Lock the Vault
AI Governance Begins with Data Custodians

The most dangerous AI exposure isn’t what you deploy. It’s what your vendors do without asking.

Election Management Bodies (EMBs) often work with 3rd-party SaaS, cloud hosts, and custodial partners who have access to voter rolls, address registries, and sensitive adjudication records.

These contracts were written beforeagentic AI.

That’s the problem.

The Agentic Threat

Modern AI agents (like those built with OpenAI or Google Gemini) are capable of:

• Persistent memory
• Lateral reasoning
• Autonomous data retrieval

If your custodians start injecting these agents into their service layers without telling you, your voter data is at risk of being embedded, indexed, and retained outside your jurisdiction.

The Immediate Fix: Audit Every Contract

Every EMB should do the following this quarter:

• Contact all data custodians (EMS providers, hosting vendors, etc.)
• Request written confirmation that no agentic AI has been deployed
• Add a clause that no AI agent can access data without written EMB approval
• Define what constitutes “agentic AI” and require disclosure of any LLM interfaces

Sample Clause Language

“Under no circumstances may the contractor, its affiliates, or subcontractors expose EMB data to any AI agent, language model, or autonomous system, unless expressly authorized in writing by the EMB.”

Governance Starts With Control

Disclaimer: I am not a lawyer. The guidance in this article reflects my personal strategic view on AI governance, not legal advice. I strongly recommend that you bring these issues to your organization’s legal counsel and use this context as a starting point for contract review and conversation. You can’t govern what you don’t control.

Lock the vault.

Only after you secure your perimeter can you begin to pilot safe, sovereign AI.