County AI governance: are policies keeping up with runtime control?

TL;DR: 68% of county technology leaders have adopted an AI policy, according to JetStream Security’s analysis, but policy coverage is weaker than runtime governance, with many organisations lacking discovery, inventory, and control over how AI actually operates once deployed. Written rules alone do not govern AI behaviour after launch.

Editorial analysis by NHI Mgmt Group, based on content published by JetStream Security: “What County Technology Leaders Just Told Us About AI Governance”.

By the numbers:

• 68% have implemented a countywide policy on artificial intelligence, according to the survey results.
• 59% have one on data governance, according to the survey results.
• 68.2% of counties report AI in threat detection and prevention, according to the Center for Digital Government.

Key questions

Q: What breaks when an organisation has AI policies but no runtime visibility?

A: Policy without runtime visibility leaves a governance gap between approved intent and actual behaviour.

Q: Why do AI governance rules increase the importance of identity and access management?

A: Because AI rules depend on proving who approved use, who can change the system, and who can access the data it touches.

Q: How do security teams know if AI governance is working?

A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.

Practitioner guidance

• Define the AI inventory boundary List every AI system in scope, including internal tools, embedded features, and externally hosted services that can act on organisational data.
• Tie each system to an owner Assign one accountable owner for approval, monitoring, and retirement so every AI system has a clear governance path.
• Separate policy from enforcement Require runtime controls that can verify and restrict behaviour after deployment, rather than relying on policy documents alone.

Bottom line: County AI programmes are moving faster on policy than on operational control, which leaves a gap between written intent and live behaviour.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →