Picture a hypothetical county IT director on the morning after a local news story. A resident’s benefits letter was drafted with an AI tool, and it got her case wrong. The council wants answers by noon. The director has one document to hand them: an AI policy, approved last spring, eleven pages, signed by the county administrator.
The first council member reads it and asks a fair question. “Who checks that this is followed?”
Silence. Not because anyone is hiding something. Because nobody was ever given that job.
That is the uncomfortable truth about AI governance in a lot of public bodies. The risky document isn’t the missing policy. It’s the one that exists, looks finished, and has nobody behind it.
01Nearly everyone thinks they’re keeping up
In June 2026, SolarWinds surveyed 810 public-sector IT practitioners and leaders across the US and UK. 79% said their organization’s AI governance is on pace with or ahead of adoption.1
Now look at what sits under that confidence. Across the whole sample, only 37% said they have a formal AI governance framework that is actively enforced. 28% said theirs is incomplete or inconsistently implemented. 35% said they have none at all.1
Four in five feel fine. Roughly one in three has an enforced framework. That gap is where the county director was standing.
02The closer to the resident, the thinner the cover
The gap gets wider the closer you get to the services people use every day. Among US public-sector respondents, 40% said they have a formal AI governance framework in place. Federal civilian agencies were highest at 47%. State and local governments came in at 19% with an adoption framework for deploying AI securely and responsibly.1
Nineteen percent. These are the bodies that run benefits offices, schools, courts, permits and 911 dispatch. They hold some of the most personal data any organization has, and they usually have the fewest people to look after it.
Nobody should read that as a failing of the people in those jobs. A county with four IT staff can’t run governance the way a federal department can. But the people who rely on those services don’t get a smaller risk because the IT team is small.
03A policy is a promise. Enforcement is the receipt.
This isn’t just a government problem. EY surveyed 202 senior AI decision-makers at US public companies with more than $1 billion in revenue. 98% said they have formal AI governance policies. 47% said they had skipped that process for an urgent deployment.2
Read those two numbers together. Almost everyone has the policy. Almost half have stepped around it when it got in the way. These are well-resourced companies with compliance teams. Public bodies face the same urgency, usually with less help.
04Why “we have a policy” can be worse than “we don’t”
An organization with no policy knows it has a problem. Someone will eventually raise it in a budget meeting. An organization with an unenforced policy thinks the problem is solved, so it stops spending attention on it. Three things go wrong.
- Leaders get false cover. A board, a council or an auditor hears “we have a policy” and moves to the next item. The question that matters, “show me it’s followed”, never gets asked.
- Blame rolls downhill. When something breaks, the finding is that staff didn’t follow the policy. Rarely does anyone ask why nobody was checking.
- The inventory goes dark. If nobody enforces the rules, nobody keeps the list of where AI is actually in use. You can’t govern what you can’t see.
Who gets hurt? Not the people who wrote the policy. The resident whose letter was wrong. The caseworker who used the tool in good faith and now carries the blame. The director with nothing to show the council.
05Four things that turn paper into a control
None of this needs a new framework or a consultant’s template. It needs someone on the hook for four plain things.
- A named owner. One person, by role, who answers for whether the policy is followed. A committee can advise. It can’t be accountable.
- A live inventory. A current list of AI tools in use, including the ones staff found on their own. Refresh it every quarter. Start with a simple question to department heads: what are your people using?
- A check that actually runs. Pick a handful of AI uses each quarter and review them against the policy. Write down what you found, even if it was nothing.
- An exception log. When urgency wins, and it will, record what was skipped, who approved it and the date it will be brought into line.
06What to do Monday
Take your AI policy off the shelf and answer three questions in writing:
- Who, by name and role, is responsible for enforcing this?
- When was it last checked against real use, and where is the result?
- What AI tools are in use right now that the policy doesn’t mention?
If you can answer all three, you’re ahead of most. If you can’t, describe the policy honestly to the people who rely on it: written, not yet enforced. That sentence is uncomfortable to say to a council or a board. It is also the sentence that gets the work funded, before a reporter calls and makes the decision for you.
When you want a second pair of eyes. Glappy works with public-sector teams on the plain mechanics of AI governance: inventories, owners and checks that actually run. Book a time.
The SolarWinds whole-sample figures mix US and UK respondents and are self-reported; the 40%, 47% and 19% figures are SolarWinds’ US breakdown, and SolarWinds sells IT monitoring software. The EY figures are from large US companies, not government. The county scenario is hypothetical. The four checks are Glappy’s view, not research findings.