No Policy, No Control: Lessons on AI Governance from TxDOT and Oklahoma Health Care Authority Leaders

At InnoTech OKC this week, nearly every hand in the room went up for one question: who is already using AI at work? Only a few stayed up for the second: who feels their agency has full visibility and governance over those tools? That gap is why the session was on the agenda, and it matches what state and local IT leaders tell us every week.

I had the honor of moderating "No Policy, No Control: Why IT Leaders Must Act on AI Governance Now" with two leaders who run real governance programs: Anh Selissen, CIO of the Texas Department of Transportation, and Jalen Byford, Deputy CTO of the Oklahoma Health Care Authority and president of Techlahoma, who also drew on his recent role as CIO of Humana Healthy Horizons in Oklahoma. Both were candid about what has worked, what hasn't, and what they'd tell a peer starting from zero.

AI is already everywhere in your agency

Asked where AI is showing up, Jalen's answer was one word: everywhere. Standalone assistants like Copilot, home grown internal assistants, generative and agentic tools, traditional machine learning, and AI features vendors are quietly embedding in SaaS products agencies already own.

Then there's shadow AI. Employees are using free consumer services whether or not policy allows it. Blocking them at the firewall doesn't remove the demand; it just hides it. The durable answer is to give people an approved, useful alternative and then govern that.

TxDOT has been on a sanctioned AI journey for almost three years, starting with proofs of concept for Copilot and Gemini and expanding into Power Apps, RPA, Claude, and agent building tools. IT makes enterprise AI available the same way it makes Office 365 available, then works with the business on use cases.

Executive sponsorship turns a policy into a program

Anh was clear that executive director support is what made AI governance urgent and actionable at TxDOT. Adoption costs real money, and the agency is changing how work gets done, not just adding a tool. Neither happens on IT's authority alone.

Jalen made the same point: without executive support, AI initiatives stay isolated projects with thin adoption and thinner resources. People need to understand what AI can and can't do before they're asked to use it.

The threat model changed, and policy needs to catch up

Many agencies wrote their first AI policies when the technology was new and the focus was on opportunity. Since then, AI has also made attacks faster, cheaper, and easier to automate, and the sensitive data agencies hold on behalf of citizens raises the stakes on every incident.

Both panelists agreed that AI governance and cybersecurity now go hand in hand. Agencies need to revisit their policies with today's risks in mind, understand how AI tools connect to their systems and data, and use AI for defense as much as for operations. The threat landscape has moved, and governance has to move with it.

Who owns AI governance? Everyone.

Both panelists agreed that AI governance can't live in IT alone. The responsibility lands on every part of an agency: leadership sets the direction, legal and compliance define the guardrails, procurement shapes what gets bought, and every business unit owns how AI is used in its own work.

When governance is shared across the organization, it becomes part of how the agency operates rather than a policy nobody outside IT reads. It also brings the people closest to the work into the conversation, which is where the most valuable use cases come from.

Good governance also depends on good data. AI is only as reliable as the information behind it, so data quality is a shared responsibility too. As TxDOT puts it, AI should be "AI supported, human led."

The practical controls: DLP, an inventory, and real visibility

The audience questions went straight to enforcement: how do you keep sensitive data from leaving the agency, intentionally or by accident? Both panelists agreed that data loss prevention and monitoring are essential, but that blocking alone doesn't hold. Governance works best when it pairs clear guardrails with approved tools that meet employees' real needs.

Visibility is the other half. Agencies need to know what AI is in use, what has been built, who owns it, and how it's being used. Self reported inventories tend to leave gaps, so the agencies furthest along are investing in tools that show what's actually running across the organization.

The foundation is the same everywhere: clear governance, strong data protection, and reliable data. Those aren't AI specific requirements, they're signs of organizational maturity, and they're what make responsible AI possible.

Key takeaways

1. Make it an agency priority. AI governance needs executive sponsorship and owners across the business, not just IT.
2. Turn policy into practice. A written AI policy only works when it's enforced automatically, as AI is being used.
3. Give people a safe path. Shadow AI is a demand signal. Meet it with approved tools and guardrails, not just blocks.
4. Protect sensitive data at the source. Catch citizen and agency data before it leaves in an AI prompt.
5. Stay audit ready. Keep a clear record of AI use that supports oversight, compliance, and open records requests.
6. Know what AI is running. A live inventory of every AI tool, including embedded and shadow AI, is the baseline, and self reporting won't get you there.

That last point is the one I'd push hardest on. Both panelists described visibility as the foundation. Policy on paper is table stakes; the hard part is the enforcement layer that shows what's actually running across every tool and vendor, and closing that gap is exactly why we built Darwin Govern.

Thank you to Anh Selissen and Jalen Byford for being so candid, and to the InnoTech OKC team for putting practitioners on the stage. If you're working through the same questions in your agency, I'd love to compare notes.