The Control Paradox in Government: setting the dial for public-sector AI

Every debate about artificial intelligence in government eventually collapses into a single argument about a single dial. Turn it one way and you get the promise of faster licences, smarter services, and fraud caught before it drains the treasury. Turn it the other way and you get audit trails, human review, redress rights, and slower everything. One camp insists governance is a brake on innovation. The other insists governance is the very thing that makes innovation safe enough to scale. Both are partly right, and that is exactly the problem.

The tension is not new. In 1980, David Collingridge described what we now call the Collingridge Dilemma: early in a technology’s life, when it is still cheap and easy to steer, we do not yet understand its effects; by the time the effects are obvious, the technology is so embedded in economic and social systems that steering it becomes costly and politically painful.¹ A generation later, Larry Downes named the mismatch differently, as the pacing problem: technology moves at an exponential clip while law and regulation crawl.³ Genus and Stirling argue that Collingridge’s insight has been widely cited but rarely taken seriously enough.²

AI sharpens the dilemma to a fine point. Public-sector AI does not arrive as a discrete product you can inspect once and approve. It learns, updates, and reshapes itself in deployment. The window between easy to govern and too entrenched to change is not just shrinking, it is closing while the system is running.

The instinct to treat the choice as binary, more rules or more innovation, is the first mistake. The relationship is better drawn as an inverted U. At the low end, the absence of governance breeds uncertainty, risk aversion, and distrust, so useful systems never leave the pilot stage. At the high end, compliance becomes so heavy it drains the resources that innovation needs. The productive zone sits in the middle, where governance supplies enough clarity and trust to act, without becoming prescriptive enough to paralyse.

This is not just theory. A 2025 study by the Cloud Security Alliance and Google Cloud, drawing on 300 IT and security professionals, found that governance maturity was the single strongest predictor of AI readiness. Organisations with comprehensive AI governance were nearly twice as likely to report early adoption of advanced agentic AI (46 percent) than those with only partial guidelines (25 percent) or policies still in development (12 percent), and about three times more likely to train staff on AI security.⁴ Yet only around a quarter of organisations had reached that mature state.⁴ Structure was correlated with confident adoption, not with caution.

Arena 1 · Administrative decisions and e-licensing

Governments already run AI quietly through the machinery of the state: triaging permits, screening licence applications, flagging fraud, prioritising inspections.¹⁴ The upside is real. A licensing authority that can pre-check completeness, detect anomalies, and clear routine renewals in minutes frees scarce human attention for the hard cases. This is the dial turned up on capability.

But the same arena holds the most sobering cautionary tales in modern governance, and they are stories of the dial turned down on accountability while it was turned up on automation. In the Netherlands, the childcare benefits scandal (the toeslagenaffaire) saw the tax authority wrongly brand roughly 26,000 families as fraudsters between 2005 and 2019, a risk model that treated dual nationality as a red flag, demands to repay tens of thousands of euros, and, in January 2021, the resignation of the entire Rutte government.⁶ The related SyRI welfare-profiling system was struck down by a court in The Hague in 2020 for failing to strike a fair balance with the right to privacy.⁶ In Australia, the Robodebt scheme falsely accused close to half a million welfare recipients of owing money before it was scrapped in 2020.⁷

These were not failures of ambition. They were failures of calibration: automation deployed at scale without explainability, without meaningful human oversight, and without a working route to redress. The lesson public-sector scholars now draw is a shift from trying to open the black box toward explanation-centric accountability, where the test is not how the model computed an output but whether the resulting decision is legally defensible, traceable to a statute, and contestable by the person affected.¹⁸ Practical instruments already exist: public algorithm registers, France’s long-standing right to request administrative source code under its 1978 CADA law, and mandatory human sign-off with an audit trail.¹³

Arena 2 · Cross-border e-licensing and digital public services

The moment a licence, a qualification, or a business registration has to be recognised in another jurisdiction, the paradox compounds. Here the European Union offers the most developed live experiment. The Single Digital Gateway Regulation requires 21 key administrative procedures to be available fully online, including to cross-border users, and applies the once-only principle so that citizens and businesses need not supply the same evidence twice.⁸ Its Once-Only Technical System lets one country’s authority request official evidence from another’s, but only at the user’s explicit, previewable request.⁸ Underneath it sits the eIDAS framework, which since 2018 has required mutual recognition of national electronic identities and is now extending, through eIDAS 2.0, into a European Digital Identity Wallet.⁹

Read through the control paradox, the crucial insight is this: interoperability is governance that enables. Mutual recognition and shared technical standards are constraints, yet they are precisely what allows an e-licence to flow across a border at all. The dial here is not more or less control but control that is common. For the Global South, and for regional bodies such as ASEAN, the design challenge is to reach that common baseline without importing regulatory machinery that local institutional capacity cannot yet sustain.

Arena 3 · Cross-border trade in AI itself

Digital trade agreements are quietly becoming AI governance instruments. The Digital Economy Partnership Agreement (DEPA), launched by Chile, New Zealand, and Singapore and since joined by South Korea, already carries provisions touching AI, digital identity, and paperless trade.¹⁰ ASEAN’s Digital Economy Framework Agreement (DEFA) aims to make digital rules more interoperable, enable cross-border data flows, and build a mutually recognisable digital identity and authentication framework, with explicit cooperation on emerging topics including AI.¹¹ The OECD’s 2026 Digital Trade Review of ASEAN notes that regional trade agreements already address AI-relevant matters such as cross-border data flows, source-code protection, and the continuation of the WTO e-commerce moratorium.¹¹ Older instruments point the same way: the USMCA digital trade chapter presses members to base domestic rules on international standards.¹²

This is where the compliance-cost asymmetry the ethics debate keeps flagging becomes economic policy. Large firms can absorb divergent, jurisdiction-by-jurisdiction rules; startups and development-sector organisations operating across many countries cannot. Interoperable governance lowers that toll, which is why, counter-intuitively, well-designed rules can widen the field rather than narrow it.