The use of artificial intelligence (AI) tools is growing within the ranks of Virginia state agencies, but it is not as widespread as within federal agencies or some other states. Many employees and managers complain their efforts to adopt AI are being impeded by insufficient guidance from the Virginia Information Technology Agency (VITA).
The General Assembly’s audit arm agreed that VITA needs to significantly improve its oversight and guidelines to the agencies. It also proposed that the Assembly’s major support staff, the Division of Legislative Services, hire or retain legal advisors with specific technology expertise.
The Joint Legislative Audit and Review Commission report issued Tuesday (a 65-page slide deck and 97-page text document) focuses on risk, along with a general survey of how AI tools are already being used.
“VITA’s unclear AI standards make compliance challenging for agencies,” was one finding that appears throughout the report. “Nearly half (48 percent) of executive branch agencies using function specific AI cited unclear AI requirements as a major or moderate constraint,” and JLARC staff’s own review concurred.
JLARC Director Hal Greer told the legislators that the state’s new chief information officer, Michael Watson, was already working on corrections to issues raised in the report. “We agree with everything,” Watson told the legislators later in the meeting while discussing his own agency update that focused largely on AI.
One major opportunity for using AI identified by JLARC was leveraging its well-recognized software coding success to modernize and improve the state’s many IT systems. VITA has identified 865 systems that are out of date, 344 of which need urgent attention, JLARC’s Drew Dickinson told the legislators.
Another major opportunity would be using AI tools to reduce the error rates in social services programs. Under recent federal rule changes, Virginia must pay a higher percentage of the cost of the Supplemental Nutrition Assistance Program (SNAP) if the error rate is too high.
Examples of current uses of AI in agencies include constituent-facing chatbots, fraud detection tools, meeting transcription, tools that digitize and classify documents, and traffic incident detection systems. They are mainly using predictive AI for managing information, or generative AI, which can create documents, reports and images.
JLARC reported very little use of agentic AI, which plans and carries out multistep processes on its own to accomplish some task. In his report, Watson told legislators the state has contracts in place with OpenAI, Anthropic, Microsoft Copilot, and Google Gemini. About 2 percent of activity is classified as agentic, but the definition lines are not always clear.
About 65 of the 80 state agencies depend on VITA for IT services. The others are more independent, but still must abide by VITA’s rules, which already require that proposed uses of AI be registered and reviewed. One complaint is that the bureaucracy is slowing down adoption and may be too onerous for the most simple AI applications.
Legislators asked few questions. Few of the JLARC recommendations will require legislation. Staff seemed to be discouraging a major rush into state regulation. As noted earlier, the Assembly’s staff lacks the specific legal expertise. And the report listed many examples of other states that charged in only to have to retreat.
California and Hawaii adopted laws against using AI generated content in political ads and the courts rejected them on First Amendment grounds. Colorado adopted a broad definition of what constituted an AI function and had to amend it to something more narrow. The longer report included several pages summarizing other states’ activities, with Dickinson pointing to Oregon as a good example to follow.
Assigning liability for any harm done is particularly challenging with so many entities involved, with open-weight programs that can be amended by outside parties, and with the growing use of the more independent agentic AI. One of the most common uses of AI by the public at large is seeking not just medical information but medical advice.
The only Virginia legislative actions JLARC recommended were bills to develop more vigorous and mandatory internal employee training, to fund legal expertise, and to create an informational program for legislators. But after the meeting, one legislator told a radio reporter to expect a full suite of regulatory proposals from legislators in January.
On the administrative side the recommendation list was longer. VITA should clarify and update its guidelines, create and publish a risk assessment tool and take a tiered approach to risk, with greater restrictions where there is increased danger of harm. Agency proposals to use AI should get expedited reviews.
Not on the list but noted by most in the meeting was Dickinson’s advice that “you always want a human in the loop” when evaluating possible risks for a function handed off to one of the more independent agentic AI agents.
