The State and Local AI Governance Playbook: From Executive Order to Deployed Policy

Between 2023 and 2026, state government moved faster on AI governance than the federal government did. California, New York, Virginia, Texas, Colorado, and dozens of others issued executive orders, established AI advisory bodies, or enacted legislation requiring state agencies to inventory their AI systems, assess risks, and demonstrate compliance with defined governance principles. Most local jurisdictions followed with their own frameworks or adopted state-level guidance. The result: an AI system deployed in a state or local agency in 2026 will almost certainly need to pass through a governance review before it goes live.

This is not a temporary phenomenon. State AI governance is now permanent infrastructure. The agencies that treat governance as an obstacle to work around create friction with the reviewers who ultimately have to approve their deployments. The agencies that build AI governance readiness into their procurement and deployment plans from the beginning move faster, avoid rework, and build the credibility they will need for every subsequent AI system they want to deploy.

The Frameworks That Matter

NIST AI Risk Management Framework

The NIST AI RMF, published in 2023 and updated in 2024, is the foundational reference document that most state and local frameworks cite. It defines four core functions: Govern (establishing policies and accountability), Map (understanding the AI system context and risks), Measure (evaluating risks and impacts), and Manage (prioritising and treating risks). Most state AI governance frameworks are essentially state-specific implementations of the NIST RMF.

An AI system that has documentation aligned to the NIST RMF categories is significantly easier to move through a state governance review. Vendors that have prepared their systems for NIST RMF alignment save their government customers substantial time in the review process. Ask any AI vendor whether their documentation maps to the NIST RMF and how they help customers complete state governance reviews.

State-Specific Frameworks

State frameworks share common structural elements but vary in specifics. California's AI framework emphasises equity and non-discrimination impact assessment. New York's framework focuses on transparency and public accountability. Texas prioritises procurement guardrails and vendor contract requirements. Colorado, in the wake of the 2024 SB 205 AI accountability act, has particularly detailed requirements for high-risk AI systems that make consequential decisions about residents.

For any AI deployment, the practical implication is that governance requirements are specific to your state. Read your state's framework. Do not assume that a compliance pattern that worked in another state will work in yours. And do not assume that vendors have done this work for you: the primary responsibility for state framework compliance rests with the agency deploying the AI, not with the vendor supplying it.

The AI System Inventory Requirement

Nearly every state framework requires agencies to maintain an inventory of AI systems in use. The inventory typically documents each system's purpose, the vendor supplying it, the categories of decisions it makes or informs, the data it uses, and the risk classification assigned to it. Public-facing AI systems, systems handling sensitive data, and systems that support consequential decisions typically fall into higher risk categories with more stringent review requirements.

For AI search and chat deployed on a public government website, the inventory entry typically covers: the system name and vendor, the specific business purpose (public information retrieval, resident question answering), the data sources indexed, the demographic populations served, the escalation and human-review mechanisms, and the accuracy monitoring processes. Preparing this documentation in advance of the review, in the format your state's inventory template requires, prevents delays.

The Risk Assessment Question Set

Governance reviews typically use a standardised question set to assess AI system risk. The specific questions vary by state, but the categories are consistent. Preparing answers to these questions in advance dramatically accelerates governance approval.

1. 1What is the specific purpose of the AI system and what decisions does it make or inform? For AI search and chat, the purpose is information retrieval and question answering; the system does not make eligibility, benefits, or other consequential decisions. Being specific about the boundary matters.
2. 2What is the potential impact on residents if the system produces an incorrect output? For grounded AI search and chat, an incorrect output is a wrong or misleading answer to an information query. The mitigation is grounding, citation, and human-escalation options.
3. 3What data does the system use and how is it protected? For public-facing AI search, the answer is: publicly available website content only. For AI chat, the answer includes conversation logs, retention policy, PII handling, and vendor training data usage prohibitions.
4. 4How is bias assessed and mitigated? For AI search and chat, bias risks include differential performance across languages, differential handling of queries from residents with lower literacy or non-standard English usage, and content prioritisation that may inadvertently disadvantage certain populations.
5. 5What accessibility and equity considerations apply? WCAG 2.1 AA compliance, multilingual support, screen reader compatibility, and cognitive accessibility considerations all need to be documented.
6. 6How is the system monitored post-deployment and what interventions are available if issues emerge? Accuracy monitoring, resident feedback mechanisms, escalation processes, and the ability to update or restrict the system's behaviour without a full redeployment cycle.
7. 7How is human oversight maintained? For public-facing AI, human oversight typically means a named staff owner, regular review of system outputs, and clear escalation paths for residents who need to reach a human.

The Procurement Contract Requirements

Most state frameworks now include specific requirements for AI-related procurement contracts. These typically include: warranty and remediation obligations if the system produces unacceptable outputs, data protection and use prohibitions, requirements for the vendor to disclose material changes to the underlying AI models, and rights to audit the system's compliance with the contract terms.

The Ongoing Governance Cycle

AI governance is not a one-time approval. Most state frameworks require ongoing monitoring, periodic re-assessment (typically annually or biannually), and reporting of material incidents or changes. The agency owner of a deployed AI system is responsible for maintaining the ongoing documentation and for participating in the governance review cycle.

Practical implication: assign a named individual as the AI system owner for governance purposes. This person is responsible for maintaining the inventory entry, participating in reviews, responding to inquiries from the state governance office, and coordinating with the vendor when material changes occur. Without a named owner, governance obligations tend to fall through the cracks between departments.

Getting AI Search and Chat Through Governance Review

AI Search and AI Assistant are among the lower-risk AI applications from a governance perspective, because they do not make consequential decisions and they can be grounded in the agency's own content. This does not mean they get a free pass through governance review. It means the review is typically faster if the system is properly documented.

Three practices consistently accelerate AI search and chat approval through state governance reviews. First, prepare the risk assessment answers in advance with vendor-supplied technical documentation. Second, provide specific mitigation evidence for the risks that governance reviewers most commonly flag: hallucination, bias, accessibility, data protection. Third, document the human oversight and escalation mechanisms clearly, so reviewers can see that the system is not operating without accountability.