If you’re a CIO or IT leader in state and local government, you’ve been in one of two rooms lately. In the first room, leadership is cautious. AI feels risky, premature, or simply not a priority right now. In the second room, there’s urgency. Leadership wants AI today, and the pressure is coming from the top. Both rooms are valid. Both are real. But both rooms have the same problem: neither is actually ready.. And the reasons why are the same in both cases.

I work directly with state and local government agencies on technology adoption and modernization. What I’ve observed on the ground across different agencies are foundational gaps. No AI tool, however advanced, can compensate for them.

The first gap hides behind the “if it isn’t broken, don’t fix it” mentality. As long as it does not cause a problem today, it stays off the agenda. A significant number of SLG agencies are still running legacy applications, some of them homegrown systems built years ago by developers who are long gone. I’m not talking about the app for travel reimbursement submissions. I’m talking about applications that touch citizen services directly. The ones where if the system goes down, the service goes down. These systems are running on unsupported infrastructure, and the IT team is expected to keep them alive through pure expertise and institutional memory. How long can you expect your team to keep reviving systems that are already on life support? At some point, the system will break, and it will likely break at the worst possible moment. Even if you have no intention of adopting AI anytime soon, modernizing these systems isn’t optional. It’s operational survival. They may already be costing more to maintain than to replace.

The second gap is the foundation of AI itself. Data. Most SLG agencies are sitting on terabytes of accumulated data. It lives everywhere: in legacy systems, newer applications, cloud environments, on-premises infrastructure, databases, and file shares. Some of it is still being actively generated by modern and legacy applications. Some of it carries permanent litigation holds. It has to exist, it has to stay, but it hasn’t been accessed in years. No one knows what it is, who owns it, or what’s actually in it. Years of accumulated data sitting in silos, disconnected from each other, with no clear ownership and no governance. Ask yourself honestly: do you have full visibility into your own data environment? Introducing AI into this environment is premature. It introduces a powerful tool into an environment you do not fully understand. This is more than a technology risk. Unmanaged data leads to unmanaged AI, and unmanaged AI creates visibility, governance, and accountability risks.

The third gap is capacity. Your staff is doing extraordinary work with limited resources, but many teams are underwater. When most of their time is spent keeping aging systems alive, there is little capacity left for modernization. Hiring takes months, contractors require funding that may not exist, and the modernization conversation keeps getting pushed into the next quarter, fiscal year, or leadership cycle.

These gaps are real. They exist in more agencies than leadership would like to admit, and your IT team is carrying the weight of them quietly, often without the visibility or investment the situation actually warrants. And if you’re being honest with yourself, you probably already know this. You’ve seen it. Maybe you’ve looked away because the alternatives felt too expensive, too disruptive, or too far outside what this quarter’s priorities allow. That’s understandable. But it’s costing you more than you think.
The good news is that these are solvable problems. They deserve serious investment. The return may not be immediate, but it’s certain. You can’t plant an orchard in unprepared soil and expect it to bear good fruit. The work you do on the foundation is what makes everything that comes after it successful. Here’s where to start.

Modernize mission-critical applications

First, modernize the application layer. Prioritize the legacy systems that are mission-critical, the ones keeping citizen services running. Make the case for funding, bring in contractors if needed, and treat this as infrastructure investment. Until your applications are on modern, supported infrastructure, nothing else can move forward cleanly.

Establish visibility and governance over data

Second, once those applications are modernized, turn your attention to data. Identify what you have, where it lives, who owns it, and what governance rules apply to it. Move it to a private or government cloud environment where it can be properly structured, classified, and protected. This step is only possible once the systems generating and holding that data have been addressed.

Introduce AI only after the foundation is stable

Third, and only then, introduce AI. Not because AI isn’t powerful or valuable, it is, but because AI will only amplify what already exists in your environment. A clean, governed, well-understood data environment gives AI clear guardrails. You’ll know exactly what data sources it can access, who has visibility into it, and where the boundaries are. Too often, security and governance get cast as the blockers, the forces standing between agencies and progress. They’re not. They’re what serious, sustainable AI adoption actually looks like.

This won’t be perfect. No environment ever is. But starting from a place of structure and visibility is fundamentally different from layering AI on top of chaos and hoping for the best.

The staffing and budget conversation has to happen now at the leadership level. Not next quarter. The instinct to defer it is understandable; competing priorities, limited cycles, nothing visibly on fire. But an environment running on institutional memory and aging infrastructure is unpredictable. You cannot build anything meaningful, let alone introduce AI, on an unpredictable foundation.

Next time you find yourself in either of those rooms, whether leadership wants AI today or wants nothing to do with it, the steps you need to take are the same. The foundational work does not change based on AI appetite. Neither does the cost of ignoring it.

Guest Author:

Perla Kfouri guides regulated organizations through complex modernization efforts, with a focus on secure digitization, responsible AI, and operational continuity. She has led major initiatives to digitize laboratory operations in regulated pharmaceutical environments, retire legacy systems, and implement secure, compliant workflows that withstand the scrutiny of high‑assurance industries. As a certified change‑management practitioner, she brings a practical understanding of the cultural, operational, and governance challenges that make modernization difficult, and how to move organizations through them with clarity and confidence.

At Microsoft, Perla partners with government agencies to advance AI modernization, strengthen data governance, and adopt responsible AI practices that improve service delivery and reduce administrative burden. She advocates for human‑centered modernization that enables people to work faster, smarter, and with greater impact.

Tag/s:Artificial Intelligence, Business Transformation, Government,