Virginia audit commission finds AI use is outpacing state oversight

Virginia’s state employees are using AI more widely than their agencies have established rules for it, leaving gaps that could expose sensitive data. The Joint Legislative Audit and Review Commission presented a report on October 13, 2026, finding weaknesses in both government oversight and the technical expertise available to lawmakers drafting AI legislation.

The report found that 76% of state employees use AI to some extent, while just 28% of agencies have written policies or guidance for staff. Those figures measure different groups—employees and agencies—but show how widespread use has become alongside limited formal guidance. About one-third of agencies are using or piloting tools, including public-facing chatbots and fraud detection systems.

The 79-page report contains 14 recommendations, most aimed at the Virginia Information Technologies Agency, or VITA. That agency supplies state IT services, infrastructure and cybersecurity. Cardinal News reported that the review also calls for stronger expertise in the Division of Legislative Services, which helps lawmakers draft bills. The recommendations are proposals for action, not newly enacted AI rules.

An audit requirement without a risk definition

VITA already has an approval policy for AI tools designed for specific functions. It allows them only when they produce a clear, positive outcome for Virginia residents. Almost all tools must pass through approvals involving senior IT staff, VITA divisions, the state chief information officer and the secretary of administration, followed by ongoing evaluation and risk assessment.

The problem is how those requirements distinguish risk. They apply uniformly, regardless of a tool’s purpose or potential consequences, and VITA has not given agencies guidance on assessing that risk. A recent policy update requires annual audits of high-risk AI systems without defining high risk, according to the report’s findings described by The Virginian-Pilot.

JLARC project leader Drew Dickinson said risk depends on a tool’s purpose, its operating context and the sensitivity of data it can access. He warned that uniform requirements may be insufficient for higher-risk uses. Systems affecting residents’ rights, benefits or safety may need additional review by the relevant secretary or the Office of the Attorney General.

For example, a tool that flags potential data entry errors for human review generally poses less risk than one that autonomously manages traffic patterns.

Drew Dickinson, JLARC project leader

Approved tools, trained employees and clearer reviews

For general-purpose AI, the gaps reach everyday staff decisions: which tools are approved, what employees may use them for and where their limitations lie. JLARC identified limited responsible-use training and unclear tool approvals. It recommended an acceptable-use policy alongside formal risk-assessment criteria, rather than leaving agencies to work out those boundaries themselves.

Other recommended steps

• Maintain a list of approved AI tools and review emerging-risk standards and policies annually.
• Create a review process for AI coding tools proposed for modernizing state systems, including technical and risk-reduction requirements.
• Have lawmakers consider requiring the state chief information officer to develop an AI-literacy curriculum for employees.

The review does not argue against wider AI use. It identifies potential benefits and recommends prioritizing review of tools that could reduce Supplemental Nutrition Assistance Program payment errors. That recommendation pairs an adoption goal with an approval decision: VITA would still determine whether the proposed use should proceed.

The expertise gap reaches bill drafting

The report also calls for funding ongoing specialized technology-law expertise and producing an annual technology guide for legislators. JLARC staff director Hal Greer said AI legislation can be extraordinarily complex and challenging, making it imperative that the Division of Legislative Services acquire the expertise needed to advise lawmakers.

Del. Sam Rasoul and Sen. Creigh Deeds told Cardinal News they expect General Assembly action through bills or budget measures in the 2027 session. Deeds said more thought was needed, but expected bills generally to follow the staff recommendations. Their comments point to a legislative response; they do not settle which recommendations lawmakers will adopt.