For the first time in 12 years, cybersecurity is not the top priority for state chief information officers.
The National Association of State CIOs found in their annual survey that, no surprise, artificial intelligence has vaulted to the lead spot.
Doug Robinson, the executive director of NASCIO, said while AI’s ascension is related to the hype around the capabilities, to some degree, it’s also a recognition that these technologies, whether generative, agentic or basic, is part of broad strategic agenda.
“They all are working on policies and frameworks for acceptable use, ethical use, responsible use and all the legal issues. They’re looking at the solutions for the enterprise too,” Robinson said on Ask the CIO. “When we look go back to our 2025 CIO survey, which has a deeper kind of set of data around this, we saw that happening where we had over 90% of the state CIOs reported that they running pilot projects and Gen AI proofs of concept. Many of them had requested a separate funding streams to work on Gen AI pilots. They creating governance models and centers of excellence.”
The other top priorities include cybersecurity, budget and cost control, modernization and digital services.
For AI, it’s not just pilots that are driving the priority, but nearly every state legislator is considering bills that would impact how AI is used.
Robinson said state lawmakers have introduced more than 1,000 different bills in 2025 alone. That is up from over 500 in 2024.
“AI’s ascension into number one is really kind of unprecedented from the top 10 these topics, and many of them have been in the top 10 for 10 or 15 years. AI just rocketed right out from being not on it, all the way up to number three, number two and now number one and in consecutive years,” Robinson said. “Legislators are concerned about a number of things around AI safety and on the executive branch side, they are focused on building capacity. What are they going to do about governance? What are they going to do about moving these pilots into production? I suspect that’s going to be the major thrust in 2026.”
On the legislative side, some states were more active than others. Robinson said, for example, California had 40 bills and Texas had 38. And the agendas of the bills themselves have changed considerably over the last couple years: In 2024, lawmakers focused heavily on the use of AI in government, especially its effectiveness. In 2025, that focus shifted externally to what Robinson described as “regulatory oversight of AI in the marketplace,” citing concerns about deepfakes and child safety as primary examples.
Looking even more broadly, there’s hardly any market that’s unaffected.
“There’s a whole set of kind of lines of business that are concerned about the disintermediation impact of AI on their line of work. Some simple examples bills that are induced by land surveyors. They were looking for some kind of protection from the state, demanding that they can’t use Gen AI to do land surveying,” Robinson said. “Then, of course, the state’s concerned about the use of their contractors and partners, and legislators are introducing legislation that essentially prohibiting the use of Gen AI for things like Medicaid eligibility determination or healthcare review or insurance eligibility. They’re basically blocking all those saying you cannot use Gen AI for them and there must be humans that are making these decisions, not some automated machine learning algorithm with the large language model sitting behind it.”
As for the CIO, Robinson said many state offices have been doing the foundational work for several years. He said between 80% and 90% of state CIOs have implemented frameworks that include responsible use guidelines and other enterprise policies. Additionally, NASCIO has found that a large majority of the states have documented their use cases.
“Almost 90% have created some kind of [AI] task force. You look at that as the overarching governance and policy work, and then when you look at what are they actually doing, they’re cranking up staff and employee training because employee readiness is a big target,” Robinson said. “When we ask them to begin to articulate, what are their common use cases? What do they see from pilot to production right now? Predominantly already out there utilization are chat bots and virtual assistants for citizen services. We have states that have essentially transformed their state portals to one where they’re using ChatGPT and other type AI supported search services.”
Robinson said other common uses cases included chatbots, document generation, policy analysis, summarization, drafting of memos, doing research and generating and reviewing code.
Even with all the excitement around AI, Robinson said cybersecurity and the other topics still garner a significant amount of attention.
Old priorities remain top of mind
One surprise in this year’s survey was the return of budget and cost control, which Robinson said had dropped off the list.
He said with the end of funding from the COVID pandemic, states are projecting lower budgets and more fiscal belt tightening.
“The priority modernization always on the list. I think that’s just the aspirational. Every CIO aspires to have a modern environment with modern application development. States still have a lot of a lot of technical debt,” Robinson said. “Many of these other topics have been on the on the list consistently for years. Cloud services, I think, has been on the list for 16 years. Consolidation goes back to the mid-2000s. That was number one for a number of years.”
One of the newest priorities for 2026 is accessibility. Robinson said this is because states are under an April 2026 deadline to remediate their websites and mobile services to meet accessibility requirements based on the Justice Department’s 2024 rule.
Robinson said overall, NASCIO’s 2025 survey found both good and bad news. The good news, he said, is about 70% of the state CIOs indicated accessibility is already incorporated in their organizational directives and CIOs are leading these efforts.
The bad news, Robinson said, is about half the states haven’t dedicated funding to support the accessibility services and to support these modernization initiatives.
“Essentially, half of the states reported that they’re in progress, but a third of them said that they have a plan, but they haven’t begun to implement the plan,” he said. “As of October, only one state reported to us that they are fully implemented changes to comply with the 2026 deadline. That gives you a sense of what the challenges are. Most are still in progress and they’re going to have to work with a lot of third-party vendors that are under state contracts, and they have to build that into their contracts to make sure the changes happen.”
Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
