Most employees at the Virginia state agencies served by the state's IT agency use AI tools such as chatbots, and the state has given them little guidance on how to do it safely, according to a draft report that the staff of the Joint Legislative Audit and Review Commission, the Virginia legislature's watchdog, presented to the commission on Oct. 13, according to a news report. The report estimates that 76 percent of employees at agencies served by the Virginia Information Technologies Agency, known as VITA, used a general-purpose AI tool such as ChatGPT, Claude or Copilot Chat at least to some extent during a one-month period. Yet Virginia has no statewide policy on acceptable use, no staff training on responsible use and no clear guidance on which tools are approved for which work, the report says.
The concern is where state data ends up. Since August 2025, VITA has offered an enterprise version of Copilot, a business version that gives the state more oversight, to every agency it supports, but usage data show employees often turn to the public versions of Copilot, ChatGPT, Gemini and Claude. The report says tools an employer provides are generally safer, for example because they can keep what staff type from being used to train the company's AI, and that public tools carry a greater risk of exposing data when employees do not use them responsibly. Ninety percent of agencies surveyed said a statewide policy on acceptable use would be at least somewhat helpful.
Beyond those everyday tools, about a third of agencies were using or testing AI built for one job as of June 2026, such as a chatbot that answers routine questions from the public or a system that spots fraud, and another 30 percent were considering it. Virginia's Department of Corrections, for one, uses AI to flag potential security threats in bags. The report faults VITA because most of its AI requirements apply the same way to every use, whatever the risk. The report gives an example: a general-purpose chatbot carries little risk when it helps draft a meeting agenda but can create significant risk when it gives medical advice. At least eight other states, including Maryland, Washington and Texas, set some of their rules by risk level.
The report also says VITA's rules are unclear and have not kept pace. Nearly half of the executive branch agencies using AI built for one job called unclear requirements a major or moderate obstacle. VITA's standards do not mention AI agents, meaning AI that can carry out tasks on its own, such as using apps and websites, instead of only answering questions. Nor do they say what safeguards agents would need when they can reach state systems and data.
The report's recommendations would have VITA publish a way to rate each AI use by risk, let agencies approve low-risk uses themselves while still recording them in the state's AI registry, VITA's record of the AI uses agencies have asked to run, and write a policy on acceptable use and post which tools are approved. It also suggests lawmakers pass a law requiring yearly AI training for state employees. Mike Watson, the state's chief information officer, who leads VITA, told the commission he agreed with the findings, according to a news report. Most of the changes are up to VITA, the training requirement would need a new state law, and it is not yet clear when either will happen.