What County Technology Leaders Just Told Us About AI Governance

Each year, the Center for Digital Government surveys county governments across the United States on their technology work. Its Digital Counties 2026 results are written for public-sector leaders, but the findings describe the problem every security team is now working. The counties surveyed named cybersecurity their top priority and artificial intelligence their third. Those two priorities are converging, and the survey shows exactly where. You can see the full survey results at the infographic below. JetStream Security sponsored this survey.

Most counties have set the rules: 68% have implemented a countywide policy on artificial intelligence, and 59% have one on data governance, according to the survey results. That is real progress, and it also marks where the harder work begins. A written policy says what a system is supposed to do. It cannot show what that system actually does once it is running, calling tools, and handling a resident’s data. The distance between the two is where risk collects.

Corporate boards are in the same position. When JetStream polled members of the National Association of Corporate Directors in May 2026, 70% had an AI policy, but 67% were not performing AI discovery and 74% had no manifest of the AI running across their organization. County policy adoption sits two points below that board figure, which suggests the same gap likely sits behind it. Policy without visibility is not governance. It is paperwork.

That gap is not theoretical, because AI is already in production across county operations. Counties report AI in threat detection and prevention (68.2%), personal productivity (52.3%), and AI-augmented application development (27.3%), per the Center for Digital Government. Read together, those numbers show AI woven through daily work, from the security operations center to staff desktops to the teams that build the county’s own software. In many organizations that building now moves faster than any approval process, led by staff who reach for an AI tool when they hit a problem. These are live systems shaping real services and decisions. The governance question is who owns each system and what keeps it inside the lines while it runs.

Will agentic AI come to county governments next?

The identity data hints at a question counties may face next. They have invested in identity controls for people and machines. Multifactor authentication is in place at 83.3% of them, identity and access management at 77.3%, and privileged access management at 68.2% (Center for Digital Government). That is a mature foundation. As county AI use grows, some may begin to explore AI agents. If they do, a further question follows: would any of that identity control reach the non-human identities such systems run under? An AI agent that mints a key, reads county data, and calls an external service would be a new kind of account. It would need an identity, an owner, and a revocable boundary, the same way a privileged human account does.

This is the difference between governing AI on paper and governing it at runtime. A policy sets the intended behavior. A runtime control plane checks live behavior against that intent, continuously, and revokes access in seconds when the two diverge. JetStream AI Blueprints™ exist for this. A Blueprint is the approved description of what an AI system may do, and the runtime enforces it, so the policy a county has already written becomes something it can prove. The AI system that was granted access last quarter is still doing only what it was approved to do this quarter, or it is stopped.

For public-sector teams, that proof is turning into a procurement requirement rather than a nice-to-have. FedRAMP authorization already signals that a vendor meets a recognized federal security bar. The next question follows naturally: do the AI systems inside that authorized environment stay within their approved boundaries after they go live, and can the agency account for each one the way it accounts for every other asset? That is the step ahead for counties: turning the policy they have already written into evidence the runtime produces on demand.

County governments are keeping pace with corporate boards on policy adoption, and they face the same unfinished work: turning a written rule into something the runtime enforces. The lesson travels well beyond local government.

CDG26 Counties Infographic v Jetstream by JetStream AI Advisory

The full Digital Counties 2026 results, including the winning counties in each population category, are available from the Center for Digital Government at govtech.com/digitalcounties2026.