The National Association of State Chief Information Officers released its 2026 State CIO Survey on September 28, 2026. Fifty-one state and territory CIOs responded. The AI findings show how fast state governance has moved, and where it has not.
Policy has nearly caught up. According to NASCIO’s summary, 98 percent of states have enterprise AI policies and procedures, up from 76 percent in 2025. Eighty-eight percent have guardrails for responsible use, security, and ethics. Eighty-two percent have an advisory committee or task force. Seventy-eight percent have adopted an AI governance framework, up from 65 percent.
Contracts and money lag. Sixty-one percent have procurement terms and contract provisions for generative AI, up from 41 percent. Forty-nine percent require software providers to disclose their use of AI. Twenty-eight percent report dedicated AI funding, up from 25 percent.
Use is ahead of both. Ninety-six percent of employees in CIO organizations use generative AI tools in daily work, up from 54 percent two years earlier. Eighty-two percent of states have AI projects in production. Thirty-five percent run enterprise-scale projects across the executive branch, the first year NASCIO has tracked that. Twenty-nine percent already use agentic AI, systems that take actions on their own, and another 35 percent plan to.
The figures are self-reported by CIOs. They show whether a state has contract terms, not how strong those terms are. We worked from NASCIO’s published summary and GovTech’s coverage, not the full report.
Nearly every state has an AI policy. About six in ten have put AI terms in their contracts.
Why it matters
A policy binds a state’s own employees. A contract binds the vendor. About four in ten states have no generative AI terms in their contracts. There, vendor conduct runs on the vendor’s own terms.
The disclosure number is the sharper one. Software a state already owns can gain AI features through an update. Where a contract does not require disclosure, the state may not know when that happens.
Agentic AI raises the stakes. An agent that takes actions needs contract terms for permissions, logging, and the right to stop it. Those go a step beyond the generative AI clauses that four in ten states still lack.
For vendors and local governments, the trend line is the signal. The share of states with AI contract terms rose 20 points in a year. Expect AI clauses at renewal, not just at award.
Questions for your contracts
- Do your contracts require a vendor to disclose when it adds AI to a product you already own?
- Do they cover use of your data for training, notice of model changes, audit logs, and your right to suspend use?
- Who reviews AI terms at renewal, not only at award?
- Is there a budget line for AI governance, or does it ride on project funds?
- Do your agentic AI pilots have terms for what the agent may do and how its actions are logged?
A policy tells staff what they may do. Only the contract tells the vendor.
Sources