Every public body that adopted a generative AI policy since 2023 wrote the same sentence: IT must approve every AI system before purchase or use. Almost none of them say how. AxiLayer AI writes the policy, encodes it, and reviews the tools against it.
Public-sector AI policies assign approval to the CIO or IT department and bind every vendor and contractor working on the body's behalf, but most provide no third-party evidence mechanism IT can actually apply. A department head is asked to approve a new AI-enabled tool with no basis beyond the vendor's own word.
Shadow and embedded AI is where the real policy gap lives: generative features quietly enabled inside office suites, GIS platforms, asset-management systems, HR software and customer-service tools, none of which went through a procurement review built for AI.
A policy document alone does not close that gap. Closing it takes an inventory of what AI is actually running, obligations specific enough for IT to apply without a specialist on staff, and a third-party way to check a vendor's claims before the purchase order is signed.
The policy is delivered twice: the document the governing body adopts, and the same policy encoded as machine-readable obligations a new tool can be checked against in an afternoon, not a specialist review cycle.
Each engagement is scoped to the body's own structure and risk tolerance, but every one covers the same six areas, in the order a governing body actually needs them.
An inventory of authorized, shadow and embedded AI across departments and SaaS, department interviews, and benchmarking against comparable bodies.
Definitions for generative, predictive, physical, agentic, diagnostic and operational AI, risk tiers modeled on NIST AI RMF, human-in-the-loop mandates by tier, and data-security boundaries.
How prompts, outputs and training data interact with state public records law and the body's own retention schedule.
A vendor-neutral risk assessment IT and procurement can apply themselves, without a specialist on every purchase.
Protocols for AI failures, hallucinations and data leaks; monitoring of model performance, infrastructure health and degraded performance; vendor-neutral criteria for any monitoring tool the body later selects.
Plain-language materials and interactive workshops, built for staff who are not AI specialists.
The policy is delivered twice. First, the document the governing body adopts. Second, the same policy encoded as machine-readable obligations, each mapped to NIST AI RMF functions and ISO/IEC 42001 clauses, exported as open JSON the public body owns outright. A new tool can be checked against the policy in an afternoon. The oversight committee reviews against one consistent basis every time, not a fresh interpretation per vendor. Any monitoring tool the body later selects, from any vendor, can load the same encoded obligations.
For a tool a department wants to buy, AxiLayer AI evaluates the vendor's system against the body's own policy, NIST AI RMF and ISO/IEC 42001, and issues a signed, third-party verifiable readiness summary: Ready, Ready with Findings, or Not Ready, with a per-obligation result and the evidence reviewed. The approving IT department has something to approve against. The vendor has something to attach to a bid.
From a single department's shadow-AI inventory to a full policy encoding and vendor review program, AxiLayer AI evaluates public-sector AI use against whichever obligation actually applies, department by department.
Governments on every continent now set rules for how their own agencies use and buy AI. Each policy we write maps to the rules that bind the body, and the ones its vendors will meet elsewhere. Verified as of October 2026.
Seven duties recur across government AI rules. Our policy template covers all seven, so a body is ready whichever regime applies.
Swipe the table to see all eight jurisdictions.
| Duty | U.S. Federal | New York State | Maryland | EU Public Bodies | United Kingdom | Canada | Australia | Japan |
|---|---|---|---|---|---|---|---|---|
| AI inventory or register | ||||||||
| Impact assessment | ||||||||
| Public transparency | ||||||||
| Human oversight | ||||||||
| AI procurement terms | ||||||||
| Staff training or AI literacy | ||||||||
| Named accountable official |
Required Guidance or recommended. A blank cell means the instrument does not specify the duty. Summary of public sources, not legal advice.
Nothing about AxiSentinel's core architecture changes for a policy engagement. What changes is which RegDef packages are switched on, and that the output includes a policy document a governing body can adopt, not only continuous monitoring evidence.
The adopted policy exported as open JSON, each obligation mapped to NIST AI RMF functions and ISO/IEC 42001 clauses, owned outright by the public body.
A state-and-local-government AI policy baseline that jurisdiction-specific overlays layer on top of, so each engagement starts from encoded obligations, not a blank page.
A vendor tool is evaluated against the body's own encoded policy and returns Ready, Ready with Findings, or Not Ready, with a per-obligation result.
Every readiness result and every monitoring record is linked to the one before it in a signed, tamper-evident evidence chain, verifiable without relying on AxiLayer AI.
Structured discovery across departments and SaaS surfaces embedded AI before it becomes a policy gap.
Obligations mapped to the body's own retention schedule and the applicable state public records law.
Once adopted, the policy's obligations can be monitored continuously for customers who want always-on coverage, or on a schedule or on demand for customers who prefer that.
Where an engagement produces monitoring-tool recommendations, those are vendor-neutral selection criteria; AxiLayer AI does not recommend its own platform in that deliverable.
Nothing becomes a compliance finding until a qualified AxiLayer AI auditor reviews and signs it, for a policy readiness review the same as for continuous monitoring.
Deployment options extend to air-gapped and restricted environments for agencies that require them.
The same architecture evaluating a hospital's diagnostic AI or a bank's lending model now evaluates a county's chatbot and a utility's monitoring system. What changes is which RegDef packages are switched on.
AxiSentinel carries a state-and-local-government generative AI policy baseline, mapped to NIST AI RMF and ISO/IEC 42001, with jurisdiction-specific overlays layered on top of it as each engagement requires. A Procurement Readiness Review always evaluates a jurisdiction's overlay together with the shared baseline, never one alone, so a vendor tool is checked against the full set of obligations that actually apply, not a generic subset. The baseline and overlay architecture is live in AxiSentinel today; additional sector-specific overlays, including for public records law and for operational AI in water and utility systems, are in active development and are listed on this page only once they are live.
AxiLayer AI's ISO/IEC 17020:2026 Type A application is in process, alongside a parallel ISO/IEC 42001 application, both with a U.S.-based accreditation body signatory to the ILAC MRA and IAF MLA.
AxiLayer AI holds no stake in any tool it assesses. AxiLayer AI operates its own assurance platform, AxiSentinel, and discloses that in every engagement. Where a policy engagement produces monitoring-tool recommendations, those are vendor-neutral selection criteria, and AxiLayer AI does not recommend its own platform in that deliverable.
Whether the need is a first AI use policy, an update to one already adopted, or a Procurement Readiness Review for a single tool, AxiLayer AI delivers it the same way: an adoption-ready document, the same policy encoded as machine-checkable obligations, and a human signature before anything counts as a finding.
