How state and local agencies can build an AI-ready data loss prevention strategy

State and local agencies are under growing pressure to use artificial intelligence to improve citizen services, reduce administrative burdens and help employees work more efficiently. 

At the same time, they're responsible for protecting sensitive citizen data while managing aging infrastructure, limited cybersecurity resources and increasingly complex IT environments. As AI becomes embedded in everyday workflows, balancing innovation with security is becoming one of government IT's biggest challenges.

Before agencies can govern AI, they need to understand where sensitive information resides and how it is being used. Modern data loss prevention provides that visibility while helping agencies protect sensitive information and responsibly adopt AI to better serve the public.

AI is Creating New Data Security Challenges

Whether supporting public safety, education, healthcare, or municipal services, state and local agencies are responsible for protecting a wide range of sensitive government data. Many also operate across decades of legacy systems, departmental applications and newer cloud platforms, making it difficult to maintain consistent visibility into where sensitive information resides and how it moves across the environment.

AI adds another layer of complexity. Traditional perimeter, identity and endpoint controls remain essential, but they weren't designed to govern how sensitive information flows into and out of AI applications. Data now moves through prompts, uploaded documents, APIs and AI-generated outputs, creating new pathways for exposure that many existing security controls can’t see.

Like previous waves of cloud adoption, AI is also creating a new form of shadow IT. Employees are experimenting with public AI assistants and AI-powered features embedded in existing software, often before agencies have established policies for appropriate use or visibility into what information is being shared. For lean security teams already managing diverse IT environments, keeping pace with AI adoption while maintaining effective governance can be a significant challenge.

How Modern DLP Expands Visibility While Mitigating AI Risk

A modern DLP strategy helps close the visibility and governance gaps that AI introduces by helping agencies understand where sensitive data resides, how it’s being used and when interactions with AI create unnecessary risk. Rather than relying on static rules or keyword matching, it continuously discovers and classifies sensitive information while monitoring how that data moves across cloud services, endpoints, email, web traffic and AI applications.

Using contextual policies, DLP platforms can evaluate each AI interaction based on user, data sensitivity, destination and business purpose. This enables agencies to automatically block, redirect, or allow activity based on risk. For example, this approach can prevent sensitive public data from being uploaded to an unauthorized public AI service while allowing approved AI tools to support legitimate work.

For small security teams, automation is just as important as visibility. Modern DLP continuously enforces policies, prioritizes high-risk activity and reduces the need for manual oversight, allowing staff to focus on strengthening security and enabling responsible AI adoption rather than chasing individual incidents.

3 Steps Agencies Can Take to Build an AI-Ready DLP Strategy

Fortunately, state and local agencies don't need to solve AI governance all at once. The most effective strategies begin with a few practical steps that improve visibility, establish guardrails and reduce manual effort.

Start with discovering and classifying sensitive data. Many agencies have sensitive information spread across file shares, cloud storage, collaboration platforms and departmental applications. Automated data discovery and classification provide the visibility needed to identify high-value information, understand how it moves across the environment and establish a foundation for effective AI governance and adoption.

Establish practical guardrails for AI. Create an inventory of approved AI tools, define which types of data can be used with each one, and implement policies that focus first on the highest-risk information. Governance doesn't have to be perfect on day one. Starting with clear, risk-based policies allows agencies to support AI adoption while strengthening protections over time.

Use automation to do more with limited resources. AI-ready DLP can automatically identify sensitive information, enforce policies consistently, prioritize high-risk activity and reduce the number of manual investigations. That allows security staff to spend less time chasing alerts and more time reducing risk while supporting responsible AI adoption.

Enabling AI With Confidence

AI has the potential to help state and local agencies improve services, increase employee productivity and better serve their communities. Realizing those benefits requires confidence that sensitive information remains protected. 

By strengthening data discovery, improving visibility and implementing AI-aware DLP policies, agencies can adopt AI with confidence while maintaining public trust and making the most of limited cybersecurity resources.

Garrett Lee is the Regional Vice President of the Enterprise Security Group at Broadcom. He is responsible for Broadcom's U.S. Public Sector go-to-market for the combined portfolio of Symantec and Carbon Black solutions for Information, Network, Endpoint and Application Security.