In 2025, we saw real maturation in the AI space — from simple chatbots to systems that extract insights from unstructured data, intelligently classify it, and turn it into structured data, all while detecting security threats.
It’s an exciting time, but also one to be measured, especially for regulated organizations. How will public sector organizations roll out and level up their use of AI in 2026? I put these questions to Murtaza Masood, Box Managing Director of State and Local Government, and Jason Gray, Box Managing Director for Federal Government, to hear what they’re seeing from customers around safely using AI to further agency missions.
Starting with Jason: What’s the single most important shift you expect in how government agencies adopt AI in 2026?
Jason: It’s kind of hard to pick just one, but I think AI adoption for mission-specific functions will take a much larger role. Historically, agencies only dabbled with AI for non-mission specific activities due to safety and security concerns. This year, with the emphasis from the administration and some of the shifts we’ve seen, instead of viewing AI as a standalone capability, they’ll start seeing it as a utility like electricity — a foundational layer that powers and connects everything integrated with it.
Murtaza: Building on Jason’s insights, more and more state and local governments and educational institutions are viewing AI as transformative rather than standalone. The practical question is: how does AI enable CIOs and business leaders to increase efficiency, as they deliver “last-mile” services to the public, increase efficiency in internal processes and workflows, while also maintaining transparency and being responsive to emerging needs?
One key shift I’m seeing is a focus on building AI experiences within platforms employees already use. We’re not getting additional budgets, but demand for responsive services keeps increasing. So how do we create efficiencies within tools we already own while using AI to leapfrog legacy technical debt? I see those trends taking hold this year.
What are some examples of building that last-mile system?
Murtaza: I’m seeing county and city customers leverage AI in general, and in some cases Box AI - to build more self‑service or on‑demand AI agents so that consumers, members of the public, and private businesses—any constituents that state and local government serve—can access information such as official documents and records on public‑facing portals in a timely manner and with more context‑aware agents.
Another key example is where cities are building AI into the 311 portal systems, enabling access to personalized records, application processes, and guidance on how city and county services are using AI agents.
Jason, one pillar of the President’s Management Agenda (the PMA) is leveraging technology for faster, more secure services. Are there other pillars we’re focused on right now?
Jason: Definitely. Back in the day, remember when you’d engage an automated system and just want to talk to a person? With the advancements of AI, the quality is so good now that there’s a real opportunity to actually answer people’s questions more thoroughly.
At Box, I’ve seen systems that historically required separate pilots, testing, and administrative support. Today Box addresses multiple capabilities through one FedRAMP High-authorized system. Take data classification: this would typically require a third-party product to acquire and integrate. Box Shield Pro does it automatically, which is immensely helpful for congressional inquiries, press inquiries, and FOIA requests. Watch the demo below to see it in action.
Another example is correspondence tracking and clearances. Routing decision memos often relies on custom apps that cost time and resources. Federal agencies should really be looking for how to consolidate classification, labeling, storage, security, routing, and approvals into one platform. It just so happens that Box can help with that.
Federal agencies should really be looking for how to consolidate classification, labeling, storage, security, routing, and approvals into one platform. It just so happens that Box can help with that.
Murtaza, that brings up one of the priorities we saw in the National Association of State CIOs (NASCIO) top ten priorities for 2026. Murtaza, how are state and local governments looking at AI deployments? Are there pragmatic use cases where it has delivered measurable operational improvement?
Murtaza: AI has been a focus for some years now, but this year we see a shift towards more ROI‑based use cases being prioritized by CIOs at the state level as well as local governments. From a Box perspective, we’re seeing pragmatic use cases that involve structured and unstructured content analysis. Being the repository of choice for files, documents, and forms, we’re seeing many generative AI use cases for generating summaries across large volumes of content—useful for policy management, briefings to legislators, administrators, and public service.
We’re seeing case analysis in health and human services and public safety—things like evidence summaries and extracting key insights. Turning structured data out of unstructured files is another key AI use case. One focus at NASCIO was how CIOs and CSOs leverage AI as a force multiplier within their workforce.
How can agencies use AI while preserving data protection, auditability, and oversight?
Murtaza: It comes down to foundational governance, security, and compliance architecture. If you’re building AI on trusted platforms like Box that are designed with government needs in mind, you can be assured the right privacy and security controls are in place, whether FedRAMP High or enforcing PII and HIPAA compliance.
Jason, as a former federal CIO, how did you think about evaluating vendors and change management for AI?
Jason: As a CIO, I didn’t want a bunch of systems that are categorized as high impact level, because that just meant more controls to manage and more assessment during audits. What I love about Box is it meets many controls that would otherwise be my responsibility, whether FedRAMP High or DoD IL4. This means cleaner audits, fewer findings, and assurance to oversight bodies that you’re taking security seriously.
How should agencies prioritize use cases that demonstrate quick wins?
Jason: Prioritize use cases that reduce manual effort, shorten cycle times, and eliminate duplicative systems — outcomes that are easy to measure.
One quick win: managing a federal audit entirely within Box — stuff like evidence collection, eDiscovery, NARA requirements, and collaboration. Historically this was an email process with many manual steps. With Box, you can automate provisioning of repositories for evidence collection, making it faster and more secure.
What advice do you have for agencies that have to choose between integrating AI providers, procuring solutions, or building custom models?
Jason: Agencies today should consider whether they want to manage models and infrastructure or leverage something already FedRAMP High-authorized. My advice: choose a vendor that delivers an authorized platform with a single ATO enclosing the LLMs and AI tools within the same security boundary. That reduces administrative overhead and enables broad functionality across use cases.
Choose a vendor that delivers an authorized platform with a single ATO enclosing the LLMs and AI tools within the same security boundary
Murtaza: The key is a best-of-breed approach — pointing the right use case at a fine-tuned LLM while using SaaS applications built with government in mind. Time-to-market matters too. Do you have the luxury of building all the plumbing for privacy, data protection, and user experience? Considering the investments and skill sets required, many agencies will prefer integrating trusted platforms that provide frictionless experiences.
How should agencies think about data governance so AI projects are faster and less risky?
Jason: For an agency with decades of data, it won’t be perfect. You don’t need perfect taxonomy, but you do need consistent metadata, clear ownership, and retention rules. With those, you can establish governance that makes AI predictable and defensible.
Agencies need a solution that can evolve governance over time — start simple, scale safely, reduce risk instead of waiting years or spending millions to get everything perfect. Iterate. You don’t have time to wait.
What misconceptions about AI in government are you seeing?
Murtaza: The biggest is probably that you need a huge budget and lots of resources to get started. But you can get around that by starting with the mission outcome. The most successful pilots move into full service only when the outcome is specific and tangible — for instance, reducing the time for a citizen to complete an application. Then work backward, identify existing platforms, and figure out where AI can accelerate repetitive tasks.
On KPIs: What should CIOs track to show alignment with organizational missions?
Jason: Cycle time reduction is obvious. Track reduction in duplicative systems — are you consolidating? Track improvements in compliance posture and audit readiness. And track staff time redirected from manual tasks to mission work. These KPIs align with the president’s management agenda and agency strategic plans.
As we wrap up: How can CIOs get tangible ROI from AI deployments in the next year?
Jason: Start with administration objectives and the agency strategic plan. Demonstrating value with use cases that support those objectives shows responsible stewardship of taxpayer dollars and supports further appropriations for modernization.
Murtaza: A practical framework: build on existing trusted platforms that enable good content hygiene, enforce policy frameworks, and work backward from the outcome. What KPI are you pursuing? Whether it’s faster security applications, reduced caseloads, or improved information access, once you have that tangible use case, the ROI becomes clear.
Thank you both for your time. We look forward to seeing how the public sector continues to level up their AI usage. At Box, we’re excited to support that journey to responsible, secure, and efficient AI for our public sector customers.
Learn more about how Box’s Intelligent Content Management platform can help public sector organizations leverage AI within secure boundaries and meet their goals for 2026 and beyond.
