A new survey of public sector IT professionals found a wide gap between artificial intelligence (AI) adoption and the governance and monitoring controls needed to manage the technology; however, federal agencies reported substantially more mature governance frameworks than state and local governments.
The research report, released Sept. 22, is based on a survey of 810 public sector IT practitioners and leaders in the United States and United Kingdom. The survey was conducted in June by research firm UserEvidence on behalf of SolarWinds, an observability and IT management software provider.
Across the full survey sample, 79% said their organization’s AI governance is on pace with or ahead of adoption, but just 37% said their organizations have a formal AI governance framework that is actively enforced. Twenty-eight percent said their framework is incomplete or inconsistently implemented. Thirty-five percent have no framework.
Thirty-five percent said they’re loosening security or compliance restrictions to enable AI access; at the same time, 44% said AI-related security incidents increased during the past year.
“Confidence in AI governance is running well ahead of the actual controls agencies have in place, and that gap is where risk quietly accumulates,” Travis Galloway, senior advisor for government affairs at SolarWinds, said in a press release announcing the findings.
“Closing it isn’t about slowing AI adoption down – it’s about giving agencies the visibility and enforcement tools to govern with the same confidence they already claim to have,” Galloway said.
State and local government trails feds on governance
The differences between federal and state and local government respondents were particularly pronounced on formal AI governance. Among federal respondents across civilian and defense organizations, 43% said they have a formal framework that is actively enforced, compared with 19% of state and local respondents.
Another 34% of federal respondents said they have a framework that is incomplete or inconsistently implemented, while 13% said they are developing one and 6% said a framework is on their roadmap.
State and local governments were further behind: 20% reported having an incomplete or inconsistently implemented framework, 35% said they are developing one, and 16% said a framework is on their roadmap.
Federal organizations also reported moving more aggressively on AI adoption. Thirty-two percent of federal respondents characterized their organization as aggressively pursuing AI, compared with 12% of state and local respondents. Another 52% of federal respondents described their approach as methodical, versus 68% at the state and local level.
Lack of skilled staff is a top challenge across government
Both groups said they face significant obstacles to expanding AI. Both federal and state and local respondents pointed to workforce challenges, while budget pressures were substantially more pronounced among state and local governments.
Among federal respondents, 45% cited a lack of skilled staff as a barrier to AI adoption, followed by legacy infrastructure at 44%, security or compliance concerns at 42%, and data quality or fragmentation issues at 39%.
Among state and local respondents, 43% cited a lack of skilled staff, while 40% pointed to budget constraints. Security or compliance concerns followed at 37%, along with a lack of clear governance or policy frameworks at 35%. By comparison, only 24% of federal respondents cited budget constraints.
The survey also points to different security experiences across the two levels of government. Fifty-eight percent of federal respondents said AI-related security incidents had increased over the previous 12 months, including 15% who said incidents increased significantly and 43% who reported some increase.
Among state and local respondents, 37% reported an increase, including 8% who said incidents increased significantly and 29% who said they increased somewhat. Sixteen percent of state and local respondents said their organizations do not track AI-related incident volume, compared with 10% of federal respondents.
Across the broader U.S.-U.K. sample, AI monitoring capabilities showed signs of lagging adoption. While 80% described their overall IT monitoring coverage as comprehensive or mostly comprehensive, only 38% said AI tool behavior was fully integrated into standard monitoring. Forty-seven percent said they monitor AI tools only partially, while 15% said they do not monitor AI tool behavior.
At the same time, the study found public sector IT resources increasing across the full sample. Fifty-three percent of respondents said IT and security headcount grew during the past year, while 58% reported budget growth. The report identified increased cybersecurity prioritization and new AI investment among the major drivers behind that growth.