What States Built on the Front End
By survey measure, state AI governance is in better shape than it was two years ago. NASCIO's 2026 State CIO Top Ten Priorities ranked artificial intelligence—spanning governance, security, and emerging applications—first among state CIO priorities, ahead of cybersecurity. NASCIO's 2026 State CIO Survey reports that 78 percent of state CIOs have adopted an AI governance framework; data reported by GovTech shows 98 percent have enterprise policies governing generative AI.
The governance infrastructure most states have assembled follows a recognizable pattern. A central IT office—the state CIO, a new state chief AI officer, or both—issues an acceptable-use policy and establishes rules before deployment. Agencies must demonstrate compliance before going live with an AI system. Maryland's approach, as described in GovTech's analysis of state AI ownership structures (August 5, 2026), is representative: its Department of Information Technology requires an intake process before deployment that checks for security, privacy, and data requirements. Maryland's approach also includes post-deployment guidance—according to that analysis, agencies are expected to monitor performance, audit outputs for accuracy and bias, and keep error logs, and incident response procedures apply, with security and privacy incidents routed to the state's Security Operations Center.
This front-end work is real. Pre-deployment review catches misconfiguration, poorly scoped vendor contracts, and use cases that create immediate compliance exposure. It also creates a moment for the state to understand what AI systems it is running—which is not a trivial problem. Texas's approach under the Texas Responsible AI Governance Act (TRAIGA, HB 149), which took effect January 1, 2026, requires state agencies to maintain a periodic AI inventory as part of their regular information resources reporting to the Texas Department of Information Resources. Without that inventory, there is no surface for monitoring, testing, or incident response.
What the Audits Found
New York State's Office of the Comptroller published its audit of state agency AI governance—Report 2023-S-50—in April 2025, covering January 2019 through November 2024. The audit reviewed four agencies that had used or were piloting AI: the Office for the Aging (NYSOFA), the Department of Corrections and Community Supervision, the Department of Motor Vehicles, and the Department of Transportation.
The audit found five problem areas. The most operationally significant was the absence of post-deployment monitoring: none of the sampled agencies had required or developed specific procedures to test AI systems in order to evaluate whether outputs were accurate or biased. DMV required periodic reviews in policy—but no sampled agency had documented procedures to carry them out.
One example illustrates how structural the problem is. NYSOFA was operating an AI-based companion system—ElliQ, described in the audit as "an AI companion… designed to… provide support for older individuals." When auditors asked the agency about compliance with New York's Acceptable Use of AI Technologies policy (NYS-P24-001), the agency replied that it had not been aware of the policy. After reviewing it, the agency concluded the companion system did not fall under the policy's definition of AI. The State Comptroller disagreed: the system met the policy definition and should have been reviewed. The audit found no formal AI inventory existed at any of the sampled agencies; NYSOFA had not classified ElliQ under the state's AI policy, leaving the system outside the governance framework.
New York has revised its AI policy since the audit's coverage period. The Office of Information Technology Services has updated policy NYS-P24-001—most recently in June 2026—and the current version requires an annual risk assessment for covered AI systems, including those already in production, and assigns information owners responsibility for periodically reviewing outputs.
About three and a half years after the state comptroller's initial audit of New York City's AI governance (Report 2021-N-10, issued February 2023), the New York State Comptroller published a follow-up—Report 2025-F-17, August 2026—examining whether OTI had acted on those earlier recommendations. The follow-up found that OTI had created its own AI risk assessment tools, but that other City agencies are not required to follow or use them. One agency was still operating outside the established AI definition—the same classification gap the state audit identified. Despite improvements at OTI, the accountability gap at the operational agency level remained open.
The Central-Agency Handoff
The pattern in both audits reflects a structural problem. The handoff between central oversight and agency operations is undefined at the point that matters: after deployment.
Maryland's approach illustrates the ownership handoff. GovTech's analysis describes how, once a system clears the central intake, ownership returns to the individual agency. Maryland's approach includes post-deployment guidance—according to that analysis, agencies are expected to monitor performance, audit outputs for accuracy and bias, keep error logs, and follow incident response procedures—but the same analysis notes that across states, central governance has advanced further than operational accountability at the agency level.
The critical question that many states cannot answer: when a deployed AI system starts producing anomalous outputs, who notices? Using what procedure? With what escalation path? For states without Maryland's post-deployment expectations, the accountability model stops at the approval gate.
What Texas Required at the Floor
TRAIGA's requirements for Texas state agencies represent a minimum floor—not a complete post-deployment accountability layer, but a useful starting point that clarifies what the floor looks like.
For Texas state agencies, TRAIGA (HB 149) requires:
- Disclosure to consumers when they are interacting with an AI system (consent is not required; disclosure is)
- A periodic AI inventory as part of agencies' regular information resources reporting to DIR
- A Texas Artificial Intelligence Council attached to DIR, established to advise on AI risk and use—the council may not issue binding rules or guidance
Separately, Texas HB 3512, effective September 1, 2025, requires an annual AI training program for covered state employees—those who use a computer for at least 25 percent of their duties—certified by DIR.
The attorney general has exclusive enforcement authority under TRAIGA, with penalties up to $200,000 per uncurable violation. The act also includes a fiscal-year waiver (§9): agencies are not required to implement unfunded mandatory duties unless the legislature appropriates funds.
The inventory requirement is the most operationally significant TRAIGA element. It forces a periodic answer to the question the New York audit found was not being asked: what AI systems are running in this agency right now, and are they subject to the state's AI policy? Earlier TRAIGA drafts—including HB 1709—included impact assessments and formal risk management programs for high-risk AI systems; those requirements were removed before enactment. What remains is a floor that makes the question answerable without yet requiring the monitoring and testing that would make the answer meaningful.
What Post-Deployment Accountability Actually Requires
A state agency that has cleared the intake review and gone live with an AI system needs accountability mechanisms that work differently from what approvals provide. The intake review answers a point-in-time question: is this system acceptable to deploy today? The post-deployment layer answers a continuous question: is the system still performing as intended, is it harming residents, and who is responsible when the answer is no?
The minimum viable post-deployment accountability layer includes five components. Each addresses a gap the comptroller audits identified directly:
1. Output monitoring with a defined owner. Not every AI system requires the same monitoring frequency, but every deployed system needs a defined monitoring protocol and a named person who reviews results on a documented schedule. The New York state audit found none of the sampled agencies had established this, even where periodic reviews were formally required by policy.
2. A testing schedule for accuracy and bias. Testing a deployed model against ground truth at regular intervals—quarterly, semi-annually, or on a risk-adjusted schedule—requires documented procedures and a named accountable party. This is the specific finding from the New York state audit.
3. An incident classification and response path. When an AI system makes a decision that harms a resident—denying a benefit incorrectly, flagging a record erroneously, failing to surface a critical alert—there needs to be a path from that event to review and correction. At minimum, agencies need a documented path from anomalous output to review and escalation.
4. A persistent inventory tied to the acceptable-use policy. An inventory that is not updated when new systems are deployed is a list, not a governance tool. The NYSOFA example in the New York audit illustrates what happens when no formal AI inventory exists: a resident-facing AI system runs without review under the state's governance policy.
5. A central-to-agency escalation protocol. The state audit found that ITS has no process to monitor agency compliance and relies on agencies to self-report their AI systems (p. 13). The NYC follow-up found that OTI has no process to follow up on its own risk-assessment recommendations (p. 6) and that no citywide protocol exists for complaints of harm from AI systems (p. 7). Central IT offices have established intake processes; neither audit found that structure extending to operational incident response.
An alternative approach is to rely on vendor-managed monitoring and contractual service-level agreements rather than building an in-house accountability layer. That works where the vendor's production monitoring is rigorous and the agency has contractual access to outputs, audit logs, and incident reports—but it transfers accountability to a party whose incentives may not align with detecting adverse outcomes. It also creates a coverage gap for agency-built tools and open-source models where no vendor is in the loop. The two approaches are not mutually exclusive: vendor obligations for commercial systems, agency-side protocols for everything else.
The Decision Now
The comptroller audits document what happens when these mechanisms are absent. The findings are not about rogue or experimental deployments—they describe agencies like NYSOFA and DMV, mainstream service providers that had AI systems in resident-facing workflows, without the operational accountability layer that would surface problems before they cause harm.
The governance frameworks that NASCIO data reflects are real. So is the post-deployment gap. New York's AI policy revisions—notably the June 2026 update—take steps toward closing the monitoring gap documented in the state audit. The honest audit question for any agency with a deployed AI system is not whether there is a gap, but whether to close it now, in an orderly way, or under pressure after a failure.
If a state agency executive cannot name the person responsible for reviewing a deployed AI system's outputs this quarter, the accountability layer needs to be built. The intake review that approved the system did not build it.
Sources and further reading
- NASCIO 2026 State CIO Top Ten Priorities, NASCIO, December 2025
- New York State Artificial Intelligence Governance, Report 2023-S-50, New York State Comptroller, April 2025
- New York City OTI Artificial Intelligence Governance Follow-Up, Report 2025-F-17, New York State Comptroller, August 2026
- 50 States, 50 Different Ways: Who Owns AI Once It's Deployed?, GovTech, August 5, 2026
- New York Acceptable Use of Artificial Intelligence Technologies, Policy NYS-P24-001, New York ITS
- Texas Responsible AI Governance Act, HB 149 (enrolled), 89th Texas Legislature, 2025
- Texas HB 3512 (enrolled), 89th Texas Legislature, 2025
- Texas HB 1709 (introduced), 89th Texas Legislature, 2025 (earlier TRAIGA draft with impact assessments)
- The Texas Responsible AI Governance Act: What your company needs to know before January 1, Norton Rose Fulbright, 2025
Spartan X advises state agencies on AI strategy, governance, and program architecture—including the operational design work that follows from pre-deployment frameworks: defining post-deployment monitoring responsibilities, testing protocols, and cross-agency escalation paths. The gap documented in these audits is a solvable operational design problem, and it is easier to design for in the architecture phase than to retrofit after a failure forces the issue.
