With its power to automate tasks, supercharge analysis and draw insight from vast troves of data, AI offers public sector leaders the promise of a magic wand.

Local governments see AI as a way to stretch taxpayer dollars further and deliver more responsive, personalized services to their communities. For school boards and community colleges, the technology promises more — AI could expand educational opportunities, improve administrative efficiency and, ultimately, boost student success.

But with power comes risk. How well does your organization manage risks like inaccuracies and “hallucinations,” and how well have you protected sensitive or personal data?

As districts and municipalities build AI into new processes and new aspects of their operations, boards need to stay up to date on a fast-changing regulatory landscape. Not keeping pace can expose whole institutions to meaningful risks, from fines and reputational damage to lost community trust. Getting ahead of the curve, by contrast, gives decision-makers the chance to ensure compliance, maintain stakeholders’ trust and think strategically about long-term adoption.

To help publicly elected boards develop strong, up-to-date policies for AI governance, we’ve rounded up regulatory developments into a user-friendly guide that offers:

A detailed overview of laws and frameworks to know, plus agencies and issues to watch, in the AI regulatory landscape.

Tips and guidance on AI governance and administration, from peers grappling with the same decisions.

Advice on how modern governance software can help.

The regulatory landscape: AI in local government and public education

The emerging meshwork of AI laws covers a wide and ever-expanding range of areas, from cybersecurity and data protections issues to usage policies and safety precautions.

When navigating AI governance for your school or municipal organization, we recommend consulting with your legal team and doing in-depth research on specific agencies, laws and issues. But this high-level overview of select countries — the agencies involved, what they’re focused on, who they’re partnering with and specific policies (both enacted and proposed) — is a powerful start to understanding the landscape.

Data privacy has long been governed at the federal level by legislation such as 

. The situation with AI, however, is more complex.

American AI legislation took off when the White House released an 

 through its Office of Science and Technology in 2022, then issued an Executive Order on AI one year later. Both steps added urgency to existing efforts to develop AI legislation, of which the 

The National Artificial Intelligence Initiative Act of 2020 (Division E of the NDAA of FY2021, P.L. 116-283). This law formalize the American AI Initiative and created an AI Initiative Office, alongside an inter-agency committee and a National Advisory Committee, all aimed at guidance and recommendation.

The AI in Government Act of 2020 (Division U, Title I, of the Consolidated Appropriations Act, 2021, P.L. 116-260), which directs the General Services Administration (GSA) to create an AI Center of Excellence and undertakes various facilitating and streamlining measures.

From there, AI regulation in the United States has evolved through a patchwork of federal, state and industry frameworks — especially after July 2025, when the Senate struck down proposed legislation that would have blocked state and local governments from 

Department of Education guidance on the use of AI

. Current rules clarify the status of AI in relation to federal grants and funding and lay out key constraints on how it can be used. These directives respond to the 

 that your team will also need to become familiar with. 

Local government officials and board members can instead look to the 

, also from 2025, and may wish to follow along with 

 about the use of AI in government activities. 

Regulation of AI at the state level has been more direct and more active than among federal policymakers. Many of the key considerations apply both to school boards and to local government.

The National Council of State Legislatures published 

an overview and tracker of 2025 AI-related regulatory developments

. It tracks the most common areas for AI regulation across states, including transparency requirements for automated decision-making tools to guardrails for AI-powered bots and agents.

 became the first US state to enact comprehensive AI legislation in May 2024, with a focus on algorithmic discrimination and systems in essential areas like housing, healthcare, education and employment. 

 also has been a forerunner in AI regulation, addressing areas like increasing business accountability, combatting discrimination and regulating how businesses use data. 

Many of these policies — such as those adopted in 

 — also establish a state office or center of excellence to sponsor, host and disseminate additional research or guidance. 

Most states have, for now, opted for more limited regulation — such as 

, which this year chose not to regulate AI in education, business, or government directly but rather to prohibit certain uses of AI, such as “deepfake” images that can be harmful.

dozens of states have enacted or proposed hundreds of pieces of AI-related legislation and regulation

, with the most common areas of focus including:

Notifying people that they’re interacting with AI systems or AI-generated content

Using algorithms to determine employment, services and housing

Offering ways to opt out of data collection and profiling

Testing AI systems for discrimination and bias

Taking measures to monitor, mitigate and disclose the potential risk and impact of AI applications like automated decision tools and bots for purposes like mental health services

In public education, a majority if states now impose at least some formal guidance on school systems’ uses of AI tools and platforms, with a helpful overview provided by 

, school districts are required to maintain a detailed policy on AI use. In states like 

, the absence of school-specific regulation is balanced by robust guidelines covering legal, ethical, pedagogical and social issues related to AI.

For local government, the top concern is not about targeted regulation but the 

 — of multiple sources of AI policy and guidance. 

Artificial Intelligence and Data Act (AIDA)

 was Canada’s first attempt at comprehensive AI legislation. Although AIDA was paused in early 2025 due to parliamentary changes, its principles — including risk-based governance, transparency, and accountability — continue to shape voluntary codes and sector-specific guidance. 

In the absence of binding federal law, the Department of Innovation, Science and Economic Development (ISED) has introduced a Voluntary Code of Conduct for Generative AI, which encourages organizations to uphold standards around fairness, safety, human oversight, and transparency when deploying advanced AI systems.

 that would regulate the use of AI in Canadian higher education by extending the AIDA, but is currently tabled. The law, if passed, would implement strict transparency and safety requirements for AI in K-12 contexts. There have also been recent calls for a 

national policy strategy for generative AI

” currently surrounding the technology.

Some school boards have been proactive about AI — in Alberta, for instance, the School Board Association 

Other provinces have followed suit, albeit with a more general focus. 

, for example, imposes strict data privacy and automated decision-making disclosure requirements, including mandatory notification when decisions are made solely by AI.

 requires public sector entities to disclose AI use, manage associated risks, and implement accountability frameworks. Despite examples like this, a 2025 report on local government pointed out that nearly one-third of 

municipalities still lack formal guidelines f

These rules will continue to change. Debates about the use of AI in Canada’s schools and local governments remains fierce — so savvy board members will make proactive moves to head off the greatest risks and set up flexible, powerful systems for governance and internal management of AI technologies.

Practical tips and resources for regulatory compliance

Knowing the latest laws is only half the battle. Now you need to put that knowledge to work by figuring out how your organization will comply with them.

One place to start is with an AI governance framework. Such a framework sets guardrails, guidelines and expectations, as well as outlining what’s acceptable and what’s prohibited for those using AI tools.

A municipal or school district board can make the process of developing an AI framework more manageable with these seven steps:

1. Getting up to speed with resources like the AI Risk Management Framework and Playbook from the National Institute of Standards and Technology (NIST) or the Artificial Intelligence Governance and Auditing (AIGA) list of AI governance tasks — and trying out AI tools and applications first-hand to explore their capabilities and limitations.

2. Applying this research to their organization by considering questions like:

What will your organization consider “acceptable use” in terms of AI?

Who’s involved in making this decision and how?

What uses of AI will be prohibited, or allowed but considered high risk?

How would you govern these projects and mitigate the risk?

3. Come to a mutual understanding of how you’d like to see it used in your organization — and document this discussion.

4. Get administrators and staff familiar with AI tools and how to use them correctly, to minimize the chances they get frustrated and dismiss them.

5. Rolling out a few pilot projects Proceed in a targeted, easy-to-manage fashion.

6. Bringing in other technology to help, like specialized governance software.

7. Keeping humans in the loop every step of the way.

“While AI will assist in streamlining workflows and so many other things, the human insight provided by members of public-facing boards will not and should not ever be replaced. Boards will actually be able to offload work that can be determined by algorithms and, in its place, focus on important discussions and collaborations with those whom they represent.” - Andrea Messina, CEO, Florida School Boards Association

AI policy — guidelines and rules for AI use — is a complementary next step and brings up many more questions. A public education board might consider:

For students, what are the consequences of using AI for class assignments but not disclosing its use?

For teachers, what AI tools will be permitted in the classroom, and for what purposes?

How will data be collected, used and shared, and how will you proactively inform parents, students and stakeholders about this?

How will your district or college avoid access and digital divide issues when incorporating AI tools into classwork and assignments?

“If it’s going to help (board members) do their jobs, phenomenal. If it’s going to do their jobs for them, that’s really problematic.” — 

Jay Worona, Partner at Jaspan Schlesinger and Narendran, and former Deputy Executive Director and General Counsel, New York State School Boards Association 

Governance checklist for public education

Governance checklist for local government

creating a safe and transparent AI governance framework

Diligent Community: Bringing efficiency, effectiveness and ease to AI governance

Just like the technology itself, AI regulations are evolving fast — as are the related opportunities and risks. Diligent Community helps busy boards keep up by:

Centralizing policies, meeting materials, onboarding documents and training resources in one online library, so they can access the right data at the right time for better decision-making.

Delivering secure communications through the same platform so clerks and administrators can consistently keep board members up-to-date and prepared.

Equipping staff and board members with custom workflows for seamless reviews and approvals and meeting management features like in-platform voting and “sticky note” annotation tools, to keep them engaged and aligned in their work.

Enhancing transparency with an ADA-compliant, easily searchable public website for sharing agendas, minutes and other public documents.

Engaging the community even more through a one-stop Livestream Manager that’s easy to set up with a high-quality video stream and features that bring viewers into the process, like split-screen video alongside the agenda and time-stamped minutes that can be created quickly from livestream transcripts via AI.

Enabling policy management from creation to adoption with Policy Publisher.

Throughout, this cloud-based board management software uses secure servers and 256-bit encryption, the strongest level of encryption currently available — to ensure privacy and security for the most sensitive school or municipal data.

By delivering the right data to the right people at the right place and time, Diligent Community makes AI governance more efficient, effective and engaging. 

AI regulations: What publicly elected boards need to know

Many factors contribute to the persistent confidence that investors maintain in U.S. financial markets, including internal control over financial reporting (ICFR). It's the framework of controls companies use to compile and deliver accurate financial statements, and it's the focus for critical external audits businesses must pass. Investors depend on reliable financial information, and effective ICFR — including a successful audit report on internal controls — helps reduce the risk that financial statements will contain material errors or misstatements.

 shows material weaknesses trending downward through April 2025, indicating improved ICFR effectiveness across organizations. However, regulations continue evolving, with new auditing standards and enhanced cybersecurity disclosure requirements creating additional complexity for governance leaders.

As with any system, maintaining sound ICFR requires ongoing effort and dialogue among stakeholders to create and maintain effective controls. This article will help those involved with financial reporting establish better controls by explaining:

What internal control over financial reporting means and why it matters

ICFR regulations and frameworks, including SOX requirements and COSO guidelines

Practical ICFR examples across common business processes

The audit process and types of audit reports on internal controls

Internal controls over financial reporting checklist for payroll and procurement

Best practices for audit committee oversight and control design

How AI technology transforms ICFR through automation and continuous monitoring

What are internal controls over financial reporting?

Internal control over financial reporting is a process that helps companies manage risks and ensure the reliable preparation of accurate financial statements.

The accepted internal controls over financial reporting definition includes the 

 that employees at all levels must follow when engaging with company finances. This typically involves tracking receipts and seeking managerial approval for all transactions, among other control practices.

 companies, ICFR represents the foundation for transaction readiness and investor confidence. These organizations must build governance infrastructure that supports current operations and future growth milestones, including potential IPO preparation.

Most shareholders want to review financial statements and receive assurance about statement accuracy. However, investors aren't the only motivator for ICFR. Several regulations and frameworks dictate the internal control over financial reporting practices that companies must implement:

 The SEC requires that all public companies comply with 

, which has numerous requirements for financial reporting controls. This is a crucial way the SEC seeks to bolster consumer and shareholder confidence in the capital market. 

 resulted in a record $8.2 billion in financial remedies obtained in fiscal year 2024, highlighting the critical importance of compliance.

 isn't a legal requirement, it bridges the gap between business imperatives and the risk landscape by providing a predefined control structure that many organizations adopt as their foundation.

 There are several frameworks beyond COSO that companies utilize to meet accounting standards. These include the U.S. 

International Financial Reporting Standards

 New Public Company Account Oversight Board (PCAOB) 

 became effective December 15, 2024, including enhanced requirements for auditor coordination procedures. Additionally, 

 now mandate 8-K filings within four business days of materiality determination.

What is the purpose of internal control over financial reporting?

Internal controls over financial reporting mitigate risk. Through 

, companies detect unauthorized use of company resources — whether by an internal bad actor or external breach.

Adopting a financial reporting framework means proactively identifying any activities that could impact financial statements. This increases the quality of financial statements, reduces the likelihood of misstating company assets, and enhances information security. For growth-stage companies preparing for investment rounds or IPO, robust ICFR demonstrates governance maturity that sophisticated investors increasingly demand.

Examples of internal control over financial reporting

 should be unique to your organization and industry. After all, a company with retail storefronts will need different controls than an online pharmacy. Several specific examples of financial reporting controls are relatively common across industries:

 A designated employee, such as a manager or accountant, reviews and approves transactions. To maintain proper separation of duties, this approver should not be the same person making the purchase. In mid-market companies, approval processes often involve multi-level workflows that scale with transaction amounts.

 Many businesses collect receipts for every transaction to verify that the approved funds used are as intended. Modern approaches include digital receipt management systems that integrate with enterprise resource planning platforms.

 Another ICFR example is reconciliation, which involves using receipts to validate any money coming in and out of company accounts. Advanced reconciliation processes now incorporate automated matching capabilities that flag discrepancies for management review.

 Ensuring that no single individual has control over all aspects of a financial transaction helps prevent both errors and fraud. This becomes particularly important as organizations grow and transaction volumes increase.

 Systematic review of financial results, including variance analysis and trend identification, helps identify potential issues before they become material weaknesses.

What is an audit of internal controls over financial reporting?

During an audit of internal controls over financial reporting, an external auditor evaluates the effectiveness of a company’s controls. The resulting report provides independent assurance that the company adheres to credible and ethical financial reporting practices.

The ICFR audit process is an important way to validate financial controls. It's also an SEC requirement for most public companies classified as accelerated filers (public float of $75 million or more), according to Section 404(b) of the Sarbanes-Oxley Act.

Generally speaking, an ICFR auditor will:

Review a sample set of transactions across multiple periods

Identify any weaknesses in the internal controls design or implementation

Determine whether a company is at risk of misstating finances

Issue a report of their findings with specific recommendations

Present to management and the board so they can remediate any issues

, effective December 15, 2024, enhances audit coordination procedures when multiple audit firms are involved, particularly relevant for complex organizations with subsidiaries or joint ventures.

Audit report on internal controls over financial reporting

During an audit of internal controls over financial reporting, an external auditor will review all controls to ensure they are designed effectively and implemented to protect the organization from financial risk. Audits are a regulatory requirement, but they're also an invaluable opportunity.

Even the best ICFR process may yield weak internal controls. What's more, the best controls can flounder because employees don't know how to follow them. An audit of internal controls over financial reporting pressure tests controls so the auditor discovers potential threats, not hackers and bad actors.

 is the product of the audit. It's the document that describes whether the organization passed the audit and the auditor's recommendations for improvement.

How do audits report on internal controls?

An external auditor issues an opinion on whether internal controls over financial reporting are effective. This is separate from — but aligned with — the audit of the financial statements.

The report will summarize the auditor's findings regarding the different control components:

The SEC requires organizations to file the audit report along with the annual report. That said, organizations can also use the auditor's opinion to improve their internal controls or strengthen their financial reporting policies.

Examples of audit reports on internal controls

 depending on whether the auditor issues a favorable or unfavorable position about the company's ICFR process:

 This is the most common report an auditor issues, and it means the company's financial reporting is satisfactory with no material weaknesses identified.

 This indicates that while the financial statements are fairly presented overall, there are specific areas of concern that don't rise to the level of material weaknesses.

 This is considered an unfavorable audit report and usually suggests that the organization interfered with the auditor's process in some way, preventing them from forming an opinion.

 An organization may receive this audit report on internal controls if its financial statements contain fraud, misstatements or the data wasn't prepared properly.

Though clean reports are the most common opinion auditors issue, disclaimer and adverse reports do happen. While this represents a significant challenge, it's not insurmountable. Rather, it's an opportunity to create a comprehensive remediation plan, similar to approaches 

documented by the Government Accountability Office

Management's report on internal control over financial reporting

The SEC requires that companies include both a management report on ICFR and an audit report on internal controls in the 

 annual report. Non-accelerated filers must conduct management ICFR assessments, but only accelerated filers and large accelerated filers must include an external auditor's attestation.

 a comprehensive readiness process executed over a one- to two-year period, with their illustrative timeline showing 15 months from initial assessment to IPO. This preparation involves building out financial reporting capabilities, internal controls, and governance structures, with early engagement of external advisors critical to success.

Internal control over financial reporting checklist

An internal control over financial reporting checklist is a tool that 

 employees should follow. Employees use the checklist to verify that they follow the appropriate controls, assuming they aren't 

. The checklist will likely vary between departments — payroll, for example, has very different needs than customer billing.

Regularly, team members can use the checklist to confirm that their process aligns with established controls. This process reduces 

 and offers assurance that employees at all levels are implementing the proper controls.

A sample checklist for payroll would include:

Matching timesheets to individual employees with proper authorization

Seeking approval on billed hours from supervisors before processing

Confirming the hours in payroll match the hours in timesheets exactly

Having the payroll manager review paychecks before they go out

Depositing paychecks into accounts associated with the people named on the paychecks

Maintaining proper documentation for all payroll adjustments

Reconciling payroll registers to general ledger entries monthly

Sample checklist: Purchase-to-pay processes

For purchase-to-pay processes, a comprehensive checklist might include:

Purchase requisition approval based on spending authority limits

Three-way matching: Purchase order, receiving report, and vendor invoice

Vendor master file maintenance with proper segregation of duties

Duplicate payment prevention controls and procedures

Monthly vendor statement reconciliations and follow-up on discrepancies

Best practices for internal control over financial reporting

ICFR processes and procedures are iterative, meaning they should evolve along with the business to 

. Creating a culture that allows for this evolution in internal control over financial reporting starts with effective best practices. This includes the following:

For all members of the financial reporting supply chain, the importance of tone at the top cannot be overstated. Management, together with the 

Communicating effectively about control expectations and accountability

Visibly adhering to clear ethical principles and codes of conduct

Providing necessary support and resources for comprehensive fraud risk management programs and internal controls

Demonstrating commitment through resource allocation and performance incentives

Often, the tone at the top needs to improve to encourage company-wide adoption of ICFR. Warning signs that the tone needs improvement include:

Internal control over financial reporting: A guide for governance leaders

GC Risk Index: GCs report heightened risks

A new survey of general counsel, chief compliance officers and audit leaders finds business risk on the rise in the third quarter, amid turbulent regulatory environment and tariff impact. 

Since the start of the year, geopolitical pressures have combined with trade negotiations and deregulation efforts to create heightened volatility for business. And as we begin the fourth quarter of the year, that instability shows little sign of improvement. 

Business risk is surging, according to legal and compliance leaders surveyed by Corporate Board Member as part of our Q3 Business Risk Index, which is a survey of general counsel, compliance leaders and audit members conducted in partnership with Diligent Institute. 

Legal and compliance chiefs are rating thel evel of risk in the current business environment at 7.9 out of 10, on a scale where 1 is Negligible and 10 is Significant. That number has been rising significantly since Q1, when business risk was rated just 5.8 out of 10––an increase of 36 percent since then.

Those polled say they find heightened risk amid the continued disruption of the Trump administration’s tariffs decisions, ongoing geopolitical conflicts and sticky inflation.

“The convergence of these factors keeps risk levels high and requires businesses to invest more in proactive compliance, risk management, scenario planning and governance frameworks,” says Taras Lytovchenko, the chief legal and compliance officer at Trinitex.

Many others who participated in the September survey echoed Lytovchenko’s sentiment, citing “tariff games by the administration” and “macroeconomic forces” as pertinent to this high-risk environment.

Interestingly, while the majority also cited the unpredictability of the regulatory environment as one of the top risks for business right now, that proportion is down 10 percentage points since last quarter. Kristy Grant-Hart, vice president and head of advisory services for Spark Compliance, a Diligent Brand, says companies may feel more prepared to navigate regulatory uncertainty thanks to proactive compliance measures and increased investment in monitoring and risk management.

Diligent

Blog

AI regulations: What publicly elected boards need to know

Internal control over financial reporting: A guide for governance leaders

Your Data Matters