AI adoption, public services, and modernization for state and local government.
Latest articleJess Loban
Most states still issue magnetic-stripe EBT cards that criminal skimming operations exploit at scale. Chip migration is the right response, but a chip card program without coordinated terminal upgrades, fraud detection recalibration, and benefit recovery infrastructure closes far less of the gap than early results suggest.
Read articleAI adoption, public services, and modernization for state and local government.
48 articles · Newest first · Latest article featured above
State finance and HR system replacements fail more predictably than most agencies acknowledge. The organizational preconditions — data ownership, process authority, change management resources, oversight capacity, and governance structure — must be in place before the RFP, not assembled alongside it.
The Cyber Incident Reporting for Critical Infrastructure Act explicitly covers state and local governments under the Government Facilities Sector. State CISOs who have not started the organizational design work — designating a reporting official, scoping covered agencies, establishing inter-agency notification — are already behind the practical compliance timeline.
NASCIO ranked AI at the top of state CIO priorities for 2026—the first time it has displaced cybersecurity in twelve years. The same research shows only 22 percent of states have an AI-ready data quality program, and only 4 percent describe their data governance as very mature. That gap has a predictable cost.
State and local government entities are now among the highest-risk classifications for cyber insurers. Annual renewal has shifted from an administrative attestation to a technical evidence review. Documentation gaps — not control gaps — cause most of the friction state CISOs encounter at renewal.
Three governors signed AI executive orders in the space of six months, each transferring specific technical and procurement obligations to state CIO offices. California's 120-day certification deadline has passed; Oregon's CIO has until December to define frontier AI and propose review criteria. For state technology leaders, this is an engineering and contracting problem, not a policy exercise.
Zero trust programs, AI-assisted threat detection, and incident response all require centralized log infrastructure most state agencies do not have. The sequencing decision — resolve the log gap first — is the one state CISOs are frequently deferring at cost.
Every state agency administering Medicaid, SNAP, or unemployment insurance handles Federal Tax Information. IRS Publication 1075 follows that data wherever it goes—including into cloud platforms—and the compliance gaps that cloud migration creates are exactly what the IRS audits.
Demos, reference contracts and security questionnaires are useful starting points. State AI buyers also need evidence of performance on their actual workloads, clear monitoring obligations and a workable process for correcting errors.
Enterprise AI can arrive through an existing software relationship. State agencies need to connect platform activation, data access, and model changes to their applicable review requirements—and verify that approved controls are operating.
Federal reviews of Medicaid unwinding identified individual-level renewal errors, excluded populations, and missing response channels. Those findings give states concrete acceptance tests for eligibility rules, data exchange, contact management, and surge capacity.
The federal CCWIS record shows slow modernization, not a simple project failure rate. State buyers can use its lessons to improve program-IT governance, readiness testing, and workforce continuity.
NASCIO found that 31 percent of surveyed CIO budgets fund critical-infrastructure cyber support for local governments and special districts. A credible whole-of-state plan must map authority, funding, and actual service coverage.
Cryptographic credentials can strengthen identity verification, but states still need trustworthy enrollment, protected recovery, accessible alternatives, and separate eligibility checks.
Nevada's ransomware recovery and SOC legislation show why monitoring, response authority, agency agreements, and technical visibility must be designed together.
NASPO ranks procurement modernization first for 2026. A measured baseline helps states define success, evaluate automation, and improve agency and supplier experience.
Illinois's frontier AI audit requirement gives state buyers a useful assurance reference. Contracts still need deployment-specific testing, evidence access, change control, and remedies.
Consolidation is back in NASCIO's top ten. The useful question is which shared decisions and services will improve AI governance, security, and data quality—and how agencies will retain the expertise their missions require.
North Carolina, Nevada and Minnesota illustrate differing cloud-assurance requirements. State buyers need to connect exact product status and evidence with policy scope, renewals and transition planning.
MS-ISAC continues under a member-funded model. State and local buyers need to verify retained coverage, costs, grant conditions, and response continuity before contracts change.
Connecticut strengthens state AI inventory and procurement rules in October 2026, while employment-technology notice duties have separate October 2027 deployment triggers. Agencies need a use-case inventory, documented assessments, and a precise compliance calendar.
California's Executive Order N-5-26 provides for independent state review of federal AI supplier designations. State buyers still need to check binding obligations and establish their own evidence-based procurement decisions.
State hiring processes, compensation, classifications, and career paths can constrain technology delivery. Measure the local bottlenecks and preserve internal decision authority as capacity expands.
The January 1, 2027 federal Medicaid community-engagement date tests state eligibility systems, data exchange, notices, and exception handling. Readiness requires an end-to-end service plan.
DOL's 2026 enforcement warning and modernization audit put measurable outcomes in focus. State UI teams need clear evidence linking investments to reliability, access, and specific integrity controls.
The ARPA closeout calendar tests more than spending: states need a funded operating model for technology that must keep running after temporary federal support ends.
CMS interoperability requirements span different deadlines. The useful test is whether Medicaid APIs expose accurate, governed data and produce the reporting evidence programs need.
Washington's school-funding audit illustrates a transferable risk: a critical service can keep running while recovery knowledge rests with too few people.
Kansas offers a useful modernization case. The transferable lessons concern data quality, workflow design and evidence behind reported results—not a guarantee that another state can copy the same timeline.
The Department of Justice gave state and local governments an extra year to meet digital accessibility standards. The added time is an opportunity to strengthen procurement, testing and ongoing service ownership so accessibility survives each release.
Digital service teams need authority, multidisciplinary skills and a workable delivery environment. Assess those conditions alongside hiring so new capacity produces better resident services.
NASCIO's March 2026 report named the shift from AI that advises to AI that acts. Agencies need to check whether existing governance covers action authority, tool permissions and recovery when an AI system can execute a workflow.
Interoperability requires both reliable interfaces and a lawful, repeatable approval process. State data leaders can reduce one-off negotiation without bypassing privacy or program restrictions.
State AI ambitions require an operating team: people who can integrate, evaluate and sustain the service. Digital delivery capacity needs a staffing plan, authority and a durable budget.
AB 869 proposed zero trust maturity deadlines; the reviewed official record does not establish enactment. Its useful lesson is how to sequence identity, access and monitoring work with evidence.
AI leads NASCIO's 2026 priorities after cybersecurity held the top position for twelve years. States now need funded evaluation, data and workforce capacity behind the ambition.
The 2026 NASCIO–Deloitte study highlights pressure on state security programs. Its findings are a starting point for operational measurement, shared-service design and vendor accountability—not a breach-risk score.
A vendor can deliver a platform, but government still needs the people and authority to own its service. NYC offers a practical example of building that internal capacity.
Automated fraud tools need measured precision, representative data and a review path. A historical Michigan unemployment case offers a caution—not evidence of a recent SNAP audit.
Stronger identity checks can stop impostors and still strand eligible applicants. Benefits agencies need to measure fraud prevention, false rejection, and recovery together—and design the service around all three.
Cooperative purchasing can share the work of buying AI; modular contracts can preserve the option to change it. The value depends on local evaluation, clear interfaces, and an exit plan the agency has actually tested.
The federal counter-UAS framework creates a conditional path for eligible agencies. Training, authorized systems, coordination, reporting and privacy must be designed before procurement.
A new platform cannot resolve business rules the agency has yet to understand. State modernization teams need a rule inventory, a tested migration sequence, and a clear plan for retiring the old system.
A county can lose essential services through a shared vendor as well as its own network. Security agreements, access controls, and recovery exercises need to account for both paths.
California directs agencies to develop AI procurement safeguards. The practical opportunity is to make vendor claims testable, while distinguishing recommendations from binding contract requirements.
Reliable renewals depend on more than a new portal. States need data matching, usable interfaces and a way to resolve conflicting records without creating unnecessary work for residents.
North Carolina and Nevada are putting cloud assurance into contracts. Vendors need a product-specific authorization plan and a clear reading of each state’s transition rules.
Shared security services need recurring funding, clear participation agreements and evidence of coverage. The SLCGP transition makes those operating decisions harder to defer.
Rules discovery, surge testing and accountable automation belong in the requirements—not on a list of problems to solve after launch.
STAY INFORMED
Explore our solutions or get in touch to discuss how Spartan X is building the next generation of defense technology.