Topic starter
25/10/2026 11:09 am
TL;DR: County AI programmes are moving faster on policy than on operational control, with JetStream Security noting that written intent is still outpacing live enforcement. Runtime visibility and ownership need to be in place before AI behaviour can be governed where it actually runs.
Editorial analysis by NHI Mgmt Group, based on content published by JetStream Security: “What County Technology Leaders Just Told Us About AI Governance”.
By the numbers:
- 68% have implemented a countywide policy on artificial intelligence, according to the survey results.
- 59% have one on data governance, according to the survey results.
- 68.2% of counties report AI in threat detection and prevention, according to the Center for Digital Government.
Key questions
Q: Why do AI governance rules increase the importance of identity and access management?
A: Because AI rules depend on proving who approved use, who can change the system, and who can access the data it touches.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Q: What breaks when an organisation has AI policies but no runtime visibility?
A: Policy without runtime visibility leaves a governance gap between approved intent and actual behaviour.
Practitioner guidance
- Define the AI inventory boundary List every AI system in scope, including internal tools, embedded features, and externally hosted services that can act on organisational data.
- Tie each system to an owner Assign one accountable owner for approval, monitoring, and retirement so every AI system has a clear governance path.
- Separate policy from enforcement Require runtime controls that can verify and restrict behaviour after deployment, rather than relying on policy documents alone.
Bottom line: County AI programmes are moving faster on policy than on operational control, which leaves a gap between written intent and live behaviour.
Glossary terms: AI Governance, Runtime control, Shadow AI, AI Inventory
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Policy-led AI governance is incomplete because policy does not become enforcement by itself. Counties in this survey show that written rules are now common, but rules do not reveal what AI systems are doing after they go live. That gap matters more than policy adoption rates because the control problem sits at runtime, not at drafting time. Practitioners should treat policy as a governance input, not the governance outcome.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between static policy and runtime control for AI agents?
A: Static policy states what the agent should be allowed to do, while runtime control determines what it can actually do at the moment of execution. For autonomous systems, that distinction matters because the security risk appears in live action, not just in configured permissions.
👉 Read our full editorial: County AI governance still fails where runtime control begins
This post was modified 7 days ago by NHI Mgmt Group