BOSTON – While lawmakers and staff are increasingly using artificial intelligence to research, create content and even draft bills, many states do not have rules to guide or control the use of relatively new and controversial technologies.
According to a national legislative survey of state legislators, 20% of legislative staff said they used generative AI tools for legislative work in 2024. By 2025, that number had skyrocketed to 44%.
Will Clark, NCSL's lead in issues related to NCSL technology and legislative oversight, said the use of generative AI at the Legislative Bureau could be even more widespread.
“These are people undergoing investigations trying to admit they are using this, meaning there are many more people who don't admit it, but they use it for legislative work,” Clark said on a panel Monday at the National Legislative Conference held by the NCSL in Boston this year.
Survey respondents said ChatGPT is the most commonly used generator AI tool, followed by Microsoft Copilot. Supports research. Condens hundreds of pages of documents into a concise summary.
Many states do not have official policies on how and when lawmakers and staff use generated AI. This creates misinformation and biased output, and risks potential security vulnerabilities and privacy concerns.
“Last year, 16 respondents said that the Legislative Bureau has a policy. This year, 16 respondents said that their office has a policy, so they have to change in practice. Usage is rising, but the number of councils with policies that guide staff use is roughly the same,” Clark said.
Washington is one of the few states with acceptable use policies across Congress around AI. Chad Dahl, group infrastructure manager for Washington Congress, said the technology is “innovative” but it is “substantial risk” and “need to step lightly.”
Washington State Assemblymen and tech officials are considering whether investigations into chatbots like ChatGPT are considered public records under state law when they are undergoing a re-draft of their AI policy.
“It's a quick public record, how do you manage it effectively? If you're considering adopting AI, you need to think about public records. At least in the state, there's no legislative exemption for public records, so you need to comply with it,” Dahl said. “And when we're considering adopting an AI platform, it's a big consideration for us to play.”
He added that another important consideration is data and privacy protection.
“Data is probably the most traded product that doesn't exist on the US stock exchange. Marketing materials, where you're going, what you want to eat, what you search for, that's all the data points that AI can use,” Dahl said.
Many legislative bodies don't have AI policies, so staff often use the tool themselves on their personal accounts, especially when users enter sensitive information, which can cause privacy issues.
Clark and Dahl strongly encouraged all states to create their own AI policies for lawmakers and staff.
But Dahl said it's important to set up guardrails, but investing in AI is also essential.
“Cybersecurity is one of the places where every state of AI requires a lot of investment and AI use, because the bad guys are already using it so effectively, in fact and across the board. The practical application of AI in cybersecurity is huge, and it's the arms race.”
