AI Is Ready for Government. Is Government Ready?

- What we wanted to achieve through this report was really look at how are governments applying risk and assurance frameworks in practice. The last edition that we did looked at AI and the extent to which AI could help accelerate and continue to sort of build trust in government. And this time around, what we wanted to focus on was the voice of the practitioners and public servants within government who have been trying to build and deploy these sorts of use cases and applications in practice.

- If I were to describe the archetypal mood of these discussions that we're having, it's half extreme optimism and excitement and half powerful frustration. And the conversation often begins with, "Here are all of the things that I can see that are possible," and then quickly we'll segue into, "but we've had a pilot that's been stuck in production for 12 months," or "We have a package of programs, but they're caught up in a risk process, and we just can't get those approved."

- Welcome to "The So What from BCG," the podcast exploring the big ideas shaping business, the economy, and society. I'm Georgie Frost. Governments around the world are investing heavily in AI with the promise of better services, faster decisions, and higher productivity. But the challenge of turning AI ambition into real-world delivery isn't unique to governments.

Organizations everywhere are wrestling with how to scale these systems responsibly, consistently, and at speed. So what can leaders in every sector learn from where countries are succeeding and where they're struggling? Well, joining me are Miguel Carrasco, member of BCG's Responsible AI Council, and Daniel Selikowitz, who leads BCG's government finance segment globally. Miguel, Daniel, welcome.

Before we talk about your report, just explain, if you would, how AI is actually showing up now in the public sector. Where might we encounter it? - So I think AI is already there in the public service around the world. Sometimes it's there in ways that are clearly visible to citizens or to businesspeople.

That might look like a chatbot on a website or an agentic smart search that helps you to navigate your tax compliance obligations or healthcare payer benefits. In other cases, AI shows up in ways that are invisible to citizens but no less important and valuable to those in the public service. That might look like summarization or synthesis of a complex policy document. It might look like call transcription for an agent working in a government contact center interacting with citizens.

So there's many different ways, just as there are in the private sector, that AI is showing up in government. - Yeah, I think what we're hoping to see though is more of the citizen-facing and direct engagement where, you know, it could really help improve and make it easier for citizens to navigate sometimes the complexity of government. - Daniel, you mentioned there about the private sector. Where does it show up in a way that's, that's quite similar, and where does it differ do you think?

- It's a great question. I mean, I think in terms of the actual use cases and the value that can be unlocked through AI, there are far more similarities than differences between the public and private sector. So citizen-facing applications like the ones that Miguel mentioned or that I discussed - chatbots, smart search, ways of streamlining the client experience - those are equally applicable between government and, say, a large financial institution or a telco. I think where there is the most obvious difference is what's at stake when things go wrong.

For those who are working in private corporations, there is more room, I think, to test, to try new things with AI, to learn from failures, and to pivot. And there may, of course, be consequences for customers and for shareholders, but those are generally somewhat contained. In a government context, there's a lot more at stake if things go wrong, and there can be, of course, widespread and quite deleterious outcomes if AI makes mistakes with eligibility for benefits programs or with the quantum of a benefit that's paid.

So I think, understandably, citizens and governments want to hold a higher bar when it comes to ensuring that we're being thoughtful about where, how, why AI is being used. - I want to dig into that in more detail, but before I do, you speak to leaders across the board, private, public sector, both of you do, across the world. What are they saying to you? What is top of mind, biggest concerns, greatest opportunities, Miguel?

- I think what we're seeing at the moment is, you know, leaders are excited about the opportunity that AI could have, both in terms of improved services. It could help in terms of even designing policies and programs in government. The thing they're trying to navigate is how to move forward responsibly without being overly cautious. And the challenge they're having is navigating some of the frameworks and processes and tools that have been put in place, which are sometimes overlapping or inconsistent or unclear.

- Daniel, what are leaders saying to you? - I think that's right. If I were to describe the archetypal mood of these discussions that we're having, it's half extreme optimism and excitement and half powerful frustration. And the conversation often begins with, "Here are all of the things that I can see that are possible," and then quickly we'll segue into, "but we've had a pilot that's been stuck in production for 12 months" or "We have a package of programs that we'd really love to see implemented, but they're caught up in a risk process, and we just can't get those approved."

- It's interesting, Daniel, when you were saying that, you said, "50% excitement," and in my head and you went "50%," and I said "fear" in my head, "trepidation," and you went, "no, frustration." So there's not an element of, you know, trepidation, fear; it's just frustration or excitement? - I think certainly there is trepidation, and maybe that's implicit in both of those things. So, you know, certainly I think in, in government in particular, people do keenly feel the anxiety around what could go wrong and, of course, the responsibility to citizens and to taxpayers of doing things in the right way.

But I think that the view is generally, and we'll get into it soon I'm sure, that a lot of those fears have been very well documented and inculcated in frameworks and governance mechanisms, so I don't think there's too many people that we speak with who feel that those fears are not being adequately looked at and addressed. The, the concern I think is more whether there's, we're erring too much on the side of fear. - In some of our research that we've done as part of BCG's global digital government survey, we've asked people questions about their usage of AI and also whether they see the benefits outweighing the risk.

And I think what, what we can see through some of that data is that the more that people use and adopt AI, the less fearful they become and the more they sort of understand the potential and the capabilities, and some of the, you know, the trepidation or the fear that they might feel of the unknown and uncertainty dissipates as maturity increases and people sort of adopt and use it. And I think that's also what we're finding, too, in government, in the public sector. The more that public servants embrace the technology and use the technology as part of their work, some of the fear factor disappears.

- Well, let's talk a bit more about the latest BCG "Trust Imperative 5.0" report. You looked across a range of countries at how governments are building and applying AI governance. Tell me more about it.

What were you looking for, Miguel? What did you find? - What we wanted to achieve through this report was really look at how are governments applying risk and assurance frameworks in practice. So in the Trust Imperative series, together with Salesforce, we've been looking at the question of the relationship between citizens and government and, in particular, some of the things that help build and erode trust in government.

In the previous editions of the series, we've looked at the importance of good customer service experience, the extent to which personalization and other things sort of drive trust in government. And the last edition that we did looked at AI and the extent to which AI could help accelerate some of that. This time around, what we wanted to focus on was not so much the voice of the citizen but the voice of the practitioners and public servants within government who have been trying to build and deploy these sorts of use cases and applications in practice.

And the sort of questions that we were looking at was, you know, these risk assurance frameworks that have been established, are they working in practice? What's working well? What's not working well? How could they be improved?

- What's the common pattern in how governments are trying to govern AI? - So I think the headline message that we found in the report was that many governments have already put in place the foundational elements, so principles for ethics and transparency, frameworks, risk assessment models, accountable official roles, and things like that. The challenge, I think, has been more at the operational level. So all of the practitioners and people who are trying to apply these frameworks and tools told us that they are sometimes facing challenges with the lack of clarity or inconsistency or ambiguity in definitions where roles have been established but the accountabilities have been unclear, the processes are not very well defined, and sometimes they have to navigate quite a lot of different requirements.

One of the practitioners told us that they had in that process, you know, to navigate 71 different points in the process where people were asking for the same or similar information. The Japanese government, for example, has a multistage process for AI, which has four different stages, initially with a sandbox or pilot, then moving to a control deployment, then moving to broader scale with stronger oversight, and then finally ongoing monitoring with very clear triggers for reassessment.

- Can I ask what countries you were looking at? - So for this study, we conducted interviews with people in 10 different countries, some in Europe, in the US and Asia Pacific. And that was also supplemented by some of the research from BCG's global citizen survey, which actually covers 40 different countries around the world. - So a really broad spectrum of countries, I suppose, across the world.

Where were there similarities in the challenges? Where were there things that were perhaps unique to regions, Daniel? - If I were to characterize some of the common points, firstly, I think admirably most of these governments had developed AI assurance frameworks quite some time ago. And in that sense, they were proactive in getting ahead of this technology and thinking through some of the risks and the benefits and how to manage that.

But therefore, in most cases, with few exceptions, these frameworks had not been meaningfully updated to reflect just how far and how quickly the technology has developed. We all know from our own experience as consumers or in corporations that we work in, the technology is developing every week if not every day, and that's not how these governance frameworks have evolved. There are some, for instance Singapore, that have grappled directly, for instance, with agentic AI, but for the most part, these frameworks predate a lot of the frontier models and other technologies that exist currently.

I think the other main commonality, as Miguel referenced, is that they tend to be fairly broad brush across jurisdictions in terms of how they think about risk. So the sorts of risk tiering that you would expect to see here that would enable much faster progress and movement on relatively straightforward cases don't exist so much. One senior official quoted in the report, who I think could have been speaking for many of the countries that we talked about, said, "We are exquisitely governing very basic, low-risk AI use cases to within an inch of their lives."

- How do you tell the difference between what is genuinely useful caution and what is just unnecessary bureaucracy, overgovernance getting in the way of yourself? - What looks like very onerous and unnecessary governance can later prove to have been essential and vice versa. I think, in general, from what we have observed, what you want to see in a good governance framework is, first of all, that there is some delineation based on the type of use case, the specific example or application of AI, and how much intrinsic risk and complexity there is.

So is AI actually being used to make or meaningfully inform decisions that have significant import, or is it synthesizing documents for internal discussions or transcribing calls as just another reference point to inform internal decision-making and consideration? Of course, it's always important and it always needs some kind of governance and oversight, but you would want to see different levels of process, different levels of onerousness in terms of approval depending on those factors.

- How do you get the balance right there, Miguel? What does, I suppose, the gold standard here look like in an ideal world? - The challenge, I think, has been the definition or sort of lack of clarity about how to assess whether something is indeed low risk, medium risk, or high risk and the judgment that's required from public servants and officials. And that guidance hasn't always necessarily been very clear.

We heard of a very good example in the New South Wales government, which recently took its risk triage tool, which required sort of very specialized expertise and a lot of data and evidence and took sort of more than 40 hours on average to complete, and I've simplified it now down into a process that people can do and can complete it in like 15 minutes. - Daniel, can you tell me a bit more about the Singapore example? - Sure. So Singapore published in 2019 its Model AI Governance Framework, but since then they've made a bunch of changes and updates that I think encapsulate the point we're making around reflecting shifts in the technology.

So a year later in 2020, they updated that framework to translate the high-level principles into practical guidance for folks working in the public service. In 2022, they added AI Verify as a testing framework and toolkit to make it even more practical. In 2024, they published a new governance framework that specifically covered generative AI. And now this year, they've launched a Model AI Governance Framework for Agentic AI.

So while there's no perfect approach, I think the fact that Singapore has continually evolved its governance mechanism, both to make it more practical and specific for practitioners and to reflect changes in this fast-moving technology, is admirable and something that other jurisdictions can certainly learn from. - So what does this mean for large organizations outside of government trying to scale AI beyond pilots? What can they learn from governments? - Well, I think a lot of the same lessons apply.

There needs to be the right focus on the risk of action and inaction. There needs to be the right tiering of different risks with respect to AI. And most importantly, it needs to be really grounded in the practicalities of individual use cases. What are we actually talking about?

For instance, in a contact center, there is potentially a big difference between an AI IVR that's actually answering calls and interacting with customers as opposed to AI-enabled transcription that is keeping a record of what was discussed for later reference. You know, those could be lumped together very easily as AI in the contact center, but they're really very different in practice. - Miguel? - Well, we've covered a few of them, but I wanted to maybe just leave you with three others.

So one is the, the clarity around, sort of, accountabilities within the tech stack and making sure that the, you know, the questions are directed to the right party overall. And what I mean by that is, you know, there's, there's things that the business owners are responsible for, things that the, the LLM provider or the large language model, foundation model should be accountable for. The second thing that I think is also relevant for private sector is investing in, in capability, in literacy, in maturity.

So one of the things we've seen leading organizations do is put in place like a certification framework with different levels. As people sort of become more familiar with the technology, they can, they sort of can do the next level of certification, and that maturity and awareness, understanding, literacy, et cetera, helps in the adoption of technology and diffusion throughout the organization. And then lastly, measurement - so how we track and measure what we're implementing.

In terms of risk and assurance, it's not just about sort of measuring the activity, but actually measuring is it effective. So are we actually reducing risk? Are we reducing the number of escalations? How many things are being approved first time 'round?

And then on the benefits side, are we actually adopting the solutions? You know, are people using them? Are we getting the benefits? Are we saving money?

Are we saving time? - Finally, what is the now what - the next immediate steps that leaders can take, Daniel? - So I think, very practically, one thing is understanding properly what your customers or your citizens actually want and expect when it comes to AI. I think we tend to assume sometimes that we know what the level of comfort is, but I think it's important, as we have tried to with some of our recent research, dig into what citizens and customers of your agency or your business actually want, fear, expect when it comes to AI.

And the second point I would make is getting very specific in the way that you have discussions in governance forums, in board meetings, in risk management sessions about use cases in AI. In some cases, that means upskilling, playing around more with the tools, but really having a sense of what are the differences between different specific applications and what would those mean in terms of the level of risk upside and downside that we need to manage. - Miguel? - The agentic AI that we're seeing at the moment, you know, none of the assurance frameworks were really geared for that development.

And agentic AI requires, again, another, a different approach given that it is, you know, involves a level of autonomy and, and so providing the guardrails around what agents are allowed to do or the, the delegation rights that they have and how you manage that diffusion throughout the organization. So I think it's imperative at the moment that you keep to, you keep iterating and refining your risk and assurance models. It's not once and done. We have to keep reviewing whether they are fit for purpose and adapting them and updating them as the technology continues to evolve.

- Daniel, Miguel, thank you so much and to you for listening. If you'd like to read BCG's latest "Trust Imperative 5.0" report, you can find the link in the show notes.