Virginia’s information technology office is not up to speed on artificial intelligence, and the agency that helps draft laws does not have the AI expertise needed to address the quickly evolving technology, according to a state-directed report.
Expect legislative action in the 2027 session to deal with it, General Assembly members from Southwest Virginia said after a Tuesday presentation to the Joint Legislative Audit and Review Commission.
The commission directed its staff last year to review AI use, governance, regulation and oversight in the commonwealth. The report, published during the meeting on Tuesday, focused most of its recommendations on the Virginia Information Technologies Agency, which provides IT services, infrastructure and cybersecurity to state agencies.
State government and individual employees are using AI, but the IT agency is “currently falling short in the support, guidance and oversight it is providing state government in the area of artificial intelligence and needs to substantially up its game,” the commission’s staff director, Hal Greer, said during the meeting.
Virginia’s new chief information officer, Mike Watson, understands the issues “and is already making progress to improve things,” Greer said.
AI legislation can be “extraordinarily complex and challenging,” Greer said, adding that it “is imperative” that the state’s Division of Legislative Services, which helps Virginia lawmakers with tasks that include drafting bills, acquire the needed tech expertise to provide such counsel.
The 79-page report includes 14 recommendations, among them legislative action that would require AI literacy training for state employees, funding for ongoing specialized technology law expertise and an annual legislator’s guide on the technology.
Three Southwest Virginia legislators, Del. Sam Rasoul, D-Roanoke, Sen. Mark Obenshain, R-Rockbridge County, and Sen. Creigh Deeds, D-Charlottesville, are on the 14-member commission and received the report. Rasoul and Deeds, responding to text messages Tuesday, said that General Assembly action via bills or budget items is a certainty.
The state needs AI and technology experts in legislative services and at the agency level, Rasoul texted.
Deeds said “a lot more thought” is required, but he would expect bills in the next session to generally follow the staff report’s recommendations.
“We want to be nimble enough to deal with the rapidly changing landscape,” he texted.
Obenshain did not reply to a request for comments on the meeting and report.
While the report lists potential pitfalls of using artificial intelligence, including security risks and the unauthorized sharing of confidential information by AI agents, it mentions multiple potential boons. Those include reducing payment error rates in the federal Supplemental Nutrition Assistance Program; states with error rates above 6% will have to begin paying a portion of SNAP benefit costs next year, which could cost Virginia $270 million.
The report’s recommendations to the IT agency noted the need for risk assessments for executive branch agencies’ AI use; clear standards and policies about emerging risks, reviewed and updated annually; a list of approved tools; and a process to review and approve proposals to use AI coding tools for system modernization, with technical and risk-mitigation requirements to implement them.
Who is using it? What are the problems?
One-third of the state’s executive branch and independent agencies are using or testing at least one function-specific AI tool, staff project leader and chief legislative analyst Drew Dickinson told the commission. A function-specific tool performs only one task, such as detecting fraud or digitizing documents.
About 30% of remaining agencies are considering or pursuing using such AI tools.
But the IT agency’s rules about using AI are not proportionate to potential risks, the report concluded.
The requirements “lack risk-based criteria, clarity and timely updates, undermining efficient and effective oversight, and policy and training gaps on general-purpose AI tools increase the state’s risk of sensitive data exposure and other problems,” Dickinson said.
Studies show that AI models have surpassed humans in reading comprehension and software engineering, he said. Its speed and efficiency came in handy for the Virginia Department of Social Services, which by September had deployed two AI-enabled tools to help prevent and detect SNAP errors, and the department identified other potential ways that AI could help reduce errors, according to the report.
The state IT office identified 865 other state software applications that needed modernization, including 344 requiring urgent attention. Six agencies reported already using AI to help modernize at least one system. Eighteen others were exploring it.
There are barriers to AI adoption, including poor internal coordination. State law requires agencies to follow the IT office’s established policies and standards; some projects could require as many as 20 separate reviews, Dickinson said.
The commission staff’s interviews and survey responses showed agencies reporting frustration with the IT office’s required processes. Some reported getting conflicting information and needing to use their relationships with a former chief information officer to expedite projects.
“These problems appear to be part of broader organizational issues that have existed … for years,” he said.
Watson, who has been chief information officer for five months, worked closely with the commission staff as it finished its report.
“We agree with everything that JLARC put in there,” Watson said. “I think there’s a lot of opportunity for us to make some pretty significant changes with the way that we’re handling things today.”
It will be important to have agencies ready to put the new technologies in place, he said. The IT agency has some training pilots underway, along with a platform pilot, to be sure that the tech “won’t break down when we actually deploy it,” he said.
“We’re optimistic that we’re going to finish that within the next 60 days, and then move on to the next stage in the pilot,” Watson said.
His remarks were part of a scheduled annual overview of his department, in which he discussed the rising cost of hardware and how the IT office might mitigate that and about security in general. He told the commission he had just heard about headlines from France, where remotely controlled supermarket refrigerators were hacked and were catching fire.
“There are just random things where technology is tied into everywhere, and cybersecurity is really important,” he said.
Other news items have detailed AI systems breaking out of their contained spaces and accessing other websites, he noted. But over the past year with the IT agency, cyberattacks have decreased as detection has improved, he said. In 2024, the office logged 591 million attacks, but the next year that number fell to 329 million, with 59,435 pieces of malware blocked. Watson credited that to implementing a “zero-trust model” over the past two years, stressing that every contact is an assumed breach attempt and must be verified.
New vigilance must accompany new AI tool sets, he said, as he showed the commission a chart with a downward trend of attacks.
“We have to make sure that we’re really clear and have the capabilities in place to make sure the commonwealth is protected,” he said, adding that “our goal is to keep it flat and try to make sure that we don’t see as we see as little of a spike as possible.”
New laws needed in the AI age
Dickinson, the project leader on the report, noted the challenges of tackling tech issues with legislation. For example, courts have blocked or struck down election-related deepfake laws in California and Hawaii on free speech grounds. Even defining AI is difficult, legally, because there is wide disagreement on that topic, as different systems vary in autonomy and adaptation, the report reads.
In Colorado, a broad legal definition led its executive and legislative branches to quarrel over just which technologies were covered, and Colorado wound up repealing and replacing the law with “a narrower definition,” Dickinson said.
Liability is hard to assign because developers, deployers and end users can all contribute to AI harms. AI tools that anyone can download further muddy liability questions, he said.
The Division of Legislative Services reported to JLARC in September that it didn’t have a tech law expert on staff or access to one outside its offices.
The report recommends that the General Assembly include funding in the 2027 appropriation bill for the legislative services division to obtain specialized technology law expertise so it can provide proper advice on AI legislation. That could happen through hiring, partnering with a university or retaining outside counsel, Dickinson said.
“I think having technology-focused attorneys at DLS is a real proposal that can come out of this, said Rasoul, the Roanoke delegate, who recently passed the bar exam to practice in Virginia.
Correction 3:27 p.m. Oct. 14, 2026: Del. Sam Rasoul said that Virginia needs AI and technology expertise at the Division of Legislative Services. The department name was incorrect in an earlier version of this article.
