{"resourceId":"west-virginia-wvot-ai-acceptable-use-ethics-policies-risk-tiers-transitory-records-20261007","versions":[{"version":"external-18de9828f6bf9d510dee32f9e38d9a3214edd341d2d9059e22d4cf7f418057a1","resource":{"id":"west-virginia-wvot-ai-acceptable-use-ethics-policies-risk-tiers-transitory-records-20261007","title":"West Virginia issues mandatory statewide AI policies: risk tiers that put every public-facing chatbot in the top tier, and a rule that AI chat histories are not public records","organization":"West Virginia Office of Technology (WVOT), Office of the Chief Information Officer; WV Task Force on Artificial Intelligence","sector":"State executive-branch AI governance, records and procurement policy","geography":"West Virginia","publishedAt":"2026-10-07","publicationDate":"2026-10-07","eventDate":"2026-10-07","sourceName":"West Virginia Office of Technology","sourceLabel":"WVOT OT Policies listing: WVOT-PO1034 AI Code of Ethics Policy and WVOT-PO1035 Generative AI Acceptable Use Policy (issued 10/07/2026)","sourceUrl":"https://technology.wv.gov/policy-governance/ot-policies","evidenceClass":"standards-guidance","outcomeClass":"emerging","topics":["governance-procurement","data-security","knowledge-work","operating-model"],"finding":"On Oct 7 the West Virginia CIO issued two mandatory executive-branch policies. PO1034 sets three risk tiers: Tier 1 internal productivity needs no formal approval; Tier 2 needs supervisor approval and an abbreviated Algorithmic Impact Assessment (AIA); Tier 3, which automatically includes every public-facing chatbot plus benefit eligibility, fraud detection and hiring tools, needs a full AIA, CIO Review Committee approval and quarterly bias monitoring, with the AIA done during the RFP phase. PO1035 limits staff to WVOT-approved tools on state devices and accounts, places no data-type limits inside approved tools beyond stricter law, bans consequential decisions without human review, requires AI labels on public media, requires vendor contracts to bar training on state data, and designates AI chat histories, prompts and outputs as transitory records outside the state records act and FOIA until adopted into a final document.","sledRelevance":"Why now: the policies were posted with a 10/07/2026 date but we had not covered them, and two newer events make them relevant. Virginia's JLARC (Oct 13) criticized uniform, non-risk-based AI requirements and the lack of an employee acceptable use policy; West Virginia now has both a risk-tiered model and a mandatory acceptable use policy to compare against. And the records rule cuts against Washington's Secretary of State guidance, updated September 2026, that work-related AI interactions are public records.","evidence":"Primary policy documents opened in full; this is guidance, not an evaluation. No adoption, compliance or outcome data exist yet. The WV AI page still lists ChatGPT and DeepSeek as prohibited and Gemini and Copilot Chat as approved; that page also still says the acceptable use policy is coming soon, so state web content is not yet consistent. Page footers show earlier internal issue dates (PO1035 06/01/2026, PO1034 07/23/2026) while headers and the listing say issued 10/07/2026.","architectureImplications":"Interpretation: the control point is the identity and tenant boundary (approved tool, state device, state account), not per-prompt data screening. Public-facing chatbots inherit Tier 3 regardless of how simple they are, which means full AIA work and quarterly bias monitoring for even an FAQ assistant.","governanceImplications":"Gives CIO Review a central AI use-case inventory and tiered approval timelines (Tier 2 within 5 business days of abbreviated AIA; Tier 3 initial review in 10 and decision in 15 business days). Agencies may be stricter but cannot grant exceptions without WVOT approval.","securityPrivacyImplications":"Allows any data classification in approved tools when users are on state devices and accounts, except where stricter law applies, so data protection depends on tenant configuration and vendor contract terms (no training on state data, state-compliant hosting). Prompts remain state property and are subject to audit.","caveats":"The transitory-record and pre-decisional designations are an executive policy interpretation of the WV Code; whether courts or the records program accept it is untested. Washington treats similar interactions as public records, and a Pennsylvania records ruling reported in February reached a narrower conclusion; transferability depends on each state's records law. No enforcement data yet.","streamIds":["state-government"],"roles":{"sales":"Sales framing: West Virginia has turned AI governance into a procurement gate. Any public-facing chatbot is automatically high risk and needs a full impact assessment during the RFP, plus quarterly bias monitoring. Vendors and partners selling resident-facing assistants into WV, or into states copying this model, should expect AIA evidence, no-training contract terms and output IP clauses as table stakes. The opening is helping agencies complete AIAs and monitoring, not selling unproven savings.","engineering":"Engineering framing: the design assumes approved tenants with state identity are safe for any data class, so tenant configuration, retention settings and vendor data terms carry the load. Tier 3 classification for every external chatbot means monitoring for accuracy and bias must be built in from day one, along with a documented human override. Note the records rule: if chats are treated as transitory, retention settings and legal hold behaviour need explicit decisions, because other states require retention.","delivery":"Delivery framing: agencies now need to train every employee through KnowBe4 and LMS modules, register use cases through CIO Review, and run periodic reviews of AI-assisted work products. Delivery work centers on standing up the AIA intake, the inventory and the quarterly Tier 3 monitoring cadence. Expect friction where agency pages still show the policy as forthcoming, and track how the records designation holds up under the first FOIA request for AI chat logs."},"roleDetails":{"sales":{"customerProblem":"West Virginia agencies must now classify every AI use, complete impact assessments for Tier 2 and Tier 3 tools, and run quarterly bias monitoring for public-facing chatbots, with no stated added funding or staff.","stakeholders":["WV CIO and CIO Review Committee","Agency Information Security Administrators","Agency program owners of public chatbots and eligibility systems","Agency procurement officers","State Privacy Office","Agency counsel and records officers"],"discoveryQuestions":["How many existing AI uses would fall into Tier 3 under the external-facing rule?","Who completes the AIA during an RFP, the agency or the vendor?","What evidence will the CIO Review Committee accept for quarterly bias monitoring?","How is the transitory-records designation applied to retention settings in Gemini and Copilot tenants?","Which tools are being added to or removed from the approved list, given the 30-day transition rule?"],"valueHypothesis":"Interpretation: a repeatable AIA and monitoring template could shorten Tier 3 approvals toward the policy's 15-business-day decision window and reduce rework, but no baseline approval times exist yet.","potentialEngagement":"Bounded four-to-six-week support to one agency: inventory its AI uses, tier them, complete one full Tier 3 AIA for a public chatbot, and design the quarterly bias-monitoring report.","unsupportedClaims":["No evidence the policies have improved safety or adoption","No savings or productivity data","No evidence courts or records officials accept the transitory-record designation","No evidence on how many tools are approved or in use"]},"engineering":{"fit":"Agencies using or procuring generative AI on the WV state network, especially public-facing chatbots, benefits eligibility, fraud detection and hiring tools that fall into Tier 3.","architectureIntegration":"Enforce approved tools through state identity (state device and account), tenant-level data and retention configuration, logging of prompts for audit, accuracy and bias monitoring pipelines for Tier 3 systems, and a documented human override path.","prerequisites":["WVOT Data Classification Policy mapping","Approved software registry access","AIA form and CIO Review submission","State identity on devices used for AI","Vendor contract terms barring training on state data"],"constraints":["Only WVOT-approved tools; ChatGPT and DeepSeek listed as prohibited on the WV AI page","Any public-facing AI is automatically Tier 3","Tier 3 AIA must be completed during the RFP phase","More restrictive federal and state rules (e.g., HIPAA) still apply","ADA and WCAG compliance for AI-generated public content"],"security":"Treat the approved tenant as the security boundary: verify vendor data hosting, no-training clauses, prompt logging for audit, and privacy incident reporting through the State Privacy Office. Confirm what data classes are acceptable under federal rules despite the policy's permissive default.","proofOfValue":["Run one public chatbot through the full Tier 3 AIA and measure time to decision against the 10- and 15-business-day targets","Test whether tenant retention settings match the transitory-records designation and any legal-hold requirements","Produce a first quarterly bias and accuracy report on a sample of chatbot answers"]},"delivery":{"work":"Help an agency implement PO1034 and PO1035: tier its AI uses, register them in the CIO Review inventory, complete AIAs, set up quarterly Tier 3 monitoring, label AI-generated public content, and train staff.","dependencies":["WVOT CIO Review process and committee schedule","Approved software list and tenant configuration","Agency data classification","KnowBe4 and LMS training modules","Vendor willingness to accept no-training and IP terms"],"ownership":"WVOT Operations as policy owner and CIO Review Committee for Tier 3 approval; agency heads and ISAs for enforcement; agency records officers for the records designation.","skillsAdoption":"All employees complete the WVOT training before use; agency AI leads and ISAs need AIA and monitoring skills; communications staff need labeling practice for AI-generated media.","governanceCheckpoints":["Use case tiered and recorded before pilot","Abbreviated or full AIA submitted as required","Tier 3 CIO Review Committee decision","Quarterly Tier 3 bias monitoring report","Periodic review of AI-assisted work products","Annual policy review"],"acceptanceCriteria":["Proposed: 100% of agency AI uses tiered and in the inventory within 60 days","Proposed: every Tier 3 system has a documented human override and a quarterly monitoring report","Proposed: all staff with access complete required training before use","Proposed: all AI-generated public media carry a visible label"],"risks":["Tier 3 burden may slow or deter simple public chatbots","Transitory-record designation may be challenged under FOIA","Permissive data default inside approved tools may conflict with federal rules","Inconsistent state web guidance during rollout","No dedicated funding for monitoring"]}},"retrievedAt":"2026-10-24T22:16:56-05:00","enrichedAt":"2026-10-24T22:21:21-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Mandatory training for all employees before use; AI-generated public content must meet ADA and WCAG. Interpretation: labeling and accessibility checks add review work for communications teams.","procurementImplications":"Material: mandatory AIA before acquiring any generative AI tool, completed during the RFP for Tier 3; contracts must bar vendor training on state data, grant the state output rights and treat outputs as works made for hire. The policy was already attached to a DMV driver-system RFP posting, per a GovTribe listing (not independently verified).","operatingModelImplications":"Centralizes AI approval and inventory in CIO Review while keeping agencies accountable for enforcement and monitoring; agencies may be stricter but not looser.","sourceVerification":{"openedUrl":"https://technology.wv.gov/policy-governance/ot-policies","referenceExcerpt":"WVOT-PO1035 - Generative Artificial Intelligence Acceptable Use Policy - 10/07/2026","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}