AI adoption, public services, and modernization for state and local government.
Latest articleJess Loban
Maryland law now requires its IT department to staff a technical procurement team with technology and agile procurement expertise. The statute targets the right problem. Two things it leaves open will determine whether the team changes any award outcome.
Read articleAI adoption, public services, and modernization for state and local government.
81 articles · Newest first · Latest article featured above
Close to half of the applications to the Public Benefit Innovation Fund's first round proposed chatbots. Its new $11M round funds the administrative work behind eligibility instead, and SNAP's merit-staffing rules explain why that matters: federal regulation reserves certification to state merit-system personnel, which sets the boundary between what AI can assist and what only state employees can decide.
NASCIO's 2026 State CIO Survey reports 49% of states require disclosure by software providers — but 77% are inventorying GenAI use. That 28-point gap raises a governance question: if AI capabilities arrive as feature updates to deployed software rather than through new procurement, does the inventory count them?
State cybersecurity confidence has collapsed to 22% as budget growth stalled. The 2026 NASCIO-Deloitte study shows 49% of CISOs naming measurement frameworks a top-five initiative — a signal that the most defensible budget arguments frame cybersecurity in financial and operational terms, not technical ones.
Federal cost-sharing under the One Big Beautiful Bill Act creates real financial pressure for states to deploy AI fraud detection in SNAP and Medicaid — but the states that build programs that last are the ones that solve data quality, explainability, and due process architecture first. Michigan's MiDAS system is the documented cost of skipping those steps.
State AI governance frameworks cover most states, but two consecutive New York State Comptroller audits document findings that together point to the same structural gap: approval-stage accountability does not carry through to deployed systems. This is what the post-deployment layer requires.
NIST IR 8547, published October 2026, sets the quantum transition timeline: quantum-vulnerable algorithms are deprecated after 2030 and disallowed after 2035. State agencies aren't formally covered by EO 14412 or OMB M-26-15, but adversaries may be harvesting encrypted state data for future decryption, and federal program requirements are expected to cascade PQC obligations through CJIS, IRS Pub 1075, and HIPAA as NIST's deprecation schedule takes effect. CJIS SC-13 made FIPS 140-2 certificates 'not acceptable' after September 21, 2026. The cryptographic inventory must start before the compliance triggers arrive.
NASCIO's 2026 State CIO Survey shows 82% of states have AI in production—but only 35% report instances of enterprise-scale AI deployments. The gap isn't purely technical. It's a funding structure, measurement, and workforce problem that most programs haven't been designed to solve.
On August 24, 2025, ransomware encrypted the virtual infrastructure supporting 60+ Nevada state agencies. Twenty-eight days later, the state had fully recovered without paying ransom and without missing a payroll cycle. The Governor's Technology Office's official After-Action Report identifies what made that speed possible — and much of it was in place before the incident began.
Roughly one-fifth of state CISOs indicated their states were moving toward a whole-of-state cybersecurity model, even as 63% say they are 'not very confident' in the ability of local government and public higher education to secure public data. The detection gap is real—and the states that have closed it show that legal authority, technical integration, and incident response coordination must be in place before the right monitoring tool even matters.
Colorado repealed its comprehensive AI risk management law before it ever took effect and replaced it with a narrower ADMT disclosure statute. For state program directors, interpreting that change as a reduction in governance obligations carries real operational risk. The legal minimum narrowed; the conditions that made oversight necessary did not.
FedRAMP's AI prioritization initiative put ChatGPT Enterprise, Gemini for Government, and Perplexity on the FedRAMP Marketplace in early 2026. A vendor's FedRAMP certification is evidence a state agency can use, not authority to operate the service, and the certification's boundary stops where the agency's own integrations begin.
January 1, 2027 brings Medicaid community engagement requirements to 44 jurisdictions and six-month redeterminations to ACA expansion states. Montana's July 2026 implementation — hold-harmless through September, enforcement beginning October — shows what it costs to learn the system gaps in production.
Florida's PALM financial system goes live on January 12, 2027, with all state financial systems offline from December 23 until catch-up or go-live. The final sprint before a major ERP cutover is where programs that survived years of preparation can still fail — in governance gaps, interface blind spots, and data exceptions that only appear at scale.
H.R. 1 converts SNAP payment error rates into a direct state budget liability starting October 2027. Most states currently exceed the 6% threshold where cost-sharing begins. The eligibility system decisions that were easy to defer are now time-bound financial exposure.
In New York's fall 2025 AI pilot, 87% of participating state employees had no prior generative AI training. States are now choosing between tool-gated training, statutory mandates and voluntary communities of practice, and each choice decides who uses AI without a shared baseline.
The Trump administration's May 2025 termination of $675 million in ARPA grants to unemployment insurance programs halted or cut back modernization work in more than 30 states and territories. A 14-state coalition filed suit on October 8, seeking money damages — not project restoration. New York, itself a coalition plaintiff whose ARPA grants were also terminated, is proceeding with the cutover that begins November 2 to replace its 50-year-old system. What each recovery path requires, and what program directors with partial work and no replacement funding need to decide this budget cycle.
Virginia's October 23 directive is notable not just for the incidents the Governor cited, but for the governance architecture it established: a Cyber Consortium embedded within the Unified Readiness Framework, with the AI Task Force's existing cyber-risk mandate expanded and formalized. Other state CISOs should examine this structural decision now.
The State and Local Cybersecurity Grant Program's statutory requirements terminated September 30, 2026, and no new funds have been appropriated. The Senate has not moved on reauthorization. State CISOs who built cybersecurity programs on four years of SLCGP funding now have weeks before budget submission season opens: audit what was purchased, identify which capabilities survive without the grant, and make the budget case before the funding gap becomes a posture gap.
The GSA finalized a contract clause for large language model procurements on September 28, 2026, effective October 19. With 39% of state and territory CIOs surveyed not yet reporting AI-specific procurement provisions, the federal standard names the exact terms that state contracts need to address.
All 56 BEAD Final Proposals are now approved. Construction is starting. The September 2026 Supplemental Deployment Policy Notice adds another location-verification round. State broadband offices and CIOs that haven't yet stood up grant management and data systems are already behind.
Texas TRAIGA has required state and local governmental agencies to disclose AI interactions to residents since January 2026. Colorado SB 26-189, effective January 1, 2027, adds notice, adverse-outcome explanation, and human review obligations whose application to public agencies is a live legal question — but whose covered domain centers on essential government services. Most state AI governance programs were built to manage vendor risk — not to generate the compliance mechanisms that may now apply to the agencies' own deployments.
Budget and cost control jumped from sixth to third on NASCIO's 2026 priority list in the same year AI took the top spot. Usage-based AI pricing does not fit budget structures built for fixed licenses, and the next budget cycle is already under way.
The Department of Justice extended ADA Title II's digital accessibility deadline to April 2027, citing resource constraints and slower-than-expected AI remediation tools. The extension shifts a date. It does not relieve state agencies of an obligation that predates the 2024 rule — and states that treat the extra year as permission to wait are likely to arrive at 2027 in the same position.
State governments are deploying AI systems into production without AI-specific incident response plans. The NIST AI RMF's MANAGE function defines the operational requirements — but the state policies we reviewed do not define AI incidents, response timelines, or incident ownership. When a model drifts, produces discriminatory outputs, or fails silently, generic IT incident procedures don't fit.
With 39 gubernatorial elections on November 3, state IT organizations face predictable leadership disruption. The window to build transition documentation that keeps programs on track is now.
NASCIO and the Urban Institute each published guidance for state governments on agentic AI governance in 2026. The accountability challenges these systems create — upstream decision-making before human review, public records obligations on agent outputs, and action-layer security exposure — are structurally different from what existing state AI governance frameworks were built to address.
States administering federal programs are deploying AI across eligibility, fraud detection, and case management without the documentation federal reviewers and single auditors will ask for. OMB M-25-21 binds only federal agencies, but the agencies overseeing Medicaid, SNAP, and unemployment insurance are now required to inventory their own AI, and single audits already test internal control over compliance for the major federal programs those systems administer. The state that builds its AI inventory now controls the narrative when oversight arrives.
Modular IT procurement is the structurally correct answer to large-contract failure. But it trades vendor dependence for internal product management capacity most agencies do not yet have. Before splitting the contract, assess whether you have what modular actually requires — and know what to do when you do not.
Iowa expects to pay Cognizant and AWS an estimated $419.7 million over ten years to run and modernize its executive branch IT. The state cost comparison projects about $530 million in savings, with an assumption of rising hardware costs as a significant driver. 192 state employees received layoff notices, and the governance questions — oversight capacity, data compliance, exit strategy — will determine whether the model holds up.
The SLFRF expenditure deadline is December 31, 2026. State technology programs built on ARPA funding face two distinct problems before that date: a federal audit close-out and a system sustainability question. Both require decisions that cannot wait until November.
NIST CSF 2.0 added a Govern function in February 2024 that sits above the original five. It asks for evidence that cybersecurity risk management connects to organizational decision-making, budgeting, and authority — not just that controls are deployed. In our experience, many state agencies can demonstrate control coverage more readily than governance coverage in the terms CSF 2.0 now specifies.
Most states still issue magnetic-stripe EBT cards that criminal skimming operations exploit at scale. Chip migration is the right response, but a chip card program without coordinated terminal upgrades, fraud detection recalibration, and benefit recovery infrastructure closes far less of the gap than early results suggest.
State finance and HR system replacements fail more predictably than most agencies acknowledge. The organizational preconditions — data ownership, process authority, change management resources, oversight capacity, and governance structure — must be in place before the RFP, not assembled alongside it.
CISA's proposed CIRCIA rule would cover state, local, tribal and territorial government entities serving jurisdictions of 50,000 or more people, which includes every state government. State CISOs who have not started the organizational design work (designating a reporting official, scoping covered agencies, establishing inter-agency notification) will be short on time once the final rule sets its effective date.
NASCIO ranked AI at the top of state CIO priorities for 2026—the first time it has displaced cybersecurity in twelve years. Separate NASCIO research shows only 22 percent of responding states have a dedicated data quality program, and only 4 percent of state CIOs describe their data governance as very mature. That gap has a predictable cost.
State and local government entities face elevated ransomware exposure, and in Spartan X's assessment, cyber insurers increasingly ask for evidence rather than attestations. Also in our assessment, documentation gaps — not control gaps — are a primary source of friction state CISOs encounter at renewal.
At least three states issued AI executive orders between March and September 2026, and California issued two, transferring specific technical and procurement obligations to state technology and procurement offices (California's DGS and CDT, Oregon's State CIO, and an Illinois cabinet supported by DoIT). California's N-5-26 deadlines have passed; its follow-on N-9-26 sets a November 16, 2026 recommendation deadline, and Oregon's CIO has until December to define frontier AI and propose review criteria. For state technology leaders, this is an engineering and contracting problem, not a policy exercise.
Zero trust programs, AI-assisted threat detection, and incident response all require centralized log infrastructure, and where a state’s logging is fragmented across agencies, those programs rest on a gap. The sequencing decision is to resolve the log gap first, or at least in step with control deployment.
Most state agencies administering Medicaid, SNAP, or unemployment insurance receive Federal Tax Information. IRS Publication 1075 follows that data wherever it goes—including into cloud platforms—and the compliance gaps that cloud migration creates are exactly what the IRS audits.
Demos, reference contracts and security questionnaires are useful starting points. State AI buyers also need evidence of performance on their actual workloads, clear monitoring obligations and a workable process for correcting errors.
Enterprise AI can arrive through an existing software relationship. State agencies need to connect platform activation, data access, and model changes to their applicable review requirements—and verify that approved controls are operating.
States are committing to AI across benefits, fraud detection, and service delivery — but many have not yet built the data governance foundation those systems actually require. The gap is structural, not technical, and it shapes outcomes before a model is ever trained.
Federal reviews of Medicaid unwinding identified individual-level renewal errors, excluded populations, and missing response channels. Those findings give states concrete acceptance tests for eligibility rules, data exchange, contact management, and surge capacity.
The federal CCWIS record shows slow modernization, not a simple project failure rate. State buyers can use its lessons to improve program-IT governance, readiness testing, and workforce continuity.
NASCIO found that 31 percent of surveyed CIO budgets fund critical-infrastructure cyber support for local governments and special districts. A credible whole-of-state plan must map authority, funding, and actual service coverage.
Cryptographic credentials can strengthen identity verification, but states still need trustworthy enrollment, protected recovery, accessible alternatives, and separate eligibility checks.
Nevada's ransomware recovery and SOC legislation show why monitoring, response authority, agency agreements, and technical visibility must be designed together.
NASPO ranks procurement modernization first for 2026. A measured baseline helps states define success, evaluate automation, and improve agency and supplier experience.
Illinois's frontier AI audit requirement gives state buyers a useful assurance reference. Contracts still need deployment-specific testing, evidence access, change control, and remedies.
Consolidation is back in NASCIO's top ten. The useful question is which shared decisions and services will improve AI governance, security, and data quality—and how agencies will retain the expertise their missions require.
North Carolina, Nevada and Minnesota illustrate differing cloud-assurance requirements. State buyers need to connect exact product status and evidence with policy scope, renewals and transition planning.
MS-ISAC continues under a member-funded model. State and local buyers need to verify retained coverage, costs, grant conditions, and response continuity before contracts change.
Connecticut strengthens state AI inventory and procurement rules in October 2026, while employment-technology notice duties have separate October 2027 deployment triggers. Agencies need a use-case inventory, documented assessments, and a precise compliance calendar.
California's Executive Order N-5-26 provides for independent state review of federal AI supplier designations. State buyers still need to check binding obligations and establish their own evidence-based procurement decisions.
State hiring processes, compensation, classifications, and career paths can constrain technology delivery. Measure the local bottlenecks and preserve internal decision authority as capacity expands.
The January 1, 2027 federal Medicaid community-engagement date tests state eligibility systems, data exchange, notices, and exception handling. Readiness requires an end-to-end service plan.
DOL's 2026 enforcement warning and modernization audit put measurable outcomes in focus. State UI teams need clear evidence linking investments to reliability, access, and specific integrity controls.
The ARPA closeout calendar tests more than spending: states need a funded operating model for technology that must keep running after temporary federal support ends.
CMS interoperability requirements span different deadlines. The useful test is whether Medicaid APIs expose accurate, governed data and produce the reporting evidence programs need.
Washington's school-funding audit illustrates a transferable risk: a critical service can keep running while recovery knowledge rests with too few people.
Kansas offers a useful modernization case. The transferable lessons concern data quality, workflow design and evidence behind reported results—not a guarantee that another state can copy the same timeline.
The Department of Justice gave state and local governments an extra year to meet digital accessibility standards. The added time is an opportunity to strengthen procurement, testing and ongoing service ownership so accessibility survives each release.
Digital service teams need authority, multidisciplinary skills and a workable delivery environment. Assess those conditions alongside hiring so new capacity produces better resident services.
NASCIO's March 2026 report named the shift from AI that advises to AI that acts. Agencies need to check whether existing governance covers action authority, tool permissions and recovery when an AI system can execute a workflow.
Interoperability requires both reliable interfaces and a lawful, repeatable approval process. State data leaders can reduce one-off negotiation without bypassing privacy or program restrictions.
State AI ambitions require an operating team: people who can integrate, evaluate and sustain the service. Digital delivery capacity needs a staffing plan, authority and a durable budget.
AB 869 proposed zero trust maturity deadlines but stalled in Senate Appropriations in August 2025 and was not enacted before the Legislature's August 31, 2026 deadline. Its useful lesson is how to sequence identity, access and monitoring work with evidence.
AI leads NASCIO's 2026 priorities after cybersecurity held the top position for twelve years. States now need funded evaluation, data and workforce capacity behind the ambition.
The 2026 NASCIO–Deloitte study highlights pressure on state security programs. Its findings are a starting point for operational measurement, shared-service design and vendor accountability—not a breach-risk score.
A vendor can deliver a platform, but government still needs the people and authority to own its service. NYC offers a practical example of building that internal capacity.
Automated fraud tools need measured precision, representative data and a review path. A historical Michigan unemployment case offers a caution—not evidence of a recent SNAP audit.
Stronger identity checks can stop impostors and still strand eligible applicants. Benefits agencies need to measure fraud prevention, false rejection, and recovery together—and design the service around all three.
Cooperative purchasing can share the work of buying AI; modular contracts can preserve the option to change it. The value depends on local evaluation, clear interfaces, and an exit plan the agency has actually tested.
The federal counter-UAS framework creates a conditional path for eligible agencies. Training, authorized systems, coordination, reporting and privacy must be designed before procurement.
A new platform cannot resolve business rules the agency has yet to understand. State modernization teams need a rule inventory, a tested migration sequence, and a clear plan for retiring the old system.
A county can lose essential services through a shared vendor as well as its own network. Security agreements, access controls, and recovery exercises need to account for both paths.
California directs agencies to develop AI procurement safeguards. The practical opportunity is to make vendor claims testable, while distinguishing recommendations from binding contract requirements.
Reliable renewals depend on more than a new portal. States need data matching, usable interfaces and a way to resolve conflicting records without creating unnecessary work for residents.
North Carolina and Nevada are putting cloud assurance into contracts. Vendors need a product-specific authorization plan and a clear reading of each state’s transition rules.
Shared security services need recurring funding, clear participation agreements and evidence of coverage. The SLCGP transition makes those operating decisions harder to defer.
Rules discovery, surge testing and accountable automation belong in the requirements—not on a list of problems to solve after launch.
STAY INFORMED
Explore our solutions or get in touch to discuss how Spartan X is building the next generation of defense technology.