Governing AI use across a 6,000-person local authority
Staff were using AI to draft letters, summarise casework and answer resident queries. The authority needed adoption to continue, with resident data protected and every interaction accountable.
of shadow AI use moved to approved tools
policy violations resolved by a nudge, not a block
of AI interactions logged for the governance board
The challenge
Resident casework contains some of the most sensitive personal data there is, and it was appearing in prompts across dozens of AI tools, most of them personal accounts invisible to IT.
As a public body, the authority had obligations its AI policy alone could not meet: data protection, freedom of information, and a governance board asking for evidence rather than assurances.
The approach
Discover, control, detect, prove
Discover
Sensors gave the security team its first real picture of AI use across every directorate, from contact-centre chatbots to AI features inside existing case-management SaaS.
Control
Real-time nudges redirect staff from personal AI accounts to the approved Copilot deployment, with hard blocks reserved for resident-identifiable data.
Detect
Context-aware detection recognised resident personal data in prompts and uploads without a data-classification programme the team had no capacity to run.
Prove
Every interaction is logged and reportable, giving the AI governance board and information-governance team a standing evidence base.
The results
- 78% of shadow AI usage moved to the approved tools within three months, driven by redirection rather than restriction.
- Nine in ten policy violations were resolved by an in-the-moment nudge; blocking is now the exception, not the default posture.
- The governance board reviews actual usage evidence quarterly, and the authority can answer "how are we managing AI risk?" with data.
This paste contains customer personal data. Remove it, or continue in the approved workspace.
Guidance in the moment, not an alert in a queue
“We could never have justified blocking the tools our teams were using to serve residents faster. Redirecting them to the approved route, and being able to prove it, changed everything.”
Uncover hidden AI risk
Start a free 2-week AI Risk Assessment. Easy setup. Fast visibility.