← Governance Research Brief

Governance Research Brief · Edition 2 · 11 September 2026

Government dependence on suppliers, infrastructure and records

The Dependencies Government Must Govern

Six recent publications show where public institutions in Kenya and across the Global South can lose practical control of suppliers, systems, records and recovery. They cover artificial intelligence (AI), digital sovereignty, social protection, the Programme for International Student Assessment (PISA) and public recruitment.

Ahmed Nadhir Omar

Published · 14-minute read · Six research readings

Contents

At a glance · 3-minute read

Supplier dependenceCritical public functions must be mapped against the models, cloud services and jurisdictions on which they depend.
Records and recoveryPublic control requires records sufficient to reconstruct automated actions, system failures and human overrides.
Fiscal exposureFiscal planning must account for the effects of changing work and income on contributions and services.
Public scrutinyPublic judgement depends upon citizens being able to weigh evidence and contest administrative claims.

Across six publications—four published from 5 to 11 September and two published 8–30 days earlier—the same administrative risk emerges: acquiring technology can create dependencies that public institutions cannot readily inspect, recover from or replace.

A government may retain legal authority while losing practical control if it cannot replace a supplier, recover after an incident, inspect the evidence behind an automated action or finance the social consequences of economic change. Public judgement also depends upon citizens having the capacity to distinguish evidence from confident fabrication.

For Kenya, procurement, cybersecurity, fiscal planning, education and devolution must therefore be considered together. National standards require county readiness, named responsibilities and recovery arrangements that can function under actual service conditions.

Decision test

Can the institution identify, govern and replace each dependency before it becomes indispensable?

Evidence base

The six publications brought together in this edition

Four were published from 5 to 11 September 2026. Two others, published on 13 August and 3 September, were retained because they sharpen the questions raised by the week's evidence. Each contributes a distinct part of the argument.

AI security and public accountabilityDetecting and countering misuse of AI: September 2026Anthropic · 10 September 2026Frontier access and sovereign capabilitySovereign by necessity? Frontier AI export controls, cyber security, and the limits of national AI capabilityAlan Woodward and Andrew Rogoyski · 13 August 2026Supplier dependence and operational controlDigital sovereignty: From policy ambition to executive imperativeCapgemini Research Institute · 8 September 2026Fiscal resilience and social protectionFinancing of Social ProtectionOrganisation for Economic Co-operation and Development (OECD) · 9 September 2026Evidence literacy and public judgementPISA 2025 Results, Volume I: Future-Ready StudentsOrganisation for Economic Co-operation and Development (OECD) · 8 September 2026Automated recruitment and administrative fairnessFrom Matching Models to Recruiting Agents: A Systematized Narrative Review of AI Recruitment Systems, Evaluation, and GovernanceZiyi Zhao and Guanzheng Wei · 3 September 2026

AI security and public accountability

Detecting and countering misuse of AI: September 2026

Anthropic · 10 September 2026

What the research says. Anthropic documents cases detected between December 2025 and August 2026 involving cyber operations, surveillance, influence, fraud and other harms. Several cases show AI moving from advisory assistance into the orchestration of reconnaissance, exploitation and data exfiltration. One intrusion reportedly exposed more than 300,000 national identity records and commercial registry information concerning over half a million companies.

Limit of the evidence. These are selected company cases chosen for novelty and seriousness, rather than a representative measure of all misuse.

Why this matters for public institutions

KenyaContracts covering identity, health, tax, payment and land systems need usable logs, rapid incident reporting, evidence preservation and tested recovery arrangements. Shared platforms require clear national and county responsibilities.
Global SouthAI is reducing the expertise and labour needed for sustained intrusion. Governments with thin defences may also depend upon foreign providers for the intelligence needed to understand those threats.
Wider implicationsModel companies increasingly possess security evidence that public authorities cannot observe independently. Common disclosure standards and public scrutiny are becoming necessary.

Frontier access and sovereign capability

Sovereign by necessity? Frontier AI export controls, cyber security, and the limits of national AI capability

Alan Woodward and Andrew Rogoyski · 13 August 2026

What the research says. The authors argue that access to frontier AI is becoming part of national cyber capability while remaining concentrated among firms subject to a few supplier states. Since access can be withdrawn, technological dependence can become a security exposure. They propose access guarantees, locally controlled inference, open-weight models, pooled regional capability, talent development and basic cyber resilience.

Limit of the evidence. This is a strategic analysis with practical proposals, rather than an empirical test of the proposed arrangements.

Why this matters for public institutions

KenyaA sovereignty strategy should identify public functions that cannot tolerate the withdrawal of model access, cloud capacity or technical support. Counties need tested fallbacks where they rely upon shared national systems.
Global SouthRegional compute and shared evaluation capacity offer a credible course between complete dependence and financially unrealistic national self-sufficiency.
Wider implicationsExport controls are turning access to advanced models into an instrument of state power. Continuity of access now belongs within AI governance.

Supplier dependence and operational control

Digital sovereignty: From policy ambition to executive imperative

Capgemini Research Institute · 8 September 2026

What the research says. A survey of 1,300 executives finds that 59 per cent regard complete digital sovereignty as unrealistic. The report recommends managed interdependence, under which organisations identify critical dependencies, preserve control over essential assets and improve their ability to change suppliers.

Limit of the evidence. The sample centres upon large organisations, and the publisher is itself a technology services firm.

Why this matters for public institutions

KenyaSovereignty can be made operational through portability requirements, switching assistance, audit rights, continuity provisions and defined recovery times. Responsibilities between vendors, national operators and counties must be explicit.
Global SouthManaged interdependence is more attainable than complete autonomy, although it requires stronger bargaining power, procurement competence and technical capacity.
Wider implicationsThe report shifts attention from where infrastructure is located to whether an organisation can inspect critical dependencies, retain operational control and replace a supplier in time.

Fiscal resilience and social protection

Financing of Social Protection

Organisation for Economic Co-operation and Development (OECD) · 9 September 2026

What the research says. The report examines pressures arising from ageing, non-standard employment and technological change. Social contributions financed 43 per cent of OECD social expenditure in 2023, compared with 47 per cent in 1995, while general-revenue financing expanded.

Limit of the evidence. Its evidence concerns Organisation for Economic Co-operation and Development and European Union systems and therefore requires local fiscal analysis before application elsewhere.

Why this matters for public institutions

KenyaHealth and social protection reforms cannot assume that stable payroll employment will provide an adequate contribution base. Informal earnings and automation affect national financing, transfers and county service obligations.
Global SouthContribution-based systems can exclude the people most exposed to economic disruption. Digital enforcement cannot resolve low or irregular incomes.
Wider implicationsIf technological change reduces labour income or accelerates job reallocation, governments may need to reconsider who finances social protection.

Evidence literacy and public judgement

PISA 2025 Results, Volume I: Future-Ready Students

Organisation for Economic Co-operation and Development (OECD) · 8 September 2026

What the research says. The 2025 PISA cycle included more than 760,000 students in 91 countries and economies. Reading performance declined sharply. Across OECD countries, 46 per cent of students reported both checking source credibility and placing greater trust in scientific evidence than in common sense.

Limit of the evidence. The cited OECD averages do not include Kenya and should prompt local investigation rather than substitute for it.

Why this matters for public institutions

KenyaSource evaluation and AI literacy belong among the civic capabilities developed through schools, teacher preparation, county libraries and public information services.
Global SouthUnequal teaching capacity and access may turn AI literacy into another dimension of educational inequality, particularly in multilingual information environments.
Wider implicationsTrustworthy administration depends partly upon citizens possessing the ability to assess official claims, scientific evidence and synthetic content.

Automated recruitment and administrative fairness

From Matching Models to Recruiting Agents: A Systematized Narrative Review of AI Recruitment Systems, Evaluation, and Governance

Ziyi Zhao and Guanzheng Wei · 3 September 2026

What the research says. A review of 40 representative works traces recruitment technology from matching tools towards agents that retrieve evidence and support actions throughout a multi-stage process. Final-output scores can conceal earlier failures, and no study within the coded set jointly evaluates utility, fairness, privacy and security.

Limit of the evidence. The purposive review is a structured synthesis, rather than a prevalence estimate for the field.

Why this matters for public institutions

KenyaPublic Service Commission and county public service board procurements should examine sourcing, screening, assessment, human handover, records and reasons.
Global SouthImported systems may embed assumptions derived from different labour markets and formal qualifications, deepening existing inequalities.
Wider implicationsAccountability must follow the complete workflow, including where evidence enters, where uncertainty is lost and who retains authority to intervene.

Three questions for policy work

  1. What would remain operational after a supplier withdrawal or major cyber incident? Kenya needs named substitutes, tested exit arrangements and clear national-county recovery responsibilities.
  2. Which public body can reconstruct an AI-assisted action? Logs, evidence and responsibility must remain available across vendors, software interfaces and shared platforms.
  3. Are public finances and civic capabilities being prepared for the same technological transition? AI-enabled government will require sustainable social protection and citizens capable of judging evidence.

When government cannot identify a system's dependencies or reconstruct its actions, formal authority offers little protection. Public control requires a clear map of these dependencies, staff who can assess them and a workable route to replace them.

The six sources

This edition distinguishes the claims made by each publication from the independent conclusions drawn for Kenya and the Global South. The publications provide international evidence and comparison; the governance conclusions remain specific to the institutions concerned.