The Numbers and What They Reflect
The 2026 survey's inventory figure — 77% of state CIOs report inventorying and documenting GenAI uses across agencies and applications — is down from 84% in NASCIO's 2025 survey. NASCIO did not explain the 7-point decline.
The companion figure is the operative one. Only 49% of states report requiring disclosure by software providers, up from 41% in 2025. That 8-point gain is real progress. The remaining gap — 28 points between inventory practice and disclosure requirements — leaves open the question of completeness: a state can count what it has purchased while having no contractual claim on what AI capabilities arrived in the installed base since.
Rounding out the picture: only 28% of state CIOs report dedicated AI funding, and 64% named agentic AI as the most impactful emerging technology they expect to encounter in the next two to three years.
The 61% of states now including AI provisions in GenAI procurement terms — up from 41% in 2025 — is the most direct governance lever. Procurement terms are where policy gets operationalized. But those terms primarily govern new purchases. The gap is in what happens after the contract is signed.
How AI Enters Without Triggering Review
Enterprise SaaS platforms have fundamentally changed how AI reaches state agencies. When a state buys a new AI analytics platform, procurement happens, the acquisition goes through review, and the item enters the inventory. That is the model most state AI governance frameworks are built around.
That is not the primary way state agencies are encountering AI in 2026. One state CIO responding to the 2026 survey noted that production AI is difficult to count because AI is now "embedded in so many activities" — an acknowledgment that the inventory challenge goes beyond enumerating purchases.
The clearest public example is Microsoft 365 Copilot Chat, which became available to existing Microsoft 365 GCC customers at no additional cost — no new procurement action, no contract modification required. Full Microsoft 365 Copilot, with its broader feature set, is a separately purchased add-on license on eligible government plans. That distinction illustrates the split that matters: some AI arrives through procurement, and some arrives through platform updates to contracts already in place. For the latter, an AI disclosure requirement in new contract templates does nothing unless it also covers the installed base.
Where a state's existing contract with a software vendor contains no disclosure requirement, the state CIO may not learn that an AI capability is active until a staff member encounters it, or a vendor account manager mentions it in a renewal conversation.
That is the author's explanation for the 28-point gap. The inventory process asks what the state bought. The question it does not reliably answer, without a disclosure obligation in existing agreements, is: what AI is my deployed software running right now?
Why Existing Contracts Don't Fill the Gap
Improvements to procurement term templates address the right problem for future contracts. They do not reach existing multi-year SaaS agreements — often the highest-volume platforms the state operates — that were written before AI transparency was a contract concern. Renegotiating a mid-term disclosure obligation requires either leverage (a renewal approaching) or explicit legal authority to compel it.
The practical implication: a state CIO's AI inventory, even a carefully maintained one, reflects the AI capabilities the state explicitly purchased while likely undercounting AI capabilities that arrived through platform updates or licensing tier changes in existing agreements.
For high-stakes applications — benefits eligibility processing, case prioritization, fraud detection, resident-facing chatbots — the question of whether an AI component is active, what it does, and what data it was trained on is not incidental. It drives accuracy assessment, bias auditing, and appropriate-use determinations. An inventory that cannot answer it is not adequate governance.
What Adequate Disclosure Looks Like
The federal government has been building exactly this kind of ongoing notification obligation into AI contracts. GSA issued a new clause — GSAR 552.239-7001, "Basic Safeguarding of Artificial Intelligence Systems" — first as a proposed GSAR Deviation in early 2026 (comments closing April 3, 2026) and in final form October 19, 2026 (MAS Refresh 34). The final clause applies to contracts where a large language model is a material feature and government data is processed, not to cloud services generally. The final terms differ from the draft; in the draft, the change-management section (§h) asked contractors to make reasonable efforts to provide agencies concurrent access to successor AI models 30-to-15 days before cutover and to notify the government within 7 days of AI service changes that materially affect bias, accuracy, or safeguards.
That framing — ongoing notification built into the contract, not just an at-purchase disclosure — is the mechanism state procurement terms largely lack. It is worth reading as a model, with appropriate adaptation for state contract law and procurement authority.
Georgia's enterprise IT standard SS-23-002 provides a state-level parallel: it requires contractors to identify any third-party AI models used, disclose what state data those models process and whether they use it for training, and communicate how material AI changes will be reported. That is an enterprise governance standard issued under O.C.G.A. 50-25-4, not a legislative mandate — but it applies through mandatory state contract terms, not voluntary agency adoption. But it demonstrates that the disclosure framework is not speculative — states have written it.
State CIOs designing vendor disclosure requirements have several elements to work from. A well-scoped disclosure obligation for an existing SaaS agreement would minimally require vendors to:
- Notify the state at least 30 days before activating a new AI feature that affects automated decision-making or processes personally identifiable information
- Identify the specific data the AI component processes, the purpose it serves, and the training data lineage if applicable
- Disclose whether the AI component is enabled by default or requires opt-in activation
- Provide a mechanism to disable or limit the AI feature pending state review
These requirements do not prohibit AI — they create a review window. For agentic AI features in particular, the activation question is especially important: an agentic workflow that acts on state data without a review event is a materially different risk posture than one that required explicit procurement.
Closing the Gap: Three Actions for State CIOs
Addressing the inventory gap does not require waiting for new legislation or new contracts. Three actions can begin closing it in existing environments.
Audit existing SaaS agreements for AI disclosure provisions. Most won't have them. The audit output is a list of gaps with renewal dates, which becomes a prioritized renegotiation agenda. High-volume, high-stakes platforms go first — benefits systems, case management, identity, fraud detection.
Issue a vendor disclosure request to critical SaaS providers. Outside of contract renegotiation, a formal written request to major vendors asking them to disclose current and planned AI features, their data handling, and default activation status is a reasonable governance step. Many vendors will respond. Those that do not are identifying themselves as governance risks at the next renewal.
Build a vendor AI inventory supplement. The procurement-sourced AI inventory should be supplemented with a vendor-sourced register populated by disclosure responses, account manager conversations, and periodic platform audits. It is a manual process until disclosure requirements are contractually established — but it is the only way to close the gap in the interim.
The Policy Direction
State legislation is moving toward requiring AI transparency as an operational obligation, not just a best practice. Connecticut Public Act 23-16 (effective July 1, 2023) requires the Department of Administrative Services to maintain an annual state AI inventory — the first was due December 31, 2023 — and requires state agencies to complete impact assessments before implementing new AI systems, beginning February 1, 2024. That is the inventory side. The disclosure side — requiring vendors to report AI capabilities in existing contracts — is less settled in statute, though state enterprise IT standards like Georgia's SS-23-002 demonstrate the framework is writable.
The direction is toward more disclosure, not less. Agencies that build vendor disclosure into contract practices now will be ahead of the compliance requirement. More practically, they will know what they are running.
Sources and further reading
- NASCIO, *The 2026 NASCIO State CIO Survey: The State CIO in Motion: Priorities, Pressures and Progress*, nascio.org
- NASCIO, *The 2025 State CIO Survey*, nascio.org
- NASCIO, *Beyond Generation: The Rise of Agentic AI in State Government* (March 2026), nascio.org
- GSA, *Proposed GSAR 552.239-7001: Basic Safeguarding of Artificial Intelligence Systems* (FEB 2026 GSAR Deviation draft), buy.gsa.gov
- Georgia GTA, *Artificial Intelligence Responsible Use (SS-23-002)*, gta-psg.georgia.gov
- Connecticut General Assembly, *Public Act 23-16* (An Act Concerning Artificial Intelligence), cga.ct.gov
- Microsoft, *License options for Microsoft Copilot*, microsoft.com
- Microsoft, *Microsoft 365 Copilot for GCC Generally Available* (Dec 2024), techcommunity.microsoft.com
- Wiley Rein, *GSA Releases Final Language of AI Contract Clause* (Oct 2026), wiley.law
Spartan X has advised state government leadership on AI strategy and governance. That work extends to the vendor side: disclosure templates, AI use registries that capture embedded product features, and assessments of existing SaaS portfolios for AI components are part of Spartan X's AI governance practice.
