What the 2026 numbers actually show
The 2026 NASCIO State CIO Survey, fielded in summer 2026 and covering 51 state and territory CIOs, is the clearest picture of where state AI programs stand in a year when AI finally displaced cybersecurity at the top of the NASCIO priorities list—ending cybersecurity's 12 straight years at the top.
The adoption curve is steep but uneven:
- 98% have enterprise policies and procedures on AI development and use (up from 76% in 2025)
- 94% are running AI pilots
- 92% have proofs of concept underway
- 82% have AI in production
- 78% have adopted an AI governance framework
- 61% have GenAI-specific procurement terms
- 35% report instances of enterprise-scale AI projects across the executive branch (first year this was asked)
- 28% have dedicated AI funding (up from 25% in 2025)
The first observation is that governance adoption has outrun funding by a wide margin. Nearly every state CIO has an AI policy. Only about one in four has money specifically set aside to run what that policy governs. The second observation is that the step to enterprise scale is where programs are stopping. Eighty-two percent of CIOs have something running in production; fewer than half report enterprise-scale deployments across the executive branch.
That is not a small gap. It represents a substantial portion of state AI programs that are technically live, organizationally real, and operationally insufficient for the scale the governance frameworks anticipate.
Three structural barriers behind the gap
Funding that was designed for pilots
Pilots and proofs of concept are commonly funded from discretionary technology budgets, innovation grants, or federal pass-through dollars with defined end dates. Those funding sources work well for early-phase experimentation. They do not work for sustained enterprise operations, which require recurring appropriations for model maintenance, data infrastructure, change management, and security monitoring.
One state CIO's comment illustrates this. They described lacking "dedicated funding for AI which makes it difficult to move quickly with additional pilot projects, proofs of concepts, and expanding the sandbox." The absence of a recurring budget line is not a temporary oversight—it reflects a structural mismatch between how state budgets are built and how AI programs grow. State budget cycles run on annual or biennial appropriations rhythms. AI operating costs are continuous and compound as systems handle more workload, connect to more data sources, and require ongoing monitoring for bias, drift, and security.
A production AI deployment running on pilot-era funding is not enterprise AI. It is a pilot that survived past its original timeline.
Measurement that hasn't caught up
NASCIO's survey reveals a striking gap in self-knowledge: when asked to estimate the number of GenAI projects in production, CIOs gave answers ranging from "four" to "thousands." Some had difficulty even estimating the number, noting that AI is now embedded in so many activities it is difficult to count separately. If a state CIO cannot reliably account for what is running in production, they cannot make an evidence-based case for recurring appropriations, cannot prioritize where to invest next, and cannot demonstrate to oversight bodies that the enterprise AI governance framework is doing anything.
The same survey reports that 77% of states are already inventorying and documenting AI uses. The gap is not that inventories don't exist—it is that they don't capture production reality. AI projects often start inside a single agency under a different program name, get deployed through a software vendor's existing contract, or run as a module inside a larger system without being tracked as an AI use case. By the time the CIO office tries to reconcile the inventory against what is actually live, the deployment footprint is already dispersed.
This creates a credibility problem at the moment it matters most: when CIOs are making the case to appropriators that AI deserves a dedicated budget line. Without a clear account of what is in production, what it costs to run, and what it has changed, the funding argument cannot be made with specificity.
Workforce that was hired for discovery, not operations
The skills needed to run a successful pilot—problem identification, vendor evaluation, data preparation, change management for a small team—are not the same as the skills needed to operate AI at enterprise scale. Enterprise-scale AI requires ongoing model monitoring, incident response capability for model failures and adversarial inputs, agency-side training programs that keep staff current as the system changes, and coordination infrastructure across the enterprise.
The survey lists upskilling current staff, training investments, and talent pipeline development as the top workforce strategies—which correctly identifies the problem but also signals that the transition is still in progress. Most state technology teams appear to have upskilled primarily for the pilot and PoC stage. A state running production AI with a team whose training ended there is operating with a skills gap that grows as the deployment scales.
What enterprise scale actually requires
The difference between a production AI deployment and an enterprise AI deployment is not primarily model capability—it is operational infrastructure. Enterprise-scale AI in a state environment requires:
A recurring budget line. One-time and grant funding is not a sustainable operating model. The ask to appropriators at this stage is different from a pilot request: it is a recurring operations cost, not a one-time investment. It is worth noting that only 28% of states report dedicated AI funding while 35% report enterprise-scale instances, which means some states have reached that threshold without a dedicated line—likely through reallocation within existing IT budgets or on extended pilot-era funding. Neither is designed for sustained operations.
A reconciled use-case inventory. The CIO office needs to know what is deployed, in which agencies, under what contracts, with what data access, and at what operating cost—and that inventory needs to match what is actually running, not what was once approved. Without reconciliation, the CIO cannot manage security exposure, cannot identify where model drift is a risk, and cannot plan for model refresh cycles.
An incident response protocol for AI. Production AI failures are operationally different from application outages. They include model drift (the system degrades gradually without a visible error state), adversarial inputs (someone deliberately skewing outputs), and silent accuracy failures (the system returns a confident wrong answer). Most state IT incident response playbooks were not written for these failure modes. Enterprise-scale AI programs need a separate response protocol and a team that knows how to execute it.
Agency-side accountability. At enterprise scale, AI governance cannot sit entirely in the CIO office. Agencies deploying AI against resident services need designated staff responsible for monitoring outputs, handling escalations, and conducting periodic reviews of model performance against stated objectives. NASCIO's survey found 88% of states have responsible-use guardrails in place, but guardrails are policy—accountability is organizational. The two are not the same.
The agentic AI inflection and why timing matters
Sixty-four percent of state CIOs told NASCIO that agentic AI will be the most impactful emerging technology in the next two to three years. Only 29% are currently using it; 35% have it planned.
Agentic AI—systems that take multi-step actions, integrate with external tools, and make consequential decisions without human review of each step—has a different operational profile than the generative AI currently running in most production state deployments. The survey notes that early state agentic deployments are predominantly internal. One CIO described their intent as proving it internally, with a human accountable for every consequential action. That accountability structure is a design requirement, not a default: the gap from production to enterprise that most states have not yet crossed becomes more consequential when the systems involved can initiate procurement actions, modify records, or affect service eligibility without a human in the approval chain.
States that build operational infrastructure for enterprise-scale AI in 2026—recurring funding, measurement systems, incident response protocols, and agency accountability structures—are positioning themselves to govern agentic deployments responsibly when they arrive. States that remain in the production-pilot gap are not.
The 2026 NASCIO survey was fielded in a year when 36 states held gubernatorial elections on November 3, 2026. Many of those races will likely bring new state CIOs in early 2027, and those incoming CIOs will inherit AI programs that are technically in production but structurally underprepared for the scale they are being asked to govern. The specific problem they will face is not the absence of a policy—98% of states already have one—but the absence of the operational infrastructure that makes the policy enforceable.
The decision the CIO needs to make now
If your state's AI program is in the production layer—pilots are live, some things are running, the governance framework exists—the question is not how to prove AI works. It is how to close the gap to enterprise scale before the next budget cycle, the next CIO transition, or the next agentic deployment.
A practical starting sequence:
- Reconcile the inventory against production reality. Most states have an AI inventory of some kind; the problem is that CIO estimates of production AI projects still range from "four" to "thousands." A scoped effort to map active deployments against the existing inventory—covering data access, operating costs, agency owners, and contract vehicles—is the prerequisite for the funding argument and the incident response plan.
- Separate operating costs from project costs. In budget materials, distinguish the recurring cost of running current AI deployments from the investment cost of expanding them. Appropriators understand the difference; conflating them produces requests that look like new spending rather than operational continuity.
- Identify the highest-risk production deployments. Which AI systems are making or influencing decisions that affect resident services, benefits, or compliance outcomes? Those require the incident response protocol and the agency accountability structure first—before you scale them further.
- Align workforce development to operations, not discovery. The skills gap the survey identifies is real; the training programs needed now are model monitoring, adversarial input recognition, and AI incident response—not use-case identification.
The case for staying at the production layer is real in some contexts: keeping high-risk use cases at agency scope, with designated human accountability, may be the right model for systems that affect benefits or compliance outcomes. What is not sustainable is remaining in the production layer because operational infrastructure was never built, not because it was deliberately scoped that way.
Spartan X's work in state-level AI program design and execution—AI strategy, architecture, and delivery of state platforms—addresses the operational layer where most programs stall: translating enterprise AI policy into repeatable practice when the governance framework exists but the infrastructure to enforce it does not.
