A city attorney asks internal audit to verify AI use against sector guidance for health, education, and public safety. What should audit do?

When a city attorney asks internal audit to verify AI use against sector guidance for health, education, and public safety, audit should assess applicable sector-specific AI regulatory and ethical guidance for each municipal program area. Generic enterprise IT policy rarely captures health privacy and safety norms, student-data rules, or public-safety use constraints that attach to particular AI systems. Program-by-program applicability analysis identifies which guidance binds or informs each use case and where controls must differ. Applying the enterprise-wide AI governance policy as the baseline control set for municipal programs fails by concept: a single enterprise baseline does not substitute for program-by-program review of applicable health, education, and public-safety sector guidance. Assessing health, education, and safety AI use against general municipal data privacy requirements fails by concept: general privacy rules do not encompass the full sector-specific AI regulatory and ethical guidance that attaches to each municipal program area. Reviewing vendor model risk documentation and third-party attestations for each deployed municipal tool fails by concept: vendor documentation and attestations do not replace the municipality's own assessment of applicable sector-specific regulatory and ethical guidance for each program area. Exam caveat: AAIA ethics/compliance items treat sector-specific AI guidance applicability as a core assurance task across municipal program areas—not an enterprise-wide baseline, privacy-only screen, or vendor attestation package as a substitute. Operational check: inventory AI systems by program area, map each to relevant health/education/public-safety guidance, document applicability decisions with legal input, and test whether operating controls match the applicable guidance.