Lighthouse AdvisorySLED AI Adoption Intelligence

State & Local GovernmentIssue 143 records

State Government

Three new-to-archive sources fill the measured-outcomes and independent-assurance gaps left after yesterday's CA/NY/PA oversight edition: Colorado OIT's GenAI strategy page publishes scarce operating metrics—6,447 trained Gemini users, a CDLE UI virtual agent cutting wait times from 36 to 11 minutes (−50%) over six months, and an HCPF training platform cutting new-hire classroom time 40% with high QA scores—under an explicit human-in-the-loop risk gate; Ontario's Auditor General (May 12, 2026) finds ~94% of OPS GenAI usage on unapproved sites versus ~6% on approved Copilot, with only 3% of staff trained and weak AI Scribe evaluation; Illinois's July 6, 2026 AI Safety Measures Act requires large frontier developers to obtain annual conflict-free independent compliance audits beginning 2028. Two patterns contrast measured service gains with approved-tool leakage and note that independent-assurance mandates still outpace completed audits. No edition claims Illinois audits are already finished or that Colorado's metrics were externally re-audited.

Evidence records
3
Cross-source patterns
2
Evidence classes
2 government evaluation1 government audit
Outcomes
1 mixed1 cautionary1 emerging
Source freshness
1 undated1 older, newly relevant1 recent
Research completed
2026-09-20

Choose a role to see its takeaway beside every record in the ledger.

Patterns across the evidence

Synthesis · Lighthouse Advisory interpretation

2 patterns, each supported by at least two sources

  1. Measured GenAI service gains coexist with approved-tool leakage elsewhere

    Colorado's OIT strategy publishes concrete operating metrics (UI wait-time cuts, training-time reduction, thousands of trained Gemini users) under a risk gate, while Ontario's Auditor General finds ~94% of GenAI usage on unapproved sites versus ~6% on approved Copilot, with only 3% trained. Outcome evidence and control evidence are diverging across jurisdictions—peers should not assume an allowlisted tool equals either adoption or measured service value.

    Operating questionFor our approved GenAI path, what share of actual usage does it capture—and which service KPIs prove value when it does?

    Supporting evidenceColorado Governor's Office of Information Technology (OIT)Office of the Auditor General of Ontario

  2. Independent AI assurance mandates are expanding faster than completed audits

    Illinois's AI Safety Measures Act requires annual conflict-free independent audits of large frontier developers beginning 2028, while Ontario's audit shows public-sector AI procurement still accepting weak live testing of hallucinating AI Scribe systems. Statutory/independent-assurance agendas are hardening, but verified third-party evaluations of deployed systems remain scarce in the near term.

    Operating questionWhich of our frontier vendors will owe independent audits by 2028, and what interim evaluation standard do we require before then?

    Supporting evidenceState of Illinois (Governor's Office / General Assembly)Office of the Auditor General of Ontario

Evidence ledger

Full record · every source keeps its link and limitations

3 records
  1. Government evaluationMixedUndated source

    Colorado GenAI strategy reports measured UI wait-time cuts, training savings, and Gemini scale-up

    Colorado OIT's GenAI strategy lessons-learned page reports statewide scale and selected service metrics: 6,447 executive-branch employees using Google Gemini after training as of May 2026; 281 GenAI use cases as of February 2026 (220 approved; 125 in production); and self-reported success that 80% of production cases met or exceeded team expectations through October 2025. Highlighted operating results include a CDLE Unemployment Insurance virtual agent that cut average wait times 50% over six months (36 to 11 minutes) and reduced live-agent request share from 80% to 55%, plus an HCPF Medicaid contact-center GenAI training platform (Bright) that cut new-hire classroom time 40% (five to three weeks), with QA scores 97.8–99.2% and an estimated $350,000 annual savings. Mixed: metrics are agency-reported, not an independent audit, and the page still labels overall success as mixed while steering clear of unsupervised agentic decisions affecting residents.

    Colorado Governor's Office of Information Technology (OIT)Colorado (transferable as measured state GenAI operating evidence; not a multi-state RCT)OIT Statewide GenAI Strategy lessons-learned page (metrics as of Feb–May 2026; retrieved 2026-09-19)

    Why it matters, evidence and limitations
    Why it matters
    Provides scarce measured state-government GenAI operating outcomes (wait times, training duration, workforce tool adoption) under an explicit risk-assessment and human-in-the-loop posture—useful benchmarks for CIO/GovOps peers still stuck at pilot announcements.
    Evidence and measured results
    OIT page: 6,447 Gemini users (May 2026) after prerequisite training; Feb 2026 portfolio 281 use cases / 220 approved / 125 production / 61 not approved; 80% of production cases met/exceeded expectations through Oct 2025; CDLE UI agent wait 36→11 minutes (−50%) over six months and live-agent requests 80%→55%; HCPF Bright training 5→3 weeks (−40%), QA 97.8–99.2%, ~$350k annual savings estimate; risk process with executive review for high-risk cases; avoids unsupervised agentic AI for resident-impacting decisions.
    Limitations and uncertainty
    Agency self-reporting; no independent auditor validation of wait-time, QA, or savings figures on this page. Publication date not stamped; metrics dated Feb–May 2026 / through Oct 2025. Colorado UI randomized fact-finding sandbox already in archive is a different study—do not conflate. Curl to oit.colorado.gov returned 403 from the research host; page opened via HTTPS WebFetch.
    State CIO / OIT strategy publication Role takeaways & implementation
  2. Government auditCautionaryNewly relevant · May 2026

    Ontario auditor finds 94% of GenAI use on unapproved sites and thin Copilot adoption controls

    In its May 12, 2026 special report, Ontario's Auditor General concluded the Ministry of Public and Business Service Delivery and Procurement lacked consistently effective processes to manage AI across the Ontario Public Service. From April 22 to August 18, 2025, other popular GenAI websites comprised 94% of tracked OPS GenAI usage versus ~6% for the only approved tool, Microsoft Copilot Chat; only 3% of staff (1,800 of 55,000) had completed non-mandatory Responsible Use of AI training as of August 2025; staff could reach numerous unsafe/unsecured AI sites; and Copilot's Enterprise Data Protection could be bypassed via non-default browsers. The audit also criticized inadequate evaluation of AI Scribe vendors (including hallucinations in testing) and incomplete bias testing for the Document Verification Service. Cautionary for U.S. states: approved-tool programs without blocking, KPIs, and mandatory training can leave most usage outside the secure path.

    Office of the Auditor General of OntarioOntario, Canada (transferable scrutiny pattern for U.S. state OPS/CIO controls; legal regime differs)2026-05-12

    Why it matters, evidence and limitations
    Why it matters
    Transferable operating warning for state CIOs and shared-services leaders: publishing an approved Copilot/Gemini path is insufficient if telemetry shows the workforce still prefers consumer GenAI and training remains optional.
    Evidence and measured results
    Signed audit PDF: 94% vs 6% GenAI usage split (Apr 22–Aug 18, 2025); Copilot Chat only approved GenAI website with Enterprise Data Protection when accessed correctly; no KPI targets/reporting for Copilot adoption (Rec. 2); browser bypass risk (Rec. 3); 3% training completion, training not mandatory (Rec. 1); unsafe/unsecured sites ~60% of sampled AI sites by Defender score; AI Scribe RFB testing showed hallucinations/inaccuracies and weak bias evaluation; DVS bias testing incomplete; Ministry agreed with recommendations addressed to it.
    Limitations and uncertainty
    Ontario provincial audit—not U.S. state law. Fieldwork through Nov 2025; release May 12, 2026 (outside same-week freshness but newly relevant and absent from stream archive). Ministry response claims later Copilot user growth (~23,000 monthly) after fieldwork—treat as auditee reply, not re-audited outcome. AI Scribe findings concern broader public-sector health procurement optional VOR.
    Independent government audit (provincial) Role takeaways & implementation
  3. Government evaluationEmergingRecent

    Illinois AI Safety Measures Act mandates annual independent audits for large frontier developers

    On July 6, 2026, Governor Pritzker signed SB 315 (Public Act 104-0538), the Artificial Intelligence Safety Measures Act. The enrolled act requires large frontier developers—frontier developers with gross revenues exceeding $500,000,000 in the preceding calendar year—to publish frontier AI frameworks, report critical safety incidents, and, beginning January 1, 2028 or 90 days after first qualifying (whichever is later), annually retain a conflict-free third party to perform an independent audit of Section 10 compliance, producing a detailed report with lead-auditor certification and a published high-level summary transmitted to state authorities within 30 days. Whistleblower protections and civil penalties attach; the Governor's office and press materials describe the law as first-in-nation for regular independent third-party safety audits. Emerging: obligations largely phase in 2027–2028; no measured post-enactment audit outcomes yet.

    State of Illinois (Governor's Office / General Assembly)Illinois (national-model claims; duties apply to covered large frontier developers, not generic state-agency copilots)2026-07-06

    Why it matters, evidence and limitations
    Why it matters
    Extends the multi-state independent-verification agenda (alongside California's SB 813/AB 1405/EO track) with a statutory annual independent-audit duty and whistleblower channel—relevant for state attorneys general, CIOs tracking vendor assurance clauses, and GovOps teams designing verifier markets.
    Evidence and measured results
    Public Act PDF: definition of large frontier developer (>$500M prior-year gross revenues); Section 10 frontier AI framework duties; subsection (d) annual independent audit by conflict-free third party with competence in frontier-model safety; required report elements including compliance opinion, deviations, internal controls, conflicts, methodology, lead-auditor signature; 30-day summary publication and transmission to Agency and Attorney General; Section 15 critical safety incident reporting; Section 20 whistleblower protections; Section 25 civil penalties for audit/reporting failures. Governor press (July 6, 2026): law takes effect January 1, 2027; claims first-in-nation regular independent third-party safety audits.
    Limitations and uncertainty
    Signed July 2026—outside preferred same-week freshness but absent from stream archive and newly relevant beside California's Sept. 18 EO on related themes. Independent audits begin 2028 for qualifying developers; no completed statutory audits yet. Governor 'first/strongest' rhetoric is advocacy. Curl required insecure TLS for ilga.gov PDF retrieval.
    State statute (enrolled public act) Role takeaways & implementation

How to read this edition

Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.

Government evaluation
A public body’s measured evaluation or documented pilot.
Government audit
An oversight review of performance, controls, or operations.