As councils explore AI agents to support public services, the challenge is no longer simply identifying where artificial intelligence could save time. It is establishing how these systems can operate safely, transparently and accountably.
On 9 October 2026, the Local Government Association published A Playbook for Agentic AI in Local Government, offering practical guidance on responsible adoption.
The playbook addresses the opportunities offered by agentic AI alongside the importance of risk management, information governance, clear accountability and public trust.
For local authorities considering this technology, the guidance provides a useful starting point for turning AI ambitions into manageable governance arrangements.
Why agentic AI requires a different approach
Councils are increasingly exploring AI technologies to support administrative work, improve access to information and make services more efficient.
Agentic AI introduces an additional capability: systems may be able to plan tasks, use tools, connect to organisational information and perform actions with varying degrees of autonomy.
This creates potential productivity benefits, but also increases the importance of defining the boundaries within which those systems operate.
A council might, for example, deploy an agent to organise incoming information or prepare administrative recommendations.
Even where the final decision remains with an employee, the organisation still needs to understand the information being processed, the reliability of outputs and the controls needed to prevent inappropriate actions.
What does the LGA’s new playbook recommend?
The LGA’s October 2026 guidance promotes a proportionate approach to AI adoption.
It highlights the need for clear ownership, suitable risk assessments, information governance, workforce readiness, cybersecurity and meaningful human accountability.
Crucially, the playbook recognises that AI adoption is not just a technology implementation project.
It also affects service design, professional responsibilities and organisational governance.
An AI system introduced into an unclear or poorly controlled process may expose or amplify existing weaknesses rather than resolve them.
A practical agentic AI governance checklist for councils
1. Identify and document AI use cases
Before introducing an AI agent, establish what it is intended to achieve.
Record the relevant service, intended activities, information sources, expected benefits and limitations.
A central inventory can help councils maintain visibility over AI systems used across different departments.
2. Assign responsibility
Each AI deployment should have clear ownership.
This may include a service owner, technical owner, information governance responsibilities and defined escalation arrangements.
Accountability should not become unclear simply because an activity is performed by technology.
3. Assess risks before deployment
A structured assessment should consider risks to residents, employees, organisational information and service delivery.
Potential concerns include incorrect outputs, unauthorised access, unintended actions, bias, security weaknesses and insufficient human review.
Where personal information is involved, data protection requirements should also be assessed.
4. Establish appropriate controls
The level of control should reflect the potential consequences of the agent’s activities.
Controls may include restricted access, approval requirements, monitoring, testing and procedures for suspending or withdrawing a system.
Higher-impact activities may require greater scrutiny than low-risk administrative assistance.
5. Define human oversight
Councils should determine which activities can be performed automatically and which require professional judgement or approval.
For example, an agent may assist with preparing a recommendation, while the decision affecting a resident remains subject to appropriate human review.
Human oversight needs to be meaningful rather than simply a formal approval step.
6. Monitor performance and incidents
Governance does not end when a system becomes operational.
Councils should monitor relevant outcomes, record unexpected behaviour, investigate incidents and review whether controls remain effective.
Risks may change when an agent gains access to new information, tools or workflows.
7. Maintain assurance evidence
Good governance depends on being able to demonstrate that procedures have been followed.
Councils should consider what evidence is needed to show risk assessments, approvals, control reviews, incidents and corrective actions.
Appropriate documentation can support internal audit, management reporting and wider accountability.
Connecting agentic AI governance with existing council risk management
Local authorities do not necessarily need to create an entirely separate governance function to oversee every AI deployment.
Many of the necessary activities already exist within established risk, compliance, audit and information governance processes.
The key is connecting them.
For example:
AI use case → Risk assessment → Risk owner → Controls → Approval → Monitoring → Incident reporting → Corrective action → Assurance
This approach helps avoid situations in which AI policies, risks, incidents and remediation activities are managed separately without a clear picture of their relationships.
How Symbiant Supports Governance and Risk Management Across UK Local Government
Managing governance, risk and compliance (GRC) across a local authority requires more than maintaining individual risk registers. Councils need clear accountability, consistent oversight and reliable information across departments, services and strategic programmes.
Symbiant provides secure, UK-hosted, modular GRC and audit management software designed to support organisations of all sizes, including large, complex public-sector bodies at a price that fits their budget.
The platform connects risk registers, assessments, controls and policies, incident reporting, audit working papers, corrective actions and compliance monitoring within one configurable system. This enables organisations to maintain clear ownership, structured governance records and accessible assurance evidence.
Trusted by Major UK Government Bodies
Symbiant has extensive experience supporting public-sector organisations operating in complex, highly accountable environments.
The platform is used by the UK Health Security Agency (UKHSA), with which Symbiant has worked to develop risk management capabilities aligned with HM Treasury’s Orange Book principles.
Independent feedback from 450 UKHSA users reported:
95% satisfaction or better with the system.
97% satisfaction or better with the support received.
Symbiant is also used by other major UK public bodies, including the Office for Nuclear Regulation, the Oil and Pipelines Agency and CITB.
Supporting Councils and Regional Authorities
Symbiant supports a wide range of UK local authorities, helping councils strengthen governance, risk management, audit and assurance.
A recent example is the North East Mayoral Strategic Authority, which selected Symbiant to support governance, risk and assurance across its regional responsibilities.
The Authority brings together seven constituent council areas: County Durham, Gateshead, Newcastle upon Tyne, North Tyneside, Northumberland, South Tyneside and Sunderland, representing a region of approximately two million people.
Its responsibilities span major regional priorities, including transport, housing, skills, regeneration and economic growth, where effective risk management and accountability are essential.
Symbiant’s wider local-government experience also includes councils such as Glasgow City Council, demonstrating its ability to support different organisational structures, governance arrangements and reporting requirements.
Secure, UK-Hosted and Available Through G-Cloud 15
For public-sector organisations, security, procurement accessibility and flexibility are essential considerations.
Symbiant combines:
UK-based hosting, supported by ISO 27001 and ISO 9001-certified hosting arrangements and Cyber Essentials Plus credentials.
Orange Book-aligned risk management, supporting structured risk ownership, assessments, controls and assurance.
G-Cloud 15 availability, providing eligible public-sector organisations with an established government procurement route.
Role-based permissions and audit trails, supporting controlled access, accountability and traceability.
Modular, configurable functionality, enabling councils to adopt the capabilities they need and expand over time.
UK-based support, training and configuration, helping organisations adapt the platform to their requirements.
As councils explore agentic AI, these established governance processes provide a practical foundation for documenting AI-related risks, assigning accountability, reviewing controls and maintaining evidence of oversight.
Effective AI governance does not need to sit separately from existing risk management. By connecting AI-related risks with wider organisational governance, councils can strengthen oversight while continuing to innovate responsibly.
Explore Symbiant’s GRC Software for Local Government →
AI-Assisted GRC: Combining Intelligent Support with Human Oversight
Symbiant goes beyond traditional GRC management with its AI Assistant, designed to help organisations work more efficiently with their risk, audit and compliance information.
Rather than treating AI as a separate tool, Symbiant brings AI-assisted capabilities into an existing, connected GRC environment.
The AI Assistant can support activities such as:
Risk identification and assessment: Helping users identify emerging risks, analyse risk information and suggest relevant mitigations.
Control analysis: Reviewing control information and identifying potential weaknesses or areas requiring further attention.
Incident investigation: Supporting root-cause analysis and identifying relationships between incidents and existing risks.
Connected risk intelligence: Helping users understand relationships between risks, controls, incidents and other relevant organisational records.
Audit support: Assisting with audit recommendations and corrective-action planning. It can also fins new risks from audit findings and much more.
For councils and large public-sector organisations, this combination can help teams navigate complex governance information, identify relationships and reduce time spent on repetitive analysis, while retaining appropriate human oversight.
Importantly, AI-assisted recommendations support professional judgement rather than replacing organisational accountability.
As public-sector bodies explore agentic AI, the distinction between using AI to support governance and governing autonomous AI systems will become increasingly important.
Symbiant demonstrates how AI can be incorporated into established GRC processes while maintaining a focus on connected information, permissions and human decision-making.
Explore Symbiant’s AI-Assisted GRC Software →
Five questions council leaders should ask before deploying an AI agent
Before approving an AI use case, decision-makers should be able to answer:
What will the agent actually do, and what is it not permitted to do?
Who owns the system and remains accountable for its outcomes?
What organisational and personal information can it access?
Which activities require human review or approval?
How will we identify problems and demonstrate that controls are working?
If these questions cannot be answered clearly, further governance work may be needed before deployment.
Sources
The bigger picture: innovation needs accountable governance
The LGA’s playbook offers a timely reminder that successful AI adoption should not be measured by efficiency alone.
Councils must also consider the quality of decisions, protection of information, confidence of residents and continued importance of professional judgement.
As local authorities explore agentic AI, clear governance arrangements can help them assess opportunities while maintaining accountability.
The objective is not to prevent innovation. It is to make innovation governable.
Explore Symbiant GRC software to learn how connected risk, audit and compliance processes can support public-sector governance.
