AI through a risk lens

This piece has been contributed by Juanita Victor, and Josh Lindsay from PwC New Zealand

As AI becomes part of everyday work across local government, the challenge is no longer whether councils should adopt it. It is whether they have the right governance, visibility and safeguards in place to use it responsibly.

AI has moved rapidly from experimentation to everyday practice. Across organisations, staff are already using tools to draft reports, summarise meetings, analyse information and support decision-making. Some of this use is formally approved, while some occurs informally through publicly available tools.

For councils, this creates significant opportunities to improve productivity and service delivery. It also introduces new risks that require thoughtful governance.

Importantly, the greatest risk is often unmanaged and ungoverned use, not the technology itself. Many councils already have AI in their organisation. The question is whether they know where and how it is being used.

AI can strengthen existing risk management

Rather than replacing established risk management practices, AI has the potential to enhance them.

Across the risk lifecycle, AI can help organisations identify emerging issues by analysing large volumes of information, improve the consistency of risk assessments, support faster responses through workflow automation and strengthen monitoring by detecting anomalies and trends much earlier.

For councils managing growing volumes of information and obligations, these capabilities can improve visibility and allow staff to focus on judgement, engagement and decision-making.

Human oversight, however, remains essential. AI should support professional expertise rather than replace it.

Examples are already emerging

Local government organisations are beginning to demonstrate how AI can improve both operational performance and risk outcomes.

One example involves emergency response communications, where AI-assisted workflows helped draft and coordinate messaging during high-pressure events. Human review remained part of the process, while faster and more consistent communications strengthened organisational resilience.

Other uses include organising and summarising case information, reviewing public-facing documents for readability and compliance before publication, and monitoring supplier contracts to identify pricing discrepancies or missed commercial entitlements.

Even though the use cases differ, they share common characteristics. AI processes large amounts of information quickly, improves consistency, and provides greater visibility. At the same time, people remain accountable for decisions.

Governance matters more than ever

As AI adoption grows, councils need to recognise that traditional approaches to technology governance are not always enough.

Unlike conventional software, AI can give different answers because it works with probabilities not certainty. The same prompts may generate different responses and outputs can appear convincing even when they contain inaccuracies.

This means organisations need to adapt how they test, monitor and assure AI-enabled processes, alongside ongoing human review.

Good AI governance does not require entirely new frameworks. Instead, organisations can build on existing governance practices by providing approved tools, establishing clear policies, maintaining human accountability, investing in staff capability, and applying controls that are proportionate to the level of risk.

Boards and executive teams can start with three simple questions:

• Do we know where, and for what purposes, AI is being used across the organisation?
• Are higher-risk uses subject to appropriate oversight and human accountability?
• Do we have sufficient visibility to demonstrate AI is being used responsibly and in line with our values?

The objective is not to slow innovation, but to create confidence that AI is being used safely, responsibly and transparently.

Looking ahead

As AI becomes increasingly embedded in council operations, risk leaders have an important role to play.

That means engaging early in projects, helping design appropriate controls from the outset, strengthening AI and data literacy across organisations and adapting governance frameworks to reflect new forms of decision-making.

Internal audit should also consider how AI could strengthen its role. Used appropriately, AI can help identify emerging risks, analyse larger volumes of information and focus activity where it is most needed.

The most valuable questions for councils are whether AI is being governed effectively and if their risk and assurance functions are evolving quickly enough to provide confidence over how AI is being used.

Councils that can answer that question with confidence will be better placed to realise AI’s benefits while maintaining the trust of their communities.

Juanita Victor, Partner PwC New Zealand – juanita.j.victor@pwc.com

Josh Lindsay, Partner, PwC New Zealand – josh.t.lindsay@pwc.com