Almost two thirds of Victorian local government officers are using artificial intelligence without clear governance behind them, a new survey has found. The gap exposes councils to privacy, accountability and compliance risk.
The finding comes from Bridging the Gap: AI Risk and Governance in Local Government, a report by law firm Maddocks. It draws on responses from 337 officers across 75 Victorian councils, surveyed in September and October 2025. A follow-up pulse survey of 100 officers in June 2026 confirmed the trends.
The report describes a sector where AI adoption is real but tactical. In the pulse survey, 92 per cent said their council used AI in some form, up from 68 per cent in late 2025. Yet only about a third across both surveys believed their council had a governance framework in place.
Most use remains individual rather than institutional. In the pulse survey, 54 per cent said AI was used mainly for individual productivity such as drafting. Just 2 per cent said it was embedded in business processes or service delivery. Drafting and writing was the top task, mentioned 186 times in open responses.
Privacy and accuracy dominate concerns
Privacy and data protection was the biggest risk officers associated with AI. It was cited by 95 per cent of respondents in the initial survey and 62 per cent in the pulse survey. Quality and reliability of outputs narrowly led the pulse survey at 63 per cent, ahead of governance and policy gaps at 49 per cent.
The report notes that officers are proactively self-imposing limits, such as avoiding uploading sensitive data and closely reviewing outputs. It links this caution to a lack of guidance rather than resistance to the technology, concluding that officers "are not anti-AI, but rather anti-risk".
Uncertainty runs through the data. On average, 67 per cent were unsure whether their council had received legal or compliance advice on AI use, council data or output ownership. Respondents from the same councils frequently gave conflicting answers. The report reads this as a sign that AI information is not managed or communicated centrally.
Legal obligations still apply
Maddocks sets out the legislation councils must weigh when deploying AI. These include the Privacy and Data Protection Act 2014 (Vic) and the Health Records Act 2001. Others are the Freedom of Information Act 1982, the Public Records Act 1973 and the Equal Opportunity Act 2010. The report stresses that AI does not remove human accountability, and that councils remain responsible for decisions affecting ratepayers.
It flags that freedom of information and public records obligations continue to apply to AI-generated material. Officers, it warns, often lack clarity on data sovereignty and offshore processing.
Kate Oliver is a Maddocks partner and the firm's Victorian local government sector leader. She writes that councils that get strategy, governance and compliance right "will confidently cross the frontier - and those who don't will remain stuck in uncharted territory".
A framework for adoption
The report proposes a "6C" framework covering consideration, clarification, compliance, communication, coaching and confidence, alongside 15 considerations for drafting governance frameworks. Its central recommendation is that councils prioritise governance for current AI use, not future planning. The immediate risk is the uncoordinated use already occurring.
It also recommends a problem-led approach to deployment, experimentation within defined guardrails, and practical training through examples, templates and AI champions. Legal guidance ranked as the most requested support, chosen by 83 per cent of respondents, ahead of technical training at 75 per cent.