In the first session of our four-part series on the National Institute of Standards and Technology AI Risk Management Framework, we focused on governance rather than tools.
Across the conversation, a consistent theme emerged: For election offices, AI is primarily an operations and management issue. The technology matters, but the larger questions are about responsibility, oversight and decision-making.
Here are seven takeaways that felt especially relevant:
1) Governance needs to come first
The AI Risk Management Framework begins with the “Govern” function.
Before offices pilot tools or adopt new systems, they need clarity around roles, expectations and approval processes. Someone needs to decide what uses are appropriate, what data may be entered into a system, how outputs will be reviewed, and who is ultimately accountable.
Without those structures, adoption tends to be inconsistent and reactive. With them, offices have a stable foundation that makes experimentation safer and more predictable.
2) Ad hoc use creates familiar risks
Several panelists compared unmanaged AI use to the broader problem of shadow IT.
When team members use unapproved tools on personal devices because they are trying to move work forward, the organization loses visibility into what information is being shared and where it is going. That is not unique to AI, but generative tools make it easier to paste large amounts of content into external systems without much thought.
Clear policies and approved options reduce this behavior. Simply telling teams “don’t use it” rarely addresses the underlying need that led them there in the first place.
3) This work extends beyond IT
Although AI tools often enter the organization through technology channels, governance cannot sit only with IT.
Effective oversight requires a mix of perspectives, including legal, operations, communications, and leadership. The people closest to the work understand what “accurate” and “appropriate” look like in practice, and they are often the first to spot when something does not fit real-world needs.
In that sense, AI decisions are as much about process design and accountability as they are about software.
4) Small, repeatable processes are often enough
Governance does not have to mean a large or complicated structure.
In larger jurisdictions, a working group or council may make sense. In smaller offices, the same function might be handled by a single point person who coordinates approvals and checks in with IT or legal when needed.
What matters most is that the process is consistent and repeatable. Even a simple review workflow can prevent confusion and reduce risk.
5) Human review remains essential
A point that came up repeatedly was that AI outputs should be treated as drafts or suggestions rather than final answers.
Models can misinterpret context, fabricate sources, or provide confident responses that turn out to be inaccurate. These errors are not always obvious on first read.
One example shared during the session involved using AI to help map precinct adjacencies for continuity planning. The generated table was helpful as a starting point, but it contained incorrect information that would have caused problems if used without review.
The responsibility for accuracy still rests with the office, which means a person needs to verify the work before it is relied upon.
6) The most practical early uses are administrative
For most election offices, the immediate value of AI appears in everyday administrative tasks rather than in core voting systems.
Participants described using tools to help draft communications, summarize legislation, organize calendars, prepare reports, or generate small pieces of code for internal tools. These uses tend to save time while avoiding sensitive infrastructure.
Even in these lower-risk areas, outputs benefit from review and editing, but they can meaningfully reduce the amount of routine drafting and formatting work teams have to do.
7) Due diligence still applies
When vendors advertise “AI-enabled” products, the same procurement discipline that applies to any technology should still apply here.
Basic questions about data ownership, hosting, and security remain important. Additional questions about how models are trained, whether customer data is reused, and how outputs are monitored for accuracy also become relevant.
If a vendor cannot explain how data flows through their system or how they manage risk, that is useful information during the evaluation process.
Closing
Election offices have always been deliberate about adopting new technology. Tools are introduced when they are secure, auditable, and appropriate for a regulated environment.
AI should be approached in the same way. The goal is not rapid adoption or avoidance, but thoughtful use supported by clear governance.
That kind of structure allows offices to take advantage of helpful tools while maintaining the standards of reliability and public trust that elections require.
AI Tools in Use
The above summary was created using ChatGPT. A file containing a transcript of the audio from the webinar was uploaded to ChatGPT and it was then prompted to provide a summary. The generated text was then edited by a human.
Originally posted on the AI and Elections Substack, February 10, 2026. Read the original ↗