Key topics covered in this article:

• • AI is already embedded in day-to-day public-sector operations, often through employee use and vendor-added features, but many organizations still lack clear visibility into where it is being used, what data it touches, and what actions it can take. Building an inventory of AI tools, uses, departments, and data access is a practical first step toward stronger oversight.
  • Common governance gaps include outdated policies, unclear ownership, weak controls over AI-enabled actions, and insufficient employee guidance. Public entities need to update existing procedures, assign responsibility for AI governance, define approval and review requirements, and make sure AI-enabled workflows preserve security, accountability, and internal controls.
  • A risk-based governance approach can help public entities strengthen oversight without trying to solve everything at once. Readiness assessments, targeted controls for higher-risk use cases, periodic review of vendor changes and employee usage, and documented human oversight can help organizations manage current risks while preparing for broader AI adoption.

   

• Artificial intelligence is already part of daily operations across state agencies, counties, cities, towns, community services boards, transportation and port authorities, and other public entities. Employees are likely to use it to draft emails and analyze information, and software vendors are also adding AI capabilities to applications that public entities use every day. Adoption is only expected to accelerate. Many public-sector leaders report using AI in their daily work, and according to Gartner, at least 80% of public entities are predicted to deploy AI agents to automate routine decision-making by 2028. As AI becomes more deeply integrated into government operations, leadership needs to understand how employees use the technology and whether existing policies and controls provide adequate oversight. Addressing these governance gaps now can help public entities manage current risks while preparing for the opportunities ahead.
  

  Common AI Governance Gaps

  The greatest concern is not necessarily malicious use, but unmanaged use. Without adequate oversight, AI use can expose sensitive government information, compromise the accuracy of financial or operational decisions, and undermine existing internal controls. When these failures affect public services or taxpayer resources, they can also erode public trust.
  So, what are the most common AI governance gaps right now, and what can public-sector leaders do?

  Limited Visibility Into AI Use. What AI tools are currently being used across the organization? Employees can open a free AI tool in a browser without anyone approving it. Individual departments may adopt applications without involving anyone on the cybersecurity team. Vendors are adding AI to their products with little, if any, warning. Financial management systems and other government applications may include AI functionality that was not available when the software was originally approved, with vendors introducing these capabilities through routine updates.

  The real question is what those tools do with government information. Organizations may not know which AI features are enabled, what data they process, or whether information is stored outside government systems. Without that visibility, it’s hard to evaluate risk or judge whether existing safeguards are working. Creating an inventory of AI tools, vendor-enabled features, and their actual uses is a practical first step toward identifying where additional oversight is needed. For each use, identify the responsible department, the information involved, the systems it can access, and whether the tool only generates content or can also take action.

  Visibility should also extend to vendor terms and settings. Before enabling AI features, public entities should understand whether their information may be used to train models, how long it is retained, who can access it, and what notification the vendor provides when features or data practices change. Approval of an application should not automatically authorize every new AI capability or use.

  Outdated Policies and Procedures. As AI becomes more integrated into business operations, organizations must ensure their policies and governance practices evolve alongside it.

  Consider a clerk who knows not to email confidential information outside the office but doesn’t realize the same rule applies to pasting it into an AI tool. AI-generated letters and summaries used for public business may also qualify as public records and should be handled under applicable retention schedules and disclosure requirements. Employees may not recognize these nuances without proper guidance.

  Public entities should review existing policies to identify where AI-specific guidance is needed. A standalone AI policy is helpful, but the rules will also need to be updated in the procedures employees use during their regular workday.

  Unclear Governance Responsibilities. In many organizations, nobody owns AI governance. IT may approve an application while individual departments decide how employees use it. Who reviews the risks after that is often unclear.

  This fragmentation is particularly problematic because AI affects many areas of government. Financial controls still apply when employees use AI to prepare reports, and information security rules still apply when a department runs government data through an AI tool. Legal and compliance personnel may also need to weigh in. These responsibilities often require coordination across multiple departments rather than siloed decision-making. Public entities can benefit from designating an AI governance owner and involving the many departments that interact with AI tools, with oversight covering both the approval of new applications and how those applications are used after implementation.

  The NIST AI Risk Management Framework offers a practical starting point for public entities working to build that coordinated structure. It addresses organizational responsibilities, policies, and oversight for managing AI-related risks, and it can help public entities assign accountability in a way that reflects how AI is used throughout their operations.

  Inadequate Controls Over AI Actions. Some AI tools do more than draft content or summarize information. AI agents can update records, initiate transactions, or move work through approval processes. These capabilities introduce questions about access, authorization, and segregation of duties that may not arise when an employee simply uses AI to prepare a draft.

  Public entities should define which actions an AI tool may perform, limit its access to what is needed, and require human approval for consequential actions. An AI-enabled workflow should preserve required approvals and independent checks. Staff should also be able to trace what the tool did and stop or reverse actions when appropriate.

  Insufficient Employee Guidance and Human Oversight. Employees without clear guidance may not understand that AI output needs to be reviewed and independently verified. Consider a budget analyst who asks for an approved AI tool to summarize a financial report for department leadership. The summary overlooks an important qualification or misreads a trend. If nobody checks it against the original, that error can end up influencing a decision that affects the public at large.

  Public entities will want to establish clear rules for human review, including when it is required and what it involves. The level of scrutiny should reflect how employees intend to use the information. A draft email may need a quick read, but a dollar amount headed for a city council presentation needs to be traced back to its source. Training should also cover acceptable and prohibited uses, including what information should never be entered into AI tools. Employees need to know which applications are approved and where to direct questions, as needed.

  For uses that affect residents or service recipients, such as benefits, determinations, hiring, permitting, access to behavioral health services, or transportation eligibility, review should go beyond checking accuracy. Public entities should evaluate whether results could unfairly disadvantage individuals or groups, whether staff can explain the basis for a decision, and how an affected person can request human review.

  Practical Steps for Strengthening AI Governance

  Public entities do not need to address every AI governance concern at once. Leaders are encouraged to take a risk-based approach that starts with understanding current practices and identifying the most important improvements.

  Start with a readiness assessment. Identify the AI tools and features in use, how each department uses them, what information they process, and whether they can take action in connected systems. The assessment should also examine relevant policies, vendor terms, access permissions, approval requirements, and oversight responsibilities. These findings can help leaders identify potential weaknesses and prioritize improvements to controls, system settings, training, and documentation.

  Next, build a governance plan around risk, putting the most effort where inappropriate use would do the most damage. A tool used to draft an internal memo is different from one supporting public benefits, determinations, or financial decisions. Public-sector leaders will want to direct limited resources toward areas with the greatest risk profile first.

  Finally, assign responsibility for periodically reviewing AI uses and testing whether related controls are working. Vendors push new features through updates, and employees find new uses for approved tools. Someone in a leadership position should be designated to watch for both scenarios. For higher-risk uses, retain enough documentation to show the source information, relevant output or action, who reviewed and approved it, and how exceptions were resolved, consistent with applicable records requirements. Employees should also know how to report inaccurate results, unintended actions, or inappropriate disclosures so the government can investigate and correct problems.

  Moving Forward

  AI can help public entities work more efficiently and better serve their communities. But the tools will keep evolving; vendors will keep adding features, and employees will keep finding new ways to use what is available to them. Public entities that identify their governance gaps now will be better positioned to manage the risks that exist today and respond to whatever technology brings next. For more information on assessing current governance practices or developing a roadmap for responsible AI adoption, contact Antonina McAvoy, Partner, Cyber & Risk Advisory, or Betsy Hedrick, and Michael Garber, Partners, State and Local Government.