Why Public Sector AI Stalls Without Ontology

AI can supercharge how a public sector organization works. But first, it must understand your organization.

AI can do wonders for you

AI is the biggest operational opportunity the public sector has had in a generation.

For example:

• A subsidy claim that does not add up gets flagged before the payment leaves, not six months later in an audit finding.

• A clinic that will run short of a critical medicine in eleven days gets identified while there is still time to move stock.

• A permit application sitting untouched for three weeks, because nobody realized it was waiting on another agency, gets routed appropriately the moment it arrives.

But there is a major hurdle in the way

Here is what happens when you point AI systems at a real government organization:

The same citizen is four different people across your systems. One calls her a beneficiary. One calls her an applicant. One holds a slightly different spelling of her name. One knows her only by a file number. Your real process is not written anywhere a machine can read.

No documentation on who is in charge of what.

AI cannot work around any of this. It inherits it from your systems. Give a capable system a confused picture of your institution and it will act confidently on the confusion.

This has already happened. Between 2016 and 2019, Australia’s welfare agency automatically compared the income people declared to the tax office against the income they had reported for their benefits. The two agencies meant different things by “income”: one a total across a period, the other what was earned in a given fortnight. The system spread the longer-period figure evenly across fortnights and raised a debt wherever the numbers disagreed, which for anyone with irregular work they always would. The onus fell on citizens to prove the debt wrong. 470,000 debts were later found to be unlawful, and the settlement approved in 2021 came to A$1.87 billion. A Royal Commission called it “a crude and cruel mechanism, neither fair nor legal, and it made many people feel like criminals.” It was not even AI. It was one simple rule, acting at scale on a confused picture of two institutions.

The solution is Ontology

No single tool fixes this. Matching four records to one person is entity resolution. Writing the process down as rules is process modelling. Recording who owns what is data governance. What ties them together, in a form an AI system can actually read, is an ontology: one shared model that tells every system what each thing is, where its authoritative version lives, and which rules apply to it.

And public sector data is not like anyone else’s

Public sector data is not simply bigger than enterprise data. It is a different kind of asset, and that changes what an ontology has to do.

The span is unmatched. A single ministry can hold more records than a large bank, built up over decades, across systems never designed to speak to each other. National intelligence. Criminal records. Demographic records. Legal case judgements. Land registries. Health episodes. Tax filings. Permits. Procurement. Subsidy payments.

The value is in a category of its own

And the sensitivity is not uniform. Inside one organization, often inside a single workflow, you have open statistical data, personal data governed by the PDPL, commercially confidential procurement records, and material classified for national security. They sit side by side. One blanket rule cannot govern them.

So an ontology here has to carry classification as a property of the thing itself, not as a permission bolted on at the database. It has to tell an automated system what something is, what it may do with it, who is allowed to see the answer, and any other relevant rules to follow. Get that right and sensitivity stops being the reason you cannot automate.

What is Ontology

An ontology is your institution’s own dictionary and rulebook, written so machines can follow it. Who is a citizen. What is a permit. Who holds authority over each step in a workflow. What actions are permitted.

Think of a brilliant new employee on their first day. Fast, credentialed, genuinely capable. And useless for months, because nobody has told them who owns what, which file is current, or who approves what. Your AI is permanently on day one. An ontology is the induction it never gets.

Why ontology became more important

Until recently, AI mainly drafted and summarized content. A human read the output and corrected it. That person was the control. Then, AI graduated to taking actions. It routes files, flags claims, triggers checks, and prepares disbursements. The checking step is compressed, and in some designs it is gone.

An AI that misreads a field in a report is an inconvenience. An AI that misreads who the beneficiary is, inside a payment process, is an incident with your name on it.

What it takes to build an ontology

It starts with a decision, not a data estate. Pick something your organization cannot do today, and model only the entities that decision touches. Map each one to its real source and settle, in writing, which system is authoritative. Bind classification, access, and mandate into the model itself. Test it against real cases, including the ugly ones your staff handle by exception. Then run it as a living asset, with an owner and version control.

How it works. In practice the ontology sits between the agent and your systems. Every action an agent can take is defined against entities in the model: it looks up a Beneficiary, not a row in a legacy table. Before any action runs, the model is checked. Does this entity’s classification allow this agent and this user to see it? Does the mandate cover this step? Has the prerequisite cleared? If the model cannot answer, the action does not run.

Here is how it goes wrong. Four ways, and they are predictable.

• Teams try to model the whole institution at once. This has been failing since the 1980s and the reasons have not changed.

• Teams model in a room without the people who do the work. What comes out is a diagram the operators do not recognize, describing a process that does not exist.

• Teams treat it as documentation. A well-written PDF is not an ontology. If no system reads it, it is a report.

• Teams buy one off the shelf. A reference model built elsewhere encodes another country’s institutions, another country’s law, and another language’s assumptions about names and dates.

Then there is the skillset, which most programs underestimate. This is not one discipline. You need someone who knows the domain and the regulation at depth. A data engineer who knows what is actually inside your systems, not what the documentation claims. A knowledge engineer who can turn institutional practice into formal structure. And someone who understands how AI agents will consume the result, so the model is built to be executed rather than admired.

An ontology cannot be procured as a document and handed over, because the knowledge it encodes lives with your people, not with a vendor. The only model that works is an embedded one. A small team building it inside the organization, with your staff, transferring the capability to your team as it goes. What you should expect at the end is not a deliverable. It is a running asset, and a team of your own who can extend it and evolve it.

Examples of areas where it pays off

Anything that depends on knowing who someone is. Saudi Arabia’s national registry infrastructure is strong, so the authoritative sources already exist. What is missing is the instruction telling an automated system which source to trust for which question, and in what order. Define that once and every service you build afterward inherits it.

The citizen request that crosses three agencies. Today it moves by people, phone calls, and email. Automating it needs a system that knows which entity owns which step, what clears first, and when to escalate instead of proceeding.

Arabic. Names, transliteration variants, Hijri and Gregorian dates, titles and particles that split one person into three records. عبدالله بن محمد القحطاني appears as “Abdullah Mohammed Alqahtani” in one system, “Abdallah bin Muhammad Al-Qahtani” in another, and “عبد الله القحطاني” with a Hijri birth date in a third. Getting this right is a national requirement. Getting it right first is a national advantage.

What you need to decide

• Select a use case, with a quantified value on it. Not “improve data readiness.” Something specific like cutting license issuance from nine weeks to one, or flagging ineligible claims before payment rather than after. If you cannot put a number on the use case, it is not ready to fund.

• Make classification a design input. Your security function sits in the modeling sessions, not in a review gate at the end. Where personal and classified material sit side by side, retrofitting this is not a delay. It is a rebuild.

• Name an ontology owner at leadership level. With change control, versioning, and a budget line. Treat it the way you treat any other critical governed asset.

• Set one hard gate. No agent reaches production acting on an entity that is not in the model. One rule, enforceable, and worth more to your risk posture than any policy document.

The asset nobody can sell you

Every institution already has an ontology. It lives in the minds of people who have been there fifteen years and know which record is real, who signs, and what the circular actually meant. It is among the most valuable assets your organization owns, and the only one with no backup. When those people retire, move internally, or leave the organization, it leaves with them.

Writing it down is not a technology project. It is institutional memory made durable, and usable by machines at the same time. Which is also why nobody can sell it to you. This is the rare national capability that cannot be imported, cannot be copied, and once built, belongs entirely to you.

And start small. The people who carry your ontology today will not stay in that role always. Begin with one decision, one model, and one rule: no agent acts on anything the model does not know.

The mandate is here. The funding is here. The regulation is here. The decision is yours.