Why country-level digital authorities need to govern architecture, resilience, data, AI and third-party dependency as one risk system

Digital government is not an IT programme

Governments are digitising identity, taxation, payments, public services, health records, licensing, border systems and increasingly artificial intelligence. The tendency is to treat each initiative as a technology programme. At country level, that is too narrow.

Digital transformation changes the state’s operating model. It creates new dependencies between agencies, citizens, infrastructure providers, cloud platforms, identity systems, data exchanges and algorithms. The resulting risks are strategic, operational, legal and reputational as much as they are technological.

A national digital authority should therefore be designed less as the government’s IT department and more as a risk orchestrator for the digital state.

Its core question should be familiar to any enterprise risk function: what could prevent the state from achieving reliable, secure, inclusive and trusted digital government?

The evidence: advanced governments still struggle with execution

Recent European experience is useful because it shows that these are not problems confined to less mature states. Europe has some of the world’s most developed digital regulation, yet its own experience illustrates the gap between regulatory design and operational execution.

The OECD’s Digital Government Outlook 2026 concludes that governments have made substantial progress in building strategies, frameworks and digital foundations, but that implementation remains inconsistent. It describes a persistent gap between formal policy architecture and the day-to-day systems, skills, procurement practices and accountability mechanisms needed to make digital government work at scale.[1]

Cybersecurity offers a concrete example. EU Member States were required to transpose the NIS2 Directive into national law by 17 October 2024. In May 2025, the European Commission issued reasoned opinions to 19 Member States for failing to notify full transposition.[2] The lesson is not that the framework was weak. It is that regulation and implementation are separate risks.

The operational threat also remains substantial. ENISA reported in 2025 that public administration accounted for 38% of incidents in its latest EU threat landscape and assessed the sector as remaining in a cyber ‘risk zone’ while resilience requirements were still being embedded.[3] Compliance, therefore, cannot be confused with resilience.

Artificial intelligence creates another tension. Europe chose a risk-based AI framework, but in 2026 it adjusted implementation timelines and simplified parts of the regime through the AI Omnibus. The revised approach retained safeguards while responding to implementation readiness, standards and administrative burden.[4] That is an important governance lesson: good digital regulation must be risk-based, but it must also be adaptive.

Third-party dependency is emerging as another systemic issue. Under the Digital Operational Resilience Act, European supervisory authorities formally designated critical ICT third-party providers after assessing their systemic importance, support for critical functions and substitutability.[5] This reflects a reality every government now faces: the state may own a public service while depending on infrastructure it does not control.

The risk is even harder in fragmented digital states

The challenge becomes more difficult in large emerging economies with devolved government, uneven institutional capacity and rapidly expanding digital services.

Such countries may already possess sophisticated identity systems, digital banking, tax platforms, telecom infrastructure and provincial or municipal applications. The weakness is often not absence of technology. It is fragmentation.

Strong systems develop independently inside ministries, regulators and regions. Each may perform well in isolation, while the state as a whole accumulates incompatible architecture, duplicated data, inconsistent cybersecurity controls and overlapping regulation.

Digital islands of excellence do not automatically create a coherent digital state.

This is where a country-level digital authority becomes essential. Its purpose should not be to build every application or centralise every decision. Its purpose should be to establish the common control environment within which the digital state operates.

What should a national digital authority actually govern?

The starting point should be a national digital risk taxonomy. Technology choices should be assessed through a common set of risk lenses:

• Strategic and investment risk – whether digital spending advances national objectives and produces measurable public value.
• Architecture and interoperability risk – whether agencies are building systems that can exchange data and share trusted digital building blocks.
• Cyber and operational resilience risk – whether critical services can withstand attack, continue operating and recover within defined tolerances.
• Data and privacy risk – who owns data, who may use it, how its quality is controlled, how long it is retained and what remedies citizens have.
• AI and model risk – where automated decisions require testing, explainability, human accountability and appeal mechanisms.
• Third-party and concentration risk – dependence on cloud, software, telecom and technology providers, including portability and credible exit plans.
• Human-capital risk – whether government has enough internal expertise to challenge vendors and supervise complex platforms.
• Conduct and trust risk – whether a legally compliant digital service can still undermine confidence because it is opaque, exclusionary or difficult to challenge.

Once those risks are defined, ownership becomes clearer. Operating agencies own the risks they create. The national digital authority sets standards, monitors cross-government exposure and challenges implementation. Independent audit, regulatory and legislative oversight provide assurance.

The regulatory architecture should be principles-based, but not vague

A credible digital-governance regime needs more than a cybersecurity law or data-protection statute. It needs an integrated architecture covering at least five areas.

• Enterprise architecture and interoperability: mandatory standards for APIs, identity, data definitions and shared digital infrastructure.
• Cybersecurity and resilience: minimum controls, incident reporting, critical-system classification, recovery objectives and periodic testing.
• Data, privacy and digital identity: lawful use, access, correction, retention, authentication, biometrics and accountability for misuse.
• AI governance: risk classification, testing, transparency, human oversight and stronger controls where decisions can materially affect rights or access to public services.
• Third-party technology risk: due diligence, concentration monitoring, data portability, substitution planning and exit arrangements for critical providers.

The regulatory intensity should increase with potential harm, systemic importance and difficulty of reversing failure. A government information website should not be regulated like a biometric identity system. An AI chatbot should not be treated like an algorithm determining eligibility for a benefit.

Measure resilience, not just digitisation

Governments frequently measure digital progress by counting services moved online. That is useful, but insufficient.

A mature national dashboard should also track availability of critical services, recovery performance, cyber incidents, data-quality failures, vendor concentration, legacy-system retirement, identity fraud, privacy breaches, interoperability, AI exceptions and the proportion of critical systems independently assured.

That changes the central question from ‘How much government have we digitised?’ to ‘How safely, reliably and effectively does the digital state operate?’

The objective is not more technology. It is trusted state capacity.

Digital government ultimately depends on trust. Citizens must trust digital identity and the use of their data. Agencies must trust shared information. Regulators must trust the integrity of systems. Government must trust that critical services will remain available during disruption.

The European experience is instructive precisely because it shows that there is no final state called ‘digitally mature’. Even advanced governments continue to recalibrate AI rules, implement cybersecurity obligations, improve interoperability and manage technology concentration.

Digital governance is not a one-time transformation programme. It is a continuous enterprise risk discipline.

Technology determines what government can do. Governance determines what it should do. Risk management determines whether it can continue doing it when something goes wrong.

For a country-level digital authority, that is the real mandate: not simply to accelerate digitalisation, but to build the enterprise-risk architecture that makes the digital state resilient, interoperable and trusted.

Sources and further reading

[1] OECD (2026), Digital Government Outlook 2026: From Foundations to Transformational Impact.https://www.oecd.org/en/publications/digital-government-outlook_0496b2bc-en/full-report.html

[2] European Commission (7 May 2025), Commission calls on 19 Member States to fully transpose the NIS2 Directive.https://digital-strategy.ec.europa.eu/en/news/commission-calls-19-member-states-fully-transpose-nis2-directive

[3] ENISA (6 November 2025), Public administration increasingly targeted by DDoS attacks.https://www.enisa.europa.eu/news/public-administration-increasingly-targeted-by-ddos-attacks

[4] European Commission (2026), AI Omnibus enters into force.https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force

[5] European Banking Authority / European Supervisory Authorities (18 November 2025), Designation of critical ICT third-party providers under DORA.https://www.eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital

[6] ENISA (2025), ENISA Threat Landscape 2025.https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025

[7] European Commission (2026), AI Act – A Risk-based Approach.https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

Originally published on LinkedIn, 16 September 2026.