USDA AI Oversight Lags as Watchdog Warns of Cybersecurity Gaps

The U.S. Department of Agriculture (USDA) does not have the required cybersecurity and governance controls to monitor artificial intelligence (AI), despite growing usage of the technology at the department.

That’s according to a new report from the USDA inspector general.

The report notes that USDA prioritized implementation over guardrails, and as a result, “USDA AI technologies could be vulnerable and lack critical security controls, leaving the agency susceptible to data breaches or reputational harm.”

The findings come as USDA expands AI use for tasks such as crop yield estimates, identifying risks in the supply chain, and making permitting decisions.

“It is imperative that governance and cybersecurity controls over AI activities are top priorities,” stated the report.

Report Findings

The report found USDA has not met several White House Office of Management and Budget (OMB) AI governance requirements, including a generative AI policy due by December 2025 and minimum risk management standards for high-impact systems due by April 2026.

The agency was also cited for lacking a formal process to track its AI inventory. USDA currently reports about 84 AI use cases but relies on annual self-reporting.

“When the primary governance method is self-reporting, it can create a false sense of security that can lead to inaccurate inventory of AI tools, which can contribute to instances of Shadow AI. As AI implementation is becoming widespread, the inventory should be updated continuously to account for changes,” stated the report.

USDA has met some OMB requirements, including appointing a Chief AI Officer and developing an AI strategy.

Recommendations

The report issued four recommendations, which USDA agreed to implement.

They include getting USDA into compliance with OMB’s AI measures, developing a process to review and update AI inventory, and developing and implementing a risk assessment process.