Audit Finds East Lothian Council Lacks Cyber Strategy and AI Policy, With Plans to Grow AI Governance
Audit reveals no formal cyber strategy or AI policy, with plans to expand AI governance by 2027.
What happened
An internal audit reviewed East Lothian Council’s cyber controls and found no overarching cyber strategy or formal AI governance policy. It rated cyber arrangements as 'reasonable assurance' but noted gaps and resource constraints.
Why it matters
The finding highlights the need for formal governance as AI use grows in local government, showing how gaps can affect risk management and service resilience.
The audit describes a council that relies on standard security measures,encryption, device management, and monitoring,without a council-wide plan to steer priorities or align limited resources with the most significant risks. It notes that cyber threats remain a priority and that the council has begun to map these risks, but the absence of an AI policy suggests a lag between risk awareness and governance structures.
Auditors also flagged that resource constraints within the cybersecurity team have burdened staff and could hinder strategic planning. Management has agreed to add roles and to develop an AI policy and risk assessment into existing tech review processes by 2027, signaling a shift toward more formal governance without yet guaranteeing comprehensive coverage across all council activities.
What this does not tell us
The assessment reflects a single internal audit of one council and may not capture broader practices or recent changes at other authorities.
FOR PEOPLE
Benefits reportedThe article describes governance actions that expand human capacity to oversee AI and policy development.
FOR AI AND ITS OPERATORS
Benefits reportedThe article notes plans to build AI policy and risk assessment processes, indicating expansion of AI governance capability.
These are two separate readings of what the sources describe. Reported claims and risks do not by themselves establish a real-world effect.
Original sources · 1
- East Lothian Council lacks cyber strategy and AI policy, audit finds ↗FutureScot · 2026-10-16
Reporting discovered in United Kingdom. Discovery market does not mean the event happened there.
What is your take?
Ask a question, add useful context or share a different perspective. Keep the conversation respectful and grounded.