US federal, state and local compliance teams can use AI agents to monitor grant subrecipients, maintain AI use case inventories, track inspector general and audit recommendations, and assemble public records responses. Officials keep decisions on awards, disallowed costs, disclosures and anything affecting individuals. No single federal AI law exists; agencies work under records, privacy and grant rules plus AI governance guidance.
What do public sector compliance teams in the US spend their time on?
Compliance in a US federal agency, state department or city government is shared among programme integrity, legal, records, privacy and audit staff. Several duties dominate.
Grants. Federal funds flow through states and localities to subrecipients such as nonprofits, schools and contractors. Recipients must monitor subrecipients, test costs against grant terms and federal cost principles, and report. Disallowed costs must be repaid, and single audits examine compliance each year.
Audit recommendations. Inspectors general, state auditors and external auditors issue recommendations. Agencies must track corrective action and report progress, and open recommendations attract scrutiny from legislators.
Public records. Federal and state public records laws give people the right to request records, with deadlines and exemptions. High-profile agencies face large backlogs.
AI governance. Federal agencies are expected to inventory their AI use cases and apply additional safeguards to high-impact uses, such as those affecting rights or safety. Many states have introduced similar inventory and oversight requirements for their own agencies.
Privacy. Federal privacy law governs agencies' systems of records about individuals. Public health and benefits agencies may also be covered by HIPAA.
Where do AI agents help?
The depth of each use sets how far an agent may act: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.
Subrecipient monitoring (depth 1). The agent reads subrecipients' expenditure reports and supporting documents, tests a sample of costs against the grant terms and cost principles, and lists questioned costs with the reason for each. This is the most US-specific use, given the scale of pass-through federal funding.
AI use case inventory (depth 2). The agent reads project records and procurement files to identify systems using AI, drafts inventory entries, and flags those that may be high-impact for review.
Audit recommendation tracking (depth 2). The agent links each recommendation to the corrective action plan, evidence and owner, and drafts status updates for the audit liaison.
Public records assembly (depth 2). The agent searches records systems, assembles responsive records, marks personal information and possible exemptions, and drafts the response.
Deadline reminders (depth 3). The agent tracks records request and corrective action deadlines and notifies owners.
Auditing what the compliance agent itself recommends is a discipline of its own. The guide on how to audit a compliance agent's recommendations sets out sampling and evidence methods an inspector general would recognise.
What stays with officials?
Disallowing costs. Concluding that a subrecipient's cost is unallowable, and requiring repayment, has financial consequences for organisations that often serve vulnerable people. A grants officer decides, after hearing the subrecipient.
Classifying AI as high-impact. Whether an AI use affects rights or safety, and which safeguards apply, is a determination for the agency's designated AI official and counsel.
Records release decisions. Applying exemptions is a legal determination for records officers.
Closing audit recommendations. Whether corrective action is sufficient is decided by agency management and, ultimately, the auditor.
Decisions about individuals. Benefits, licensing and enforcement decisions are made by officials with legal authority. A compliance agent does not take part.
Which US rules apply?
The United States has no single federal AI law. Public bodies are governed by constitutional, administrative, records and privacy law, with AI governance guidance at federal and state level. The broader picture is in how AI agents are regulated in the United States.
Federal AI governance guidance for agencies requires inventories of AI use cases and additional practices for high-impact uses. A compliance agent should appear in the inventory with a reasoned impact classification.
NIST AI Risk Management Framework. Voluntary, widely used by agencies to structure AI risk management through Govern, Map, Measure and Manage. The Generative AI Profile, NIST AI 600-1, applies to agents built on generative models.
Federal and state privacy law. Federal privacy law governs agencies' records about individuals. HIPAA applies to covered public health programmes. State privacy laws such as California's CCPA, as amended by the CPRA, apply mainly to businesses, including contractors.
Public records laws set access rights, deadlines and exemptions.
Federal grant rules set cost principles, subrecipient monitoring and audit requirements.
Colorado has passed an AI act aimed at high-risk systems making consequential decisions; agencies contracting for such systems should check how it applies to vendors.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How do you start in the first 90 days?
Month one. Add the compliance agent to your AI use case inventory and document why it is or is not high-impact. Start with subrecipient monitoring for one grant programme.
Month two. Replay the agent against expenditure reports already tested by staff, including any with questioned costs. Compare item by item and record misses.
Month three. Run live, with grants officers deciding every questioned cost. Add audit recommendation tracking. UK public bodies carry a statutory equality duty with no direct federal equivalent; see compliance agents in the UK public sector. The guide to AI compliance agents explains the second-line approach.
Questions people ask
Does a compliance agent need to be in a federal agency's AI inventory?
Inventories are meant to capture AI use cases across the agency. Including the compliance agent, with its impact classification, avoids gaps and shows the agency applied its own rules.
Can an AI agent determine that a grant cost is unallowable?
No. It can question a cost and cite the term or principle involved. A grants officer decides, after the subrecipient has had a chance to respond.
How should agencies audit an agent's grant testing?
Re-test a sample of its passed and questioned items by hand, and compare results. Keep the sample and results as evidence for auditors.