The General Assembly’s watchdog agency found significant lapses in how Virginia oversees artificial intelligence use by state agencies and employees, including having no risk assessment guidance and unclear rules.
The new studyby JLARC also found AI standards from Virginia’s Information Technologies Agency — which serves 65 state agencies — haven’t kept up with the evolving risks of the technology.
“VITA is currently falling short in the support, guidance, and oversight it is providing state government in the area of artificial intelligence and needs to substantially up its game,” JLARC Director Hal Greer told the commission on Tuesday.
For the study, JLARC staff interviewed VITA leadership and surveyed 80 executive branch and independent state agencies. Its report outlined 14 recommendations to bolster Virginia’s oversight of AI.
A third of Virginia state agencies are using or testing AI tools to serve specific functions, JLARC found, and many others are weighing whether to implement AI systems.
JLARC laid out specific examples, such as the Virginia Department of Corrections’ use of AI to identify potential security threats and scan images of bags brought into prisons.
VITA has an AI registry process for agencies and standards for the use of AI systems, but the agency’s requirements are applied the same across the board, no matter the risk. JLARC’s report said this undermines the efficiency and effectiveness of the state’s oversight of AI.
Nearly half of the agencies using AI told JLARC that VITA’s unclear requirements were a major or moderate constraint on their ability to implement the technology.
One example in JLARC’s report is that the state requires AI systems to have data quality tools, but VITA doesn’t explicitly lay out what data should be evaluated. JLARC said this and other issues could lead agencies to “interpret compliance differently.”
The report adds: “For example, because VITA’s AI standards do not clearly state that each individual use case must be registered rather than AI systems, agencies may use previously approved systems for higher-risk uses without additional oversight.”
State agencies reported frustration with VITA’s “cumbersome and uncoordinated” review and approval process for AI, saying that they got conflicting information — and that some even needed to go directly to Virginia’s chief information officer to expedite AI projects.
Agencies seeking AI projects could undergo as many as 20 separate reviews before they can move forward, according to JLARC.
The reportsaid that VITA recently changed its policy to require yearly audits of high-risk AI systems used by state agencies, but didn’t define “high-risk.” VITA also last updated its enterprise architecture standard for AI in November 2023, JLARC said.
Drew Dickinson, JLARC’s chief legislative analyst and the leader of the AI study,presented the reportto the commission on Tuesday. He said that JLARC’s review of VITA’s AI standards validates agencies’ concerns.
“For example, the standards require AI systems to be certified annually for trustworthiness, but VITA identifies no certifying body or acceptable method for doing so,” Dickinson said.
One of JLARC’s recommendations is for VITA to develop and publish a comprehensive map of the review and approval process for agencies seeking to procure AI projects.
“These problems appear to be part of broader organizational issues that have existed at VITA for years,” Dickinson said. “For example, in VITA’s 2025 internal culture survey, only 29% of VITA staff reported that its work processes were highly efficient.”
Roughly 76% of state employees at VITA-supported agencies use some form of general-purpose AI tool, such as chatbots like Anthropic’s Claude and OpenAI’s ChatGPT. But JLARC’s report said that only 28% of state agencies had written staff policies or guidance on AI use as of June 2026.
According to JLARC, Virginia faces “a higher-than-necessary risk level” due to the potential misuse of these AI tools by state employees.
Despite the issues found, Greer said JLARC is encouraged by its discussions with state Chief Information Officer Mike Watson, who leads VITA, that improvements will be made.
“We agree with everything that JLARC said,” Watson told the commission after the presentation. “This is one of those things in areas where the field is moving very quickly.”
JLARC staff said that legislation concerning AI can be complex and challenging, so Greer said it is vital “that the Division of Legislative Services acquire the specialized technology legal expertise needed to provide the General Assembly with the counsel it should have in this area.”
Among other recommendations, JLARC says VITA should provide agencies with clear standards for determining risk levels of AI tools and update its existing rules.
JLARC also suggests that the General Assembly pass legislation to require Virginia’s CIO to develop and annually update AI literacy training materials for state employees.
Due to concerns over President Donald Trump potentially retaliating against states that imposed guardrails on AI,Virginia lawmakers tabled several bills focused on the issuein 2026. But they have vowed to re-up legislation to set tougher guidelines for chatbots and other AI tools.
In September, Gov. Abigail Spanbergersigned an executive orderto launch a state AI task force that would, among other tasks, work to find ways to address risks that the technology presents.
Copyright 2026 VPM