(The Center Square) – Gaps in statewide guidance and training for state employees using artificial intelligence increase the risk of exposing sensitive information, a Virginia legislative review found.

The Joint Legislative Audit and Review Commission presented its findings Tuesday. The report recommended clearer rules, annual employee training and oversight based on the risks of each AI use.

Mike Watson, the commonwealth’s chief information officer, said the Virginia Information Technologies Agency agrees with the recommendations and has training and technology pilots underway.

JLARC estimated 76% of employees at VITA-supported agencies used a general-purpose AI tool during a one-month period this summer. Tools such as ChatGPT, Claude and Microsoft Copilot can help employees draft documents, summarize information and write code.

The usage data did not show what employees entered into the tools or how they used them. JLARC found gaps in policies, guidance and training increased the risk of misuse.

VITA has offered agencies an enterprise version of Microsoft Copilot with added data protections since August 2025. Employees also frequently used publicly available tools.

During the period reviewed, employees sent more requests to ChatGPT and exchanged more data with it than with the state-provided Copilot, according to the report.

JLARC recommended VITA establish a statewide acceptable use policy and require agencies to adopt it or their own policy meeting its requirements. It also recommended publishing clear, current information identifying approved tools.

VITA staff told JLARC the employee AI training the agency was considering would be voluntary. The report recommended lawmakers require an annually updated training curriculum and annual certification that agency employees completed it.

Watson said Tuesday that training pilots were underway. He said agencies also need to prepare their data, business processes and technology before putting additional AI tools into use.

The review separately examined AI designed for specific agency tasks, such as answering public questions or detecting fraud. About one-third of the 80 agencies surveyed reported using or piloting at least one such tool in June.

JLARC found VITA applies many of the same requirements to AI tools regardless of their risk. That can slow down lower-risk projects without necessarily providing enough protection when AI affects residents’ rights, benefits or safety.

Drew Dickinson, the study’s project leader, said VITA recently amended its policy to require annual audits of high-risk AI systems but does not define high risk.

The report recommended standardized risk assessments and requirements tailored to each risk level.

It also called for updated safeguards for AI tools that can act on their own, such as by modifying, deleting or sharing files. VITA’s AI architecture standard was last updated in November 2023 and did not address those tools, the report found.

JLARC also identified opportunities to use AI to modernize government software and reduce Supplemental Nutrition Assistance Program payment errors.

Under 2025 federal changes, states with SNAP payment error rates of 6% or higher must help pay benefit costs.

Virginia could face $270 million a year in SNAP benefit costs starting in fiscal 2028 if its payment error rate stays at 11.5%, the level recorded in fiscal 2024, according to a Department of Social Services estimate. JLARC recommended VITA give priority to reviewing AI tools that could help reduce those errors.

The recommendations call for agency action or legislation. They do not establish new requirements on their own.