- Apr 13
- 5 min read
The New Infrastructure Crisis Hiding in City Hall
Cities have always delivered services. Now they are responsible for the systems those services run on. Systems they did not build, do not fully control, and cannot easily replace.

When systems fail, cities still have to answer for it
July 19, 2024. A routine software update from cybersecurity firm CrowdStrike begins rolling out to millions of Windows systems worldwide.
Within hours: airports stalled. Hospitals delaying care. Government systems offline.
There was no cyberattack. No breach. Just a faulty update and a dependency that failed at scale.
For cities caught in the outage, the situation was clarifying in the worst possible way. CrowdStrike was not necessarily a vendor they had selected directly. It was part of the underlying technology stack, embedded within systems they already relied on, several layers below any procurement decision they had made.

The failure did not come from a choice the city made. It came from a system the city depends on. And when it failed, the city was still accountable.
This is the new operating reality for cities, and it did not start with AI.
In Dallas, a 2023 ransomware attack slowed court proceedings, disrupted police systems, and forced staff into manual workarounds for months. Across the UK, a sustained wave of cyberattacks on local governments through 2025 and into 2026 disrupted housing systems, benefits processing, and planning services, sometimes for weeks. These were not edge cases. They were normal operations, under modern conditions.
This is not a problem for future cities. It is a problem for yours.
It is tempting to read these examples as cautionary tales for cities experimenting with advanced AI or ambitious digital infrastructure. But that framing lets most cities off the hook too easily.
The more uncomfortable truth: if your city runs on software, this already applies to you.
Cities are running permitting software. Managing benefits systems. Processing payments. Coordinating services across departments. Tracking casework. Most of it runs on a mix of platforms, vendors, and internal processes that staff navigate daily without much thought, until something breaks.
AI is not introducing a new category of risk. It is accelerating a system that is already in place.
A spectrum, not a switch

One of the persistent confusions in this conversation is the language. Terms like "AI city" or "smart city" get used as shorthand for something more precise: a spectrum of capability that most cities are moving along, often incrementally, often without noticing.
Most cities are not making a single decision to become "AI cities." They are moving along this spectrum, often without fully adjusting how they operate in response.
Where the crisis hides
As systems become more embedded, the points of failure become more visible and more consequential.
When a system goes down, services do not slow. They stop. Staff lose access to workflows. Residents lose access to services. Workarounds, if they exist at all, are manual and limited.
As systems scale, they become harder to replace. Contracts, integrations, and dependencies accumulate over time. What begins as a procurement decision becomes a structural constraint, something a city cannot easily exit even when it wants to.
New tools, especially AI tools, are being adopted faster than governance can keep pace. Policies are being written in parallel with real-world use. In many cases, systems are already shaping workflows before anyone has defined who is responsible for overseeing them.
The challenge is not any single failure. It is that the ability to operate is increasingly tied to systems the city does not fully manage end to end.
What cities are starting to do differently
Cities are not standing still. In many cases, they are beginning to adapt, quietly, unevenly, but meaningfully.
Redundancy is becoming more common. Some cities are exploring multi-cloud environments, backup systems, and alternative workflows to reduce single points of failure.
Cybersecurity is evolving into something broader: cyber resilience, the capacity to maintain operations during disruption, not just prevent it. Systems are being segmented. Recovery processes are being tested against actual service delivery, not just IT benchmarks.
Operational continuity planning is being revisited. Plans historically built around physical disruptions like storms, power outages, and building failures are being expanded to account for digital outages. Cities are mapping which services must stay active and what it actually takes to keep them running under constrained conditions.
Vendor relationships are receiving more scrutiny. Service-level expectations, data ownership, and system portability are becoming more central to contract conversations, even if approaches remain uneven across jurisdictions.
And in some cases, cities are investing in internal capacity, not to replace external partners, but to better understand and operate the systems they are already depending on. This is less a technical initiative than an organizational one: knowing enough to ask the right questions when something goes wrong.
The governance gap nobody owns

Cities are no longer just delivering services or managing programs. They are working within, and increasingly responsible for, complex, interconnected systems that shape how those services function. But organizational structures have not caught up. Technology, operations, policy, and procurement often sit in different parts of the organization. Each plays a role. No single function owns how the system works end to end.
Everyone touches the system. No one fully operates it.
As cities move further along the spectrum, the questions begin to shift. It is no longer just: What technology are we using? It becomes: Who understands how this system works? How are decisions being shaped within it? And who is responsible when something goes wrong?
These are not purely technical questions. They are governance questions, and they are landing on the desks of people who were not hired to answer them.
The questions city leaders can no longer defer
For city leaders, the operational questions are becoming harder to ignore. If a critical system goes down tonight, can services continue tomorrow morning? If a platform needs to be replaced, what would that actually take in time, cost, and disruption? Where does critical data reside, and how accessible is it without the vendor? Who in this organization understands how the systems connect, not in theory, but in practice?
The CrowdStrike outage and the Dallas ransomware attack are often treated as isolated incidents. They are not. They are previews of a structural condition that becomes more pronounced as digital systems become more embedded in how cities operate.
Cities are beginning to respond. Building redundancy. Strengthening resilience. Expanding internal capacity. These are early moves in what is likely a long transition.
The role of the city is changing, not all at once, not always visibly, and not always by design. But the cities that recognize this shift and start building the capacity to operate within it will be in a fundamentally different position than those that do not. The question is not whether to take on this new role. It is whether to do it deliberately.






