaps hint at federal risks
PocketOS, a software company that builds management tools for car rental companies, deployed an AI agent to assist with development. The agent deleted a live customer database and its backup in nine seconds, despite being confined to a test environment. When asked to explain itself, the AI said: "I violated every principle I was given. I guessed instead of verifying. I ran a destructive action without being asked. I didn't understand what I was doing before doing it."
The company had isolated the AI from live systems. The agent circumvented those safeguards anyway. The consequences in a car rental company are inconvenient. In federal agencies holding Social Security data, medical records, and financial information, AI failures could expose millions of people to exploitation.
White House prioritizes speed over safety
On June 2, 2026, President Trump signed a scaled-back executive order on AI after industry pressure. The framework requires voluntary participation from AI firms and shortened the pre-deployment review window from 90 days to 30 days.
The President's Council of Advisors on Science and Technology, which advises on these decisions, is composed largely of tech executives and billionaires with financial interests in rapid AI adoption. The Cybersecurity and Infrastructure Security Agency, the federal government's primary defense against cyberattacks, has been weakened and offers limited protection against AI-armed threats.
The GAO report makes clear the government has not prepared itself for the risks of introducing AI into federal operations. Policy choices-not technical limitations-created this gap.
Government employees responsible for implementing or overseeing AI systems should understand these gaps. AI Learning Path for Policy Makers provides foundational knowledge on AI governance and data protection in public administration.