The State's AI Capability Gap is a National Security Liability

As Research Scholar at Stanford's Center for International Security and Cooperation (CISAC), I examined how AI integration reshapes institutional capacity across OECD countries. A critical vulnerability emerged: governments excel at producing AI strategies and regulatory frameworks, but struggle to build and maintain the technical systems those policies require.

Canada's Global Public Health Intelligence Network (GPHIN), a 24/7 early warning system for potential public health threats worldwide, illustrates the consequences. An independent federal review and subsequent oversight reports found one of the first global AI-enabled epidemic intelligence systems chronically understaffed, technically outdated, and institutionally marginalized when COVID-19 emerged (Government of Canada Independent Panel Report, 2021). The government had built early innovation but lacked sustained capacity to maintain it. Critical warning capabilities degraded at the moment they mattered most.

This pattern extends beyond health surveillance. The question isn't whether governments should use AI—the OECD's 2024 Inventory of Tax Technology Initiatives (ITTI) shows 29 of 38 member states already deploy AI in tax enforcement, including fraud detection, risk scoring, and taxpayer services. It's whether they're developing internal capability to govern what they're deploying, or remaining dependent on external expertise to understand systems reshaping core state functions.

In my recent analysis, I examined how earlier European Commission interoperability monitoring found 72% policy alignment but only 45% implementation success—a capability deficit, not a policy failure. But skills development alone is insufficient. Governments must build AI systems themselves.

Three Sovereign Use Cases Governments Must Own

Building capability requires direct engagement in strategic domains where government data, scale, and mandate create advantages private vendors cannot replicate:

Tax enforcement as capability foundation. The UK's HMRC Connect system ingests vast datasets—tax returns, bank data, property records, customs data—to generate sophisticated data-mining and risk scores for potential non-compliance (IFA, Clever Accounts). Connect has operated for over a decade as one of the most mature government data-centric systems used for compliance. Canada's Revenue Agency provides a complementary case: the Charlie virtual assistant launched in March 2020; by March 2024, Charlie had handled over 12.5 million questions across 4.5 million conversations (Canada.ca). Tax AI forces governments to learn at scale: data engineering, iterative model tuning, operational risk, and human–machine escalation.

Immigration and high-stakes service delivery. The US Citizenship and Immigration Services operates Emma, a bilingual AI virtual assistant answering questions about immigration benefits with escalation to human agents (USCIS). In high-consequence domains like immigration, governments learn critical lessons about accuracy requirements, appeal mechanisms, and when automation must defer to human judgment—lessons that cannot be outsourced.

Cross-ministry service orchestration. Finland's AuroraAI program uses AI to recommend service "chains" around life events—starting school, losing a job, launching a business—connecting public and private offerings through ML-enabled personalization (UN DESA, OECD OPSI). Estonia's Bürokratt creates a state-wide AI assistant layer—effectively a "digital civil servant"—capable of interacting across agencies using natural language understanding (e-Estonia, RIA). These systems demand deep internal expertise in APIs, data standardization, NLP pipelines, and human-in-the-loop design.

Why Direct Development Builds Regulatory Competence

When Estonia built Bürokratt, civil servants learned how to structure government APIs for AI consumption, manage multilingual natural language processing, and balance user privacy with service personalization. When Singapore scaled Ask Jamie across 70+ agency websites handling millions of citizen questions (GovTech Singapore), they discovered which queries required human escalation and how to refresh ML models as citizen needs evolved. This hands-on experience produces institutional fluency consultants cannot provide.

The counterexamples are instructive. The US Department of Defense's attempt to replace its Defense Travel System with MyTravel (a commercial SaaS solution) represents a recent high-profile failure. Congressional oversight in 2023 cited low adoption, integration challenges in an environment with over 400 financial management systems, and an annual price tag of around $44 million alongside the decision not to exercise the next contract option—not because the commercial software was defective, but because DoD lacked internal capacity to align systems and governance around it (House Oversight). Healthcare.gov's 2013 launch disaster followed the same pattern—outsourced development without sufficient in-house technical capacity to evaluate vendor work or manage system integration (GAO).

The twelve skills I outline in The Platinum Workforce—adaptive capacity, interpretive fluency, interoperability expertise—apply directly to institutional AI capability. These capabilities develop through practice, not procurement.

The Dual Role Dilemma

Yet building government AI capacity creates fundamental tension. Governments must simultaneously develop ML applications, regulate private sector AI deployment, and increasingly compete in strategic AI development. This triple mandate produces conflicts that will intensify.

Consider the current US administration's framing of AI as a competitive race to "win." When governments view ML primarily through a national security lens—which they should, given military applications, critical infrastructure dependencies, and economic implications—the regulator role conflicts with the competitor role. How does an agency objectively regulate technologies it's desperately trying to advance for strategic advantage?

European approaches emphasize AI governance and ethical frameworks, producing comprehensive regulation like the EU AI Act. Yet European governments lag in technical capability development, creating a different imbalance—sophisticated regulation without the institutional fluency to implement it effectively. Regulation cannot enforce what institutions lack capacity to execute.

The Nordic model—Estonia and Finland—offers a more balanced approach, combining strong privacy norms with internal ML development. Yet even they face sustainability challenges as commercial AI accelerates and government development cycles remain constrained by civil service structures.

The Hyperefficient State

What happens when governments become genuine AI leaders rather than perpetual followers?

Singapore's whole-of-government digital infrastructure already demonstrates one possibility—coordinated service delivery, proactive citizen engagement, and data-driven policy iteration at national scale. Extend this trajectory: imagine governments where ML systems continuously optimize resource allocation across health, education, infrastructure, and social services. Where predictive models anticipate emerging needs before crises develop. Where administrative processes require minimal human intervention for routine matters, freeing civil servants for complex judgment.

This isn't science fiction. The technical capabilities exist. Estonia's X-Road data exchange layer, combined with Bürokratt's AI orchestration, moves toward this vision. The UAE's announcement that its National AI System will serve as advisory member to the Cabinet starting in 2026 (The National) signals governmental willingness to integrate AI into core decision-making.

But hyperefficiency isn't neutral. It raises urgent questions about democratic accountability, transparency in automated decision-making, and whether optimization for efficiency conflicts with resilience, redundancy, and the deliberative slowness democracy sometimes requires.

The Path Forward

The choice facing governments isn't whether to engage with AI—that ship sailed. It's whether they'll develop the institutional capacity to guide AI's integration into governance, or whether they'll remain perpetually dependent on external expertise to understand systems reshaping their core functions.

The cost of building internal ML development capacity must be weighed against the alternative: attempting to regulate technologies governments fundamentally don't understand, producing either ineffective oversight or counterproductive restrictions.

In a forthcoming piece, I'll examine how the hyperefficient state model scales from Singapore and Estonia to larger, more complex democracies—and whether democratic governance survives that transition intact.

For now, the imperative is clear: governments must build, not just buy. The alternative is governance by ignorance, regulation by confusion, and strategic disadvantage in the defining technology competition of the century.