How U.S. States Are Rolling Out Generative AI Faster Than They Can Govern It

U.S. state governments are deploying generative AI to their workforces at a rapid pace—but accountability frameworks aren't keeping up. By late 2024, 82% of state CIO organizations had employees using generative AI tools daily, up from 53% just a year earlier, according to NASCIO. Yet only 24% of states had data governance in place for those tools, according to a Pew survey.

The Gap Between Deployment and Governance

New York expanded its AI Pro assistant—built on Google Gemini—from a 1,200-person pilot to more than 100,000 state employees. Every prompt typed by a government employee passes through Google's infrastructure, but no public documentation clarifies what data protections apply or whether Appendix C-AI vendor contract protections extend to the Google relationship. New York's Comptroller had flagged the governance gap months earlier: a 2025 audit across four agencies found the state's AI policy lacked adequate guidance—called "a wake-up call"—yet the full rollout proceeded twelve months later.

What Better Governance Looks Like

Pennsylvania offers a contrasting model. Before expanding ChatGPT Enterprise to 3,000 employees across 35 agencies, it:

• Negotiated a binding side letter with SEIU Local 668 protecting workers from AI-based disciplinary decisions
• Built governance infrastructure under Executive Order 2023-19, including a Generative AI Governing Board
• Required employees to complete InnovateUS training before gaining access—not merely alongside it

New Jersey similarly surveyed its public-sector workforce before finalizing its governance framework, with survey results directly informing policy recommendations rather than arriving after the fact.

Key Takeaways

• Governance frameworks should be in place before AI reaches the full workforce—not built concurrently or after
• Employee training should be required individually before access is granted, not recommended at the agency level
• Labor-impact studies should be commissioned alongside deployments and report before tools reach full scale
• Public documentation connecting vendor contract terms to specific deployments needs to be accessible and consistent

Read the full article on Tech Policy Press