Virginia’s legislative watchdog has called for stronger oversight of artificial intelligence across state government, finding gaps in the guidance provided to agencies and in the technical expertise available to lawmakers drafting AI legislation.
A report presented Tuesday to the Joint Legislative Audit and Review Commission focused largely on the Virginia Information Technologies Agency, which supplies state agencies with information technology services, infrastructure and cybersecurity. The review found that its AI policies need clearer requirements, more timely updates and oversight that better reflects the risks of different uses.
The 79-page report contains 14 recommendations. They include requiring AI literacy training for state employees, funding continuing access to specialized technology law expertise and producing an annual guide to AI for legislators. The commission directed its staff last year to examine AI use, governance, regulation and oversight in Virginia.
The findings come as AI adoption is already spreading through state operations. One-third of executive branch and independent agencies are using or testing at least one tool designed for a specific function, such as detecting fraud or digitizing documents. About 30% of the remaining agencies are considering or pursuing such tools, commission staff told lawmakers.
The report recommends that the IT agency establish risk assessments for executive branch AI uses, maintain a list of approved tools and review its standards for emerging risks annually. It also calls for a process to evaluate proposals to use AI coding tools in software modernization, with technical requirements and safeguards attached to their approval.
Staff identified a mismatch between existing oversight requirements and potential risks. Gaps in policies and training for general-purpose AI tools could expose sensitive information, while cumbersome approval procedures can impede projects. Some agency projects could face as many as 20 separate reviews, and agencies described receiving conflicting guidance or relying on relationships with a former chief information officer to accelerate decisions.
The review also identified practical opportunities for the technology. By September, the Virginia Department of Social Services had deployed two AI-enabled tools to help prevent and detect errors in the Supplemental Nutrition Assistance Program. Software modernization is another area of interest: the state IT agency identified 865 applications needing modernization, including 344 requiring urgent attention. Six agencies reported already using AI to help modernize at least one system, while 18 others were exploring it.
Beyond executive branch operations, commission staff said the Division of Legislative Services needs stronger technical expertise to help lawmakers develop legislation addressing the rapidly changing technology. Delegates and senators rely on that division for assistance that includes drafting bills.
Del. Sam Rasoul and Sen. Creigh Deeds told Cardinal News they expect action through legislation or budget provisions in the 2027 General Assembly session. Those measures have not yet been finalized.
Chief Information Officer Mike Watson, who had been in the role for five months, agreed with the report’s findings during the meeting. He said the IT agency has training pilots and a platform pilot underway as it works to improve how agencies adopt new technology.
Sources: Richmond Times-Dispatch, WRIC ABC 8News, Cardinal News