West Virginia issues mandatory statewide AI policies: risk tiers that put every public-facing chatbot in the top tier, and a rule that AI chat histories are not public records

West Virginia Office of Technology (WVOT), Office of the Chief Information Officer; WV Task Force on Artificial Intelligence · State executive-branch AI governance, records and procurement policy · West Virginia

State Government

Publisher: West Virginia Office of Technology
Original publication: 2026-10-07
Source retrieved: 2026-10-25
Event date: 2026-10-07

Read original source

What happened

On Oct 7 the West Virginia CIO issued two mandatory executive-branch policies. PO1034 sets three risk tiers: Tier 1 internal productivity needs no formal approval; Tier 2 needs supervisor approval and an abbreviated Algorithmic Impact Assessment (AIA); Tier 3, which automatically includes every public-facing chatbot plus benefit eligibility, fraud detection and hiring tools, needs a full AIA, CIO Review Committee approval and quarterly bias monitoring, with the AIA done during the RFP phase. PO1035 limits staff to WVOT-approved tools on state devices and accounts, places no data-type limits inside approved tools beyond stricter law, bans consequential decisions without human review, requires AI labels on public media, requires vendor contracts to bar training on state data, and designates AI chat histories, prompts and outputs as transitory records outside the state records act and FOIA until adopted into a final document.

Why it matters

Why now: the policies were posted with a 10/07/2026 date but we had not covered them, and two newer events make them relevant. Virginia's JLARC (Oct 13) criticized uniform, non-risk-based AI requirements and the lack of an employee acceptable use policy; West Virginia now has both a risk-tiered model and a mandatory acceptable use policy to compare against. And the records rule cuts against Washington's Secretary of State guidance, updated September 2026, that work-related AI interactions are public records.

Evidence and measured results

Primary policy documents opened in full; this is guidance, not an evaluation. No adoption, compliance or outcome data exist yet. The WV AI page still lists ChatGPT and DeepSeek as prohibited and Gemini and Copilot Chat as approved; that page also still says the acceptable use policy is coming soon, so state web content is not yet consistent. Page footers show earlier internal issue dates (PO1035 06/01/2026, PO1034 07/23/2026) while headers and the listing say issued 10/07/2026.

Limitations and uncertainty

The transitory-record and pre-decisional designations are an executive policy interpretation of the WV Code; whether courts or the records program accept it is untested. Washington treats similar interactions as public records, and a Pennsylvania records ruling reported in February reached a narrower conclusion; transferability depends on each state's records law. No enforcement data yet.

Put this evidence to work

Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-24; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.

Sales

Role takeaway

Customer problem: West Virginia agencies must now classify every AI use, complete impact assessments for Tier 2 and Tier 3 tools, and run quarterly bias monitoring for public-facing chatbots, with no stated added funding or staff.
Stakeholders: WV CIO and CIO Review Committee
Agency Information Security Administrators
Agency program owners of public chatbots and eligibility systems
Agency procurement officers
State Privacy Office
Agency counsel and records officers
Discovery questions: How many existing AI uses would fall into Tier 3 under the external-facing rule?
Who completes the AIA during an RFP, the agency or the vendor?
What evidence will the CIO Review Committee accept for quarterly bias monitoring?
How is the transitory-records designation applied to retention settings in Gemini and Copilot tenants?
Which tools are being added to or removed from the approved list, given the 30-day transition rule?
Value hypothesis: Interpretation: a repeatable AIA and monitoring template could shorten Tier 3 approvals toward the policy's 15-business-day decision window and reduce rework, but no baseline approval times exist yet.
Potential engagement: Bounded four-to-six-week support to one agency: inventory its AI uses, tier them, complete one full Tier 3 AIA for a public chatbot, and design the quarterly bias-monitoring report.
Unsupported claims: No evidence the policies have improved safety or adoption
No savings or productivity data
No evidence courts or records officials accept the transitory-record designation
No evidence on how many tools are approved or in use

Pre-sales engineering

Role takeaway

Fit: Agencies using or procuring generative AI on the WV state network, especially public-facing chatbots, benefits eligibility, fraud detection and hiring tools that fall into Tier 3.
Architecture and integration: Enforce approved tools through state identity (state device and account), tenant-level data and retention configuration, logging of prompts for audit, accuracy and bias monitoring pipelines for Tier 3 systems, and a documented human override path.
Prerequisites: WVOT Data Classification Policy mapping
Approved software registry access
AIA form and CIO Review submission
State identity on devices used for AI
Vendor contract terms barring training on state data
Constraints: Only WVOT-approved tools; ChatGPT and DeepSeek listed as prohibited on the WV AI page
Any public-facing AI is automatically Tier 3
Tier 3 AIA must be completed during the RFP phase
More restrictive federal and state rules (e.g., HIPAA) still apply
ADA and WCAG compliance for AI-generated public content
Security: Treat the approved tenant as the security boundary: verify vendor data hosting, no-training clauses, prompt logging for audit, and privacy incident reporting through the State Privacy Office. Confirm what data classes are acceptable under federal rules despite the policy's permissive default.
Proof of value: Run one public chatbot through the full Tier 3 AIA and measure time to decision against the 10- and 15-business-day targets
Test whether tenant retention settings match the transitory-records designation and any legal-hold requirements
Produce a first quarterly bias and accuracy report on a sample of chatbot answers

Delivery

Role takeaway

Work: Help an agency implement PO1034 and PO1035: tier its AI uses, register them in the CIO Review inventory, complete AIAs, set up quarterly Tier 3 monitoring, label AI-generated public content, and train staff.
Dependencies: WVOT CIO Review process and committee schedule
Approved software list and tenant configuration
Agency data classification
KnowBe4 and LMS training modules
Vendor willingness to accept no-training and IP terms
Ownership: WVOT Operations as policy owner and CIO Review Committee for Tier 3 approval; agency heads and ISAs for enforcement; agency records officers for the records designation.
Skills and adoption: All employees complete the WVOT training before use; agency AI leads and ISAs need AIA and monitoring skills; communications staff need labeling practice for AI-generated media.
Governance checkpoints: Use case tiered and recorded before pilot
Abbreviated or full AIA submitted as required
Tier 3 CIO Review Committee decision
Quarterly Tier 3 bias monitoring report
Periodic review of AI-assisted work products
Annual policy review
Acceptance criteria: Proposed: 100% of agency AI uses tiered and in the inventory within 60 days
Proposed: every Tier 3 system has a documented human override and a quarterly monitoring report
Proposed: all staff with access complete required training before use
Proposed: all AI-generated public media carry a visible label
Risks: Tier 3 burden may slow or deter simple public chatbots
Transitory-record designation may be challenged under FOIA
Permissive data default inside approved tools may conflict with federal rules
Inconsistent state web guidance during rollout
No dedicated funding for monitoring

Implementation considerations

Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.

Architecture and integration

What must connect, and where does the AI sit in the workflow?

The control point is the identity and tenant boundary (approved tool, state device, state account), not per-prompt data screening. Public-facing chatbots inherit Tier 3 regardless of how simple they are, which means full AIA work and quarterly bias monitoring for even an FAQ assistant.

Governance

Who approves, reviews and stays accountable for outcomes?

Gives CIO Review a central AI use-case inventory and tiered approval timelines (Tier 2 within 5 business days of abbreviated AIA; Tier 3 initial review in 10 and decision in 15 business days). Agencies may be stricter but cannot grant exceptions without WVOT approval.

Security and privacy

What data, permissions and controls need testing?

Allows any data classification in approved tools when users are on state devices and accounts, except where stricter law applies, so data protection depends on tenant configuration and vendor contract terms (no training on state data, state-compliant hosting). Prompts remain state property and are subject to audit.

Accessibility and workforce

Who is affected, and what skills or accommodations follow?

Mandatory training for all employees before use; AI-generated public content must meet ADA and WCAG. Interpretation: labeling and accessibility checks add review work for communications teams.

Procurement

What should contracts, pricing and exit terms secure?

Material: mandatory AIA before acquiring any generative AI tool, completed during the RFP for Tier 3; contracts must bar vendor training on state data, grant the state output rights and treat outputs as works made for hire. The policy was already attached to a DMV driver-system RFP posting, per a GovTribe listing (not independently verified).

Operating model

Which teams own the service once it runs?

Centralizes AI approval and inventory in CIO Review while keeping agencies accountable for enforcement and monitoring; agencies may be stricter but not looser.

Publication history

2026-10-24State Government · Issue 472 resources

Read preserved resource versions (JSON)

Stable resource ID: west-virginia-wvot-ai-acceptable-use-ethics-policies-risk-tiers-transitory-records-20261007