DIR Discover 2026: 3 Public Sector Data Governance Lessons
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
On October 6th, 2026, the Texas Department of Information Resources (DIR) brought public sector IT and data professionals to the Palmer Events Center in Austin, TX for DIR Discover 2026: Exploring Data and Tech. Attendees came from state agencies, local governments, and public education, and the agenda ran from what’s next in AI to building smarter with data and modernizing government technology.
AI was on the agenda, but data was the conversation. At The Modern Data Company booth, almost every discussion that started with AI ended up somewhere underneath it: who is allowed to see the data, where it came from, and whether the rules that govern it still hold once a machine is the one asking.
Three themes came up consistently: governance, lineage, and access. None of them are new. What’s new is that AI turns each one from a back-office task into a front-line requirement. A human analyst can work around a gap in governance or a missing piece of lineage. An AI system can’t, and it moves too fast for anyone to catch the problem after the fact.
Why Did Data Dominate the AI Conversation in Austin?
Texas has been building its data governance framework one legislative session at a time. According to DIR’s data governance legislation timeline, the state has added:
- 2015: a State Chief Data Officer and a central repository for publicly accessible data.
- 2017: agency Data Management Officers and the Data Management Advisory Committee.
- 2019: data classification, security, and retention requirements for IT projects, plus publishing to the Texas Open Data Portal.
- 2021: a Statewide Data Coordinator and the Texas Statewide Data Exchange Compact.
- 2023: agency data maturity assessments submitted to DIR.
On January 1, 2026, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA) added an AI layer on top. Among other provisions, it requires government agencies to tell people when they are interacting with an AI system, and it bars government use of AI for social scoring.
So, the policy exists. What attendees kept asking is whether it holds when the consumer of the data is no longer a person. National research suggests the concern is well placed. In a NASCIO and EY study of 46 states, only 22% had a dedicated data quality program, and 72% described their approach to data quality as reactive or merely aware. The Modern Data Report 2026 found that 68% of data leaders and practitioners say their data isn’t trustworthy enough for AI to act on directly.
A decade of governance policy is a real head start. AI is now testing whether that policy is enforced or only written down.
Theme 1: Governance Has to Be Enforced, Not Just Documented
The governance question we heard most often went something like this: “We have a data governance policy. How do we know an AI tool will follow it?”
In most agencies, governance lives in documents: classification schemes, data sharing agreements or retention schedules. Enforcement happens through people. A Data Management Officer approves a request. An analyst knows which columns hold sensitive data and leaves them out of a report. A program manager remembers that one dataset can’t be combined with another.
AI takes those people out of the loop. An AI assistant answering a caseworker’s question doesn’t read the data sharing agreement. It reads whatever the system lets it reach. That matters more in government than almost anywhere else, because public data carries overlapping rules. Criminal justice information (CJIS), protected health information (HIPAA),
federal tax information (IRS Publication 1075), and student records (FERPA) each come with their own access and handling requirements.
For AI, public sector data governance has to be machine-readable and enforced at the point of use. Classification, quality checks, and usage policy need to be attached to the data itself, so they apply the same way whether the request comes from an analyst, a dashboard, or an AI agent.
If a policy only lives in a PDF, no AI agent has ever read it.
Theme 2: Lineage Is the Audit Trail for Every Automated Decision
The lineage question was about time: “If a legislator or an auditor asks where that number came from, how fast can we show them?”
In government, answers are public by design. Figures end up in budget requests, legislative testimony, audit reports, and responses under the Texas Public Information Act. Lineage, the record of where data came from and how it changed along the way, is what lets an agency defend a number instead of just reporting it.
AI raises the bar. When an AI system drafts a recommendation or flags a case, the agency needs to show which data informed it, which version of that data, what transformations it went through, and which policy applied when it was used. TRAIGA’s disclosure requirement tells people when AI is involved. Lineage is what lets an agency explain what the AI actually did.
Federal agencies are working through the same gap. In a March 2026 Market Connections survey of more than 200 federal IT executives, nearly 90% said they require logging and audit trails for agentic AI. Fewer than a third had implemented the oversight frameworks, most of them called essential. The cost shows up in daily work, too: The Modern Data Report found that finding the right data (89%), validating it (74%), and understanding its context (71%) are the most time-consuming parts of working with data.
Lineage you reconstruct after the question is asked isn’t lineage. It’s forensics.
Theme 3: Access Has to Be Shared Without Being Surrendered
The access question had two halves: “How do we let an AI assistant, or another agency, use our data without handing over everything?”
Texas programs cross agency and jurisdiction lines all the time. Workforce, health and human services, education, and public safety programs depend on data held by someone else, often at the state, county, and city level at once. The Statewide Data Exchange Compact exists because that sharing is necessary. In practice, though, access tends to be all or nothing. An agency signs an agreement and sends a full extract, or it doesn’t share at all. Every copy becomes one more dataset to secure, reconcile, and account for by an agency.
AI agents add a new kind of user to that picture. An agent working on behalf of a caseworker should see exactly what that caseworker is allowed to see, for the purpose they’re allowed to see it, and nothing more. That calls for fine-grained, attribute-based access: permissions based on who is asking, why, and how the data is classified, checked at query time rather than granted once and forgotten. It’s the same principle behind the data pillar of the CISA Zero Trust Maturity Model.
An AI agent should never be able to see more than the person it’s working for.
What Connects Governance, Lineage, and Access?
Seen together, the three themes are one problem viewed from three sides. Each is context that should travel with the data but usually lives somewhere else: a policy document, a ticketing system, a data steward’s memory. When the data moves into a dashboard, another agency, or an AI agent, the context stays behind.
In our recent article on data readiness for AI, governance sits at stage four of a seven-stage path to AI-ready data architecture. The conversations in Austin showed where Texas agencies feel that stage most: enforcing policy, proving provenance, and controlling access once machines join the workflow.
The fix is to stop treating context as documentation and start treating context as infrastructure.
How DataOS Does This
DataOS® for Public Sector is built around data products: governed, semantically defined datasets built for a specific use, with definitions, lineage, ownership, and access policy built in. Because the context is part of the data product, it goes wherever the data goes.
- Governance: classification, quality checks, and usage policy are defined once and enforced for every consumer, without duplication or rework.
- Lineage: each data product carries its sources, transformations, and versions, so an agency can trace an output back to the data behind it.
- Access: attribute-based policies are checked at query time, so an analyst, a dashboard, a partner agency, and an AI agent each see only what they are entitled to.
DataOS layers over existing systems rather than replacing them, so mainframes, case management systems, and warehouses stay in place. That matters when budgets run on legislative cycles and legacy systems can’t be switched off. For Texas agencies, DataOS is available through DIR-CPO-5687, as well as Carahsoft, NASA SEWP V, ITES-SW2, and NASPO ValuePoint, and supports agency TX-RAMP Level 2, CJIS, and NIST SP 800-171 requirements.
When context travels with the data, the AI conversation can get back to the mission.
Five Questions to Take Back to Your Agency
If the themes from DIR Discover sounded familiar, start with five questions. A “no” marks where to focus first.
- Governance: Is our data classification enforced by the system, or by people remembering it?
- Governance: If an AI tool queried our data today, would it face the same policies as an analyst?
- Lineage: If an auditor asked which data informed an automated output, could we show the sources, transformations, and policy in under a day?
- Access: Can we share a subset of data with another agency without sending a full copy?
- Access: Do our AI agents have their own scoped identities, or do they inherit broad service-account access?
To score your agency against a broader benchmark, take the AI Readiness Scorecard. Most AI accuracy and governance problems trace back to data that was never made ready.
Texas has spent a decade writing the rules for its data. The agencies that scale AI will be the ones whose data can enforce those rules, prove where it came from, and decide who sees it, before anyone has to ask.
