SBA OIG Finds Fraud AI Pilot Skipped OMB Safeguards
The watchdog says SBA's Palantir fraud-detection tool meets OMB's high-impact definition but the agency classified it otherwise, without documenting why, and without the required governance board or appeals process.
TL;DR
SBA's Office of Inspector General found the agency's AI fraud-detection pilot for pandemic loans wasn't listed on SBA's public AI use case inventory and didn't receive the risk-mitigation treatment OMB's April 2025 memo requires for high-impact AI. The tool, built with Palantir, was used to flag suspected fraud in PPP and COVID-19 EIDL loans. SBA managers told OIG the use case didn't qualify as high-impact, but the agency never documented that determination and hasn't convened the AI governance board OMB mandates to make such calls. A February SBA release cited by OIG noted the agency suspended 111,620 California borrowers based on the effort.
The SBA's Inspector General has delivered the first audit finding under OMB's April 2025 AI risk-management framework to name an agency for sidestepping the high-impact label on a model that plainly fits the definition. The finding, released Monday in a management advisory, will shape compliance expectations government-wide, because if SBA's reading had held, any agency running fraud detection could self-classify its way out of OMB's mandatory safeguards.
The core problem is straightforward. OMB's April 2025 memo presumes any AI model affecting a person's request for critical federal benefits (including loans and fraud adjudication) is high-impact. That classification triggers concrete requirements: an AI impact assessment, documented appeals for people flagged by the tool, and meaningful human oversight with clear intervention points. SBA ran a Palantir-based fraud pilot against PPP and COVID-19 EIDL data, used its output to suspend 111,620 California borrowers, and yet told OIG investigators the use case didn't qualify as high-impact.
The agency provided no documentation supporting that determination, according to the advisory. It also hasn't convened the AI governance board OMB requires, the body that's supposed to formally oversee exactly this kind of classification decision, with the Chief AI Officer at the table. The gap between the OMB directive and SBA's internal process isn't subtle. It's structural.
What the OIG wants SBA to do
The advisory includes five recommendations beyond the one calling for a consistent process to identify and document high-impact AI use cases. SBA will need to establish that governance board, get the fraud-detection model onto its public inventory, and retroactively assess whether the 111,620 California suspensions should carry a documented appeal path tied to the AI's determinations.
For contractors and primes watching federal AI governance take shape, the signal is that agency OIGs are now checking compliance against OMB's April 2025 standards, and they're reading the high-impact presumption broadly, exactly as OMB wrote it. SBA's pilot didn't slip through because the technology was ambiguous. It slipped through because nobody with authority formally reviewed the classification at all.
Published ·Deep Fathom