How Governments Can Turn AI Rules Into Operational Governance

Public agencies are moving deeper into algorithmic decision-making, but regulation alone does not tell officials how responsibility should flow through procurement, deployment, oversight and review. A new study argues that the key governance challenge is no longer defining responsible AI principles, but converting overlapping legal and ethical requirements into decisions, controls and evidence that public institutions can actually use.

Published in the journal Information, the study "Operationalising AI Governance in Public Administration: An Integrated Regulatory and Risk Management Framework" is authored by Nikolaos Levantis, Aggeliki Sgora, Athanasios Tsipis and Spyros Polykalas of Ionian University. The researchers analyse the EU AI Act, GDPR, Directive (EU) 2016/680, OECD AI Principles and the US National Institute of Standards and Technology AI Risk Management Framework to build an operational model for European public administration.

Rather than adding another catalogue of responsible-AI principles, the framework asks more practical questions: when should AI be used at all, who is responsible at each stage, what safeguards must exist, what evidence should demonstrate that governance is working, and what should happen when monitoring reveals problems. Its answer is a seven-pillar governance structure connected to eight stages of an AI system's lifecycle.

The real governance gap sits between regulation and administrative practice

European public authorities do not operate under a single AI governance rulebook. The EU AI Act introduces risk-based obligations, GDPR governs personal-data processing and automated decision-making, Directive (EU) 2016/680 applies in law-enforcement settings, while OECD and NIST frameworks supply broader normative and operational guidance. Each approaches risk and responsibility from a different direction.

The researchers find considerable convergence around transparency, accountability, human oversight, risk management and continuing monitoring. Still, similarities at the level of principle can conceal major operational differences. Legal force varies, definitions of risk differ and institutional roles do not always map neatly onto the internal structures of public organisations.

Those gaps become especially important when authorities procure technology from external suppliers. Regulatory categories may establish whether an organisation is a provider, deployer, controller or processor, but they do not automatically determine which internal official accepts residual risk, who authorises deployment, who can suspend a system or who confirms that corrective action has actually been completed.

The study identifies another weakness in treating compliance obligations separately. A Data Protection Impact Assessment and a Fundamental Rights Impact Assessment, for example, may address related risks without being interchangeable. Human oversight may be required without specifying when officials must intervene. Monitoring duties may exist without clear triggers for suspension, redesign or reassessment.

Governance consequently becomes a coordination problem as much as a legal one. The study's contribution lies in linking requirements to particular actors, lifecycle decisions, operational controls and documentary evidence rather than assuming that regulatory compliance will assemble itself into a functioning administrative system.

Seven pillars turn broad principles into a lifecycle of decisions

The proposed framework organises AI governance around seven areas: legal, ethical and public-value foundations; risk classification and lifecycle governance; data governance, privacy, security and robustness; transparency and contestability; human oversight and accountability; organisational capacity and procurement; and monitoring, assurance and continuous improvement.

Those pillars are then connected to eight lifecycle stages. Governance begins with problem definition and an assessment of whether AI is necessary and suitable, followed by legal and risk classification, procurement or development, data preparation, impact assessment, testing and approval, operational decision-making, and finally monitoring, incident response and decommissioning.

Placing suitability before procurement is one of the framework's most consequential choices. The authors argue that technical feasibility does not establish administrative appropriateness. Public authorities should first define the problem, identify the expected public value, consider affected groups and assess whether the same objective could reasonably be achieved through a less automated or non-AI approach.

Such an approach changes the logic of public-sector digitalisation. Instead of assuming that an available AI system should be governed after acquisition, the framework asks whether automation should enter the decision process in the first place. This becomes particularly important where decisions depend on contextual, qualitative or case-specific information that structured data may fail to capture.

Procurement also becomes a governance function rather than a purely commercial transaction. Contracts may need to secure technical documentation, audit access, logging, incident reporting, change control, support for explanations and mechanisms that allow meaningful human intervention. Outsourcing technology does not transfer responsibility for how public authority is exercised.

Human oversight must mean authority to challenge the machine

The study gives particular attention to one of the most frequently invoked safeguards in AI governance: keeping a human "in the loop." Its analysis shows why formal human presence can offer false reassurance if officials lack the competence, information or authority needed to question automated recommendations.

Meaningful oversight requires more than asking an employee to approve an algorithmic output. Officials need enough understanding to identify questionable recommendations, consider circumstances excluded from the model, request further verification and override or reject a system's conclusion where appropriate. Training therefore becomes part of accountability rather than a peripheral administrative requirement.

The framework also proposes monitoring how humans interact with AI after deployment. Acceptance rates, override patterns, recorded reasons for intervention, complaints and successful appeals can reveal whether oversight is functioning substantively or has deteriorated into routine confirmation of machine-generated outputs.

Transparency is treated in similarly operational terms. Explanations should not be reduced to technical descriptions of algorithms. For consequential administrative decisions, the framework connects explanation to reasoning, reconsideration, complaint and appeal, placing affected individuals inside the governance architecture rather than treating them merely as recipients of automated outcomes.

Two constructed scenarios demonstrate how these principles change according to context. One examines AI-supported eligibility decisions for a means-tested housing allowance, while another considers AI-supported student assessment. The same governance architecture produces different priorities because the data, consequences, professional judgement and oversight requirements differ between welfare administration and education.

A strong operating model still needs evidence from real public agencies

Methodologically, the research is designed around transparency and traceability. The authors extracted governance-relevant requirements from the five instruments, coded them across themes, lifecycle stages, actors, controls and expected evidence, and produced 72 instrument-derived records alongside six author-proposed controls.

An important safeguard is the explicit separation of binding, conditionally binding, voluntary and author-proposed measures. This prevents voluntary guidance from being presented as law and prevents an internally designed control from being treated as proof of legal compliance. The framework is therefore intended to support governance work rather than operate as a substitute for legal analysis.

Limitations are equally important. The source corpus was purposive rather than exhaustive, so sector-specific rules, national administrative law and additional standards may generate further obligations. Coding involved interpretive judgement, and only a stratified subset underwent additional author verification rather than full independent coding.

The largest unanswered question concerns real-world effectiveness. Both public-sector applications in the paper are constructed scenarios rather than field implementations. They show that the framework can produce a coherent chain of responsibilities, assessments, oversight procedures, monitoring indicators and review points, but they do not prove that public officials will find it usable, affordable or effective.

Portability beyond Europe also remains uncertain. The lifecycle structure and actor-control-evidence logic may prove adaptable elsewhere, but its legal mappings are rooted in EU law and would have to be rebuilt for other jurisdictions. For governments with limited regulatory and administrative capacity, such adaptation could be more demanding than adopting the conceptual framework itself.

Future work will need to move from analytical completeness to institutional testing. The authors call for expert evaluation, public-sector case studies and pilot implementation, alongside validated measures of human oversight, contestability, organisational capacity, stakeholder participation and post-deployment monitoring.