How can local governments implement effective cyber security and governance frameworks for AI?

While AI has the potential to address strategic and operational needs, its implementation and use also introduces new concerns around cyber security, privacy, and data protection. These are three of the challenges facing local governments as AI adoption increases:

AI governance and policy development

Many organizations implement AI before any formal governance frameworks or policies have been developed to govern its use. A lack of governance can lead to risky or inconsistent use of AI technologies, increasing risks such as inappropriate use and the potential exposure of confidential data.

Training, education, and awareness

Many employees of local governments, especially outside of core IT staff, are often less engaged with cyber security. This makes it necessary to implement mandatory training to ensure that all employees are aware of risks and understand their roles and responsibilities in protecting the organization’s data, especially as it relates to confidential and personal information of employees and citizens.

Data governance and interdepartmental collaboration

Data governance has been and continues to be a major risk area for local governments since sensitive data can be potentially exposed through AI tools. Additionally, local governments often have fragmented responsibility for records management and cyber security, which can lead to gaps and blind spots. Organizations cannot protect what they do not know. This makes it crucial for local governments to understand what data is traversing across the organization.

A roadmap toward enhancing cyber security and governance

AI systems can introduce new vulnerabilities, such as data exposure risks. Comprehensive governance frameworks and strong cyber security measures are vital to mitigate these risks and ensure the responsible use of AI systems.

This five-step roadmap can help you get started on enhancing your local government’s cyber security measures and governance framework:

1. Conduct a risk assessment

Perform a risk assessment that includes an analysis of your local government’s crown jewel data along with current AI tool use within your organization. Begin by identifying the specific AI tools and applications currently in use — including any unauthorized or shadow IT solutions.

This helps establish a baseline for risks and informs policy development. The next step is to use available cyber tools to map assets. However, it is important to realize there may be limitations in detecting AI-specific use.

A comprehensive risk assessment should include these four key elements:

• Business impact analysis (BIA) — Used to identify and prioritize crown jewels by assessing which assets are essential for business continuity and decision-making.
• Data discovery and mapping — Conduct interviews and use tools like Microsoft Purview to locate sensitive data across repositories and systems.
• Risk-based controls alignment — Map crown jewel risks to cyber security controls (e.g., Center for Internet Security (CIS) controls). This ensures that the most critical assets are protected with the most robust measures.
• Privacy and compliance integration — Align crown jewel assessments with privacy regulations (e.g., PIPEDA, GDPR, HIPAA). Include consent inventories and breach response protocols.

2. Set and communicate clear guidelines

This step involves creating a clear list of approved and unapproved AI tools for your local government and outlining what is considered appropriate use. Communicate these guidelines across the organization and reinforce them through multiple channels to ensure your employees understand which tools are permitted.

3. Strengthen access controls and security posture

Once you have developed and communicated clear guidelines governing AI use within your local government, implement strong access controls such as application whitelisting/blacklisting to prevent unauthorized downloads and use.

It is critical to ensure permissions are set correctly to prevent unauthorized access to sensitive or confidential information — especially when using AI tools such as Copilot.

4. Provide regular training and assessments

It is necessary to conduct regular training and assessments to maintain employee compliance and awareness. This include delivering targeted training based on organizational maturity, including sign-offs, quizzes, and regular refreshers. Incorporating phishing simulations and awareness campaigns can also help reinforce good security practices within your local government.

It is important to remember that training is not a one-time event. It must be a recurring and evaluated process to successfully mitigate risks to your organization.

5. Commit to continuous improvement

The digital landscape is constantly evolving — and so are the threats. This makes continuous improvement essential to strengthen cyber security measures and protect data privacy. Regularly reviewing and updating your policies, controls, and training can help your local government adapt to evolving threats and technologies. Additionally, staying informed about new tools for AI risk detection and management can help you keep ahead of changes as the field matures.