Summary

  • VITA had identified more than 850 state IT applications for modernization by August 2025; more than 300 required urgent attention.
  • JLARC’s October Commission draft recommends an expedited review path for AI coding assistance, backed by technical and risk-mitigation guidance.
  • Virginia already has AI approval and code-review rules. A workable fast lane would sort proposals by what a tool can read, change and deploy.

Virginia’s software backlog is counted. Its AI fast lane is still a recommendation.

As of August 2025, the Virginia Information Technologies Agency had identified more than 850 state IT applications needing modernization, including over 300 requiring urgent attention. The figure comes from the Joint Legislative Audit and Review Commission’s 13 October 2026 Commission draft on AI governance. The draft says coding assistants could help update dated systems if agencies put appropriate controls around them. JLARC recommends that VITA expedite review of coding-assistant proposals for modernization and publish technical and risk-mitigation guidance. The proposal is specific; the delivery clock is not. The report and its draft recommendations do not list which applications suit AI assistance or how long a review takes.

That gap matters because a coding assistant is not one risk in one box. A tool that proposes a change against public code in a sandbox has a different reach from an agent that can inspect internal repositories, retrieve sensitive records or write to a production branch. A fast lane should recognize those differences before the first request lands on an approver’s desk.

Virginia already has a formal gate. VITA’s June 2026 EA400 policy says an agency AI system it seeks to develop, implement or procure must enter the Commonwealth AI Registry and pass sequential review: the agency IT representative and information-security officer, VITA and the Commonwealth CIO, then the Secretary of Administration. The review examines fairness, public benefit, human oversight, risk, data stewardship, cost and vendor assurances. EA400 gives the state a control surface; JLARC’s complaint is that requirements largely apply the same way across different levels of risk.

The report says VITA had not given agencies a standard risk-assessment instrument, even though agencies had to identify risks in an approval request. Forty-eight percent of executive-branch agencies using function-specific AI described unclear requirements as a major or moderate constraint. JLARC also found that VITA’s standards did not address autonomous agents or safeguards for access to state systems and data. A uniform review can spend the same effort on a low-risk code suggestion and a system with broad write privileges, while still missing the second system’s larger blast radius.

The demand is already visible. Ninety-seven percent of surveyed agencies allowed some staff use of general-purpose AI, often with restrictions. JLARC estimated that 76 percent of employees served by VITA used a general-purpose AI tool during a one-month period. Agencies reported uses including code improvement. Those figures describe broad use, not the number of modernization projects ready for coding assistance. JLARC’s summary separates agency systems from day-to-day tools, but its own proposed coding lane gives the distinction a practical deadline.

A second boundary is easy to blur: approving a tool is not reviewing the patch it produces. VITA’s current AI FAQ says a qualified developer must examine AI-generated code before it enters a development branch, followed by security, functional and performance testing before production. Those are useful release controls. They do not tell an agency which tool can access which repository, which data it may see, or how quickly the state will decide whether a proposed use is allowed.

JLARC’s recommendation pairs a faster determination with technical safeguards. VITA should make the fast lane an access decision, not a rubber stamp. Public code and synthetic-data sandboxes can move through a short review. Internal source repositories need a named owner, bounded permissions and a recorded human review. Access to sensitive information or autonomous production writes belongs in a slower, stronger tier, with tests and rollback evidence required before deployment. This is a proposed structure, not a control already adopted by Virginia.

The scale of the maintenance queue gives the state a reason to measure the lane. The missing figure is request-level: how many applications are suitable for AI coding assistance, and how long did each approval take? VITA could publish both by risk tier, along with rework, approval and rejection counts. If the fast route consistently handles low-risk tasks without shortcuts to production, expand it. If delays cluster around data access, unclear ownership or agency-to-VITA handoffs, fix those steps directly.

The report says agencies experience coordination problems and recommends identifying their causes; counting elapsed days would reveal where the friction sits.

Sources: JLARC Report 621; draft recommendations; VITA EA400; VITA AI FAQ; VITA EA225.