Federal agencies must move beyond periodic security reviews and adopt continuous risk management practices to keep pace with the rapid evolution of artificial intelligence, according to Bill English, chief information officer (CIO) and chief AI officer (CAIO) at the General Services Administration (GSA) Office of Inspector General (OIG).

Speaking at MeriTalk’s Shift Happens event in Washington, D.C., English said traditional annual assessments are no longer sufficient for evaluating AI systems that can change significantly within weeks or months.

Instead, he called for a government-wide shift toward continuous AI governance and risk awareness. English emphasized that managing AI risk cannot be left solely to cybersecurity teams. He said agencies need broader participation, including executive leadership and employees across the organization, to ensure AI is implemented, governed, and secured responsibly.

He also pointed to President Donald Trump’s recent executive order on AI, which directs federal agencies to strengthen cybersecurity programs and expand the use of AI-enabled defensive tools. According to English, the mandate is driving agencies to rethink their security strategies as AI capabilities continue to advance.

While encouraging agencies to embrace innovation, English urged a balanced approach. He recommended moving quickly in low-risk areas while exercising greater caution in applications that directly affect citizens or involve high-impact decisions.

He also highlighted back-office functions such as case summarization, knowledge search, and procurement support as areas where AI can deliver immediate value. At the same time, he cautioned that agentic AI remains immature and should not yet be trusted to make complex decisions without human oversight.