Shipping AI into the Public Sector
Most AI writing sits at one of two extremes: the demo that impresses, or the responsible-AI principles that never touch a deployment. This series lives in the gap between them. Access, least-privilege, data residency, evidence and content are the work nobody demos, and they are what stands between a prototype everyone liked and a service citizens can actually use. Drawn from a real public-sector delivery, anonymised throughout.
9 articles
- Part 1The demo is not the deliveryA prototype proves the idea. It proves almost nothing about deployment, identity, data residency or who operates the thing on a Tuesday — and that gap is the actual project.6 min read
- Part 2Spec-driven development with an AI coding agentWe built the real thing with an AI coding agent. What made it work was not the code generation — it was making the specification the source of truth, and writing the guardrails down where the agent could not quietly drift past them.7 min read
- Part 3The access gauntlet nobody demosThe code was ready days before we could deploy it. The blocker was not engineering — it was a chain of cloud-access approvals, each one a fresh round-trip to a different person.7 min read
- Part 4Least-privilege as codeJust give the pipeline Owner is how breaches happen. Here is the tighter way that still ships — and why, under POPIA, least-privilege is an architecture requirement rather than a security preference.8 min read
- Part 5Where is your AI actually allowed to run?The hardest question about our AI feature was not technical. It was whether the data included personal information — and therefore which country the model was allowed to run in.8 min read
- Part 6Evidence-first deliveryOn a funded, milestone-based programme the deliverable is not just working software. It is proof that it works, captured while the run is still green.6 min read
- Part 7Content is the critical pathWe could build every screen. But a citizen portal is only as good as the content behind it — and that content is owned by people who do not work for the delivery team.6 min read
- Part 8Translating tech blockers for the people who sign offA decision sat unmade for weeks — not because it was hard, but because it had never been framed in language the people with the authority to make it could act on.6 min read
- Part 9What shipping regulated AI actually takesEight articles, one delivery, and the pattern underneath them: the work that decides whether AI reaches production is almost never the AI. Here is the whole arc, and the checklist that goes with it.7 min read
Working through any of this in your own organisation?
These articles come out of delivery work rather than theory. If the problems in this series look familiar, a short scoping conversation is usually the quickest way to work out what is worth doing first.
Talk to CloudNala