VIRGINIA — In one month this summer, about 41,556 Virginia state employees — roughly 76 percent of the workforce the state IT agency serves — used an AI chatbot or coding tool at least a little. They sent more requests, and shared more data, with the public version of ChatGPT than with the secure tool the state pays for and gives them. And the state’s own watchdog says the agency in charge never wrote the basic rules: no statewide policy on acceptable use, no required training, and no published list of approved tools.
That is the picture in a report the Joint Legislative Audit and Review Commission (JLARC) — the General Assembly’s nonpartisan watchdog — gave lawmakers on October 13. At the presentation, JLARC’s director, Hal E. Greer, put it plainly: the Virginia Information Technologies Agency (VITA) “is currently falling short in the support, guidance, and oversight it is providing state government in the area of artificial intelligence and needs to substantially up its game.”
The number everyone is quoting — and what it actually says
The 76 percent figure has led most coverage, usually shortened to “state employees used public AI tools.” The report says something more precise — and in one way more uncomfortable. The estimate comes from VITA’s own network data for July 27 to August 27, 2026. It counts any general-purpose AI tool: chatbots such as ChatGPT, Claude and Gemini, coding assistants, and the state’s own enterprise Copilot, which VITA has offered since August 2025.
Two findings sit underneath it. First, the state’s own tool is losing. Employees “made more requests to and exchanged more data with OpenAI’s ChatGPT than the VITA-provided enterprise Copilot” — even though tools like Copilot keep state data out of model training and under state control. Second, nobody knows what was in that traffic. “Available data does not indicate how Virginia state employees are using publicly available general-purpose AI tools,” the report says. The monitoring counts requests and data volume, not content — and it covers the state as a whole. There is no breakdown by agency. JLARC confirmed to Zark News that its report deliberately did not recommend tracking agencies one by one; the point, it said, was the missing policies. JLARC also found no case of sensitive data actually being exposed. The finding is about risk — in a government that holds Virginians’ tax, health, benefits and criminal-justice records.
Rules from 2023 for the technology of 2026
The deeper problem, JLARC found, is that the rulebook is older than the tools. VITA’s AI standards were last updated in November 2023 — before agentic AI, software that can act across systems on its own, entered agency use. The standards never mention agents, or limits on their access to state data. VITA requires agencies to weigh the risks of an AI tool before approving it, but “has not provided agencies with guidelines for how to assess the risk of AI tools and uses.” It recently required annual audits of “high-risk” systems without defining what “high-risk” means. And one set of rules applies to everything, whatever the risk — which, JLARC says, slows down low-risk tools while possibly under-protecting high-risk ones. A high-risk project can face 20 separate reviews.
At the agency level, almost everyone is improvising. Of the 80 agencies surveyed, 97 percent allow staff to use general-purpose AI tools with some restrictions — but as of June 2026, only 28 percent had written any policy or guidance for their staff. The AI is already doing state work: screening scanned images for threats at the Department of Corrections, flagging offensive license-plate requests at the DMV (which got approval to use ChatGPT for that job), and, at the Department of Social Services, running two tools meant to cut SNAP payment errors. That problem carries real money: at Virginia’s FY24 error rate of 11.5 percent, federal law would leave the state owing an estimated $270 million a year from FY28.
Agreement, and now dates
VITA’s chief information officer, Michael Watson, accepted the verdict — in a written response printed in the report, and again in person at the presentation. Watson wrote that VITA agrees “with the overall recommendations,” has made AI a strategic priority, built an AI Strategic Framework, and that an employee training plan “will launch shortly.” JLARC’s 14 recommendations include a standard tool for assessing risk, approvals tiered by risk, a statewide acceptable-use policy that employees must formally accept, a public list of approved tools, and — for the General Assembly to consider — mandatory annual AI training for every state employee. Delegate Cliff Hayes, who chairs the joint technology committee, has promised AI regulation in the 2027 session, according to VPM’s coverage.
What neither the report nor VITA’s response contained was a schedule. Zark News asked — and this week the agency supplied one. The risk guidance, the approved-tools list and the acceptable-use policy are “currently underway,” VITA’s director of strategy and communications, Lindsay LeGrand, told Zark News, with most of that work expected by early 2027. A wider package — an AI roadmap, a resource hub and an updated review process — is due by summer 2027. The training will be mandatory, built into the annual security-awareness training every executive-branch employee already takes, with extra role-based training for technical staff. The AI standards last updated in November 2023 will be refreshed “within the next several months.” On the question the report itself could not answer — what kinds of state information employees sent to ChatGPT, and whether any of it was sensitive — LeGrand did not say. She pointed instead to monitoring systems that, she said, let the agency “identify and monitor uses of Commonwealth data and thwart any misuse.” JLARC, for its part, told Zark News it will be watching: the commission oversees VITA under the Appropriation Act, will require documentation showing how each recommendation was addressed, and will check that the action matches the recommendation’s intent. It also cautioned that VITA “may not have time to fully address all of the recommendations before the 2027 session.”
Reporting note: This article is based on JLARC Report 621, “Governance and Oversight of Artificial Intelligence in Virginia” (October 13, 2026), and on written answers from JLARC and the Virginia Information Technologies Agency to questions Zark News sent on October 20, 2026.
