States and localities are eager to leverage artificial intelligence (AI) to optimize service delivery and infrastructure management, but they face significant resource gaps. Without sufficient personnel and capital, these jurisdictions cannot properly identify and mitigate the risks associated with AI adoption, including cyber threats, surging power demands, and data privacy issues. Congress should establish a new grant program, coordinated by the Cybersecurity and Infrastructure Security Agency (CISA), to assist state and local governments in addressing these challenges. Such funding will allow the federal government to instill best security and operating practices nationwide, while identifying effective strategies from the grassroots that can inform federal rulemaking. Ultimately, federal, state, and local capacity are interrelated; federal investments in state and local government will help the entire country harness AI’s potential and reduce the risk of catastrophic events such as a large, AI-powered cyberattack.

Challenge and Opportunity 

In 2025, 45 state legislatures have introduced more than 550 bills focused on the regulation of artificial intelligence, covering everything from procurement guidelines to acceptable AI uses in K-12 education to liability standards for AI misuse and error. Major cities have followed suit with sweeping guidance of their own, identifying specific AI risks related to bias and hallucination and directives to reduce their impact on government functions. The influx of regulatory action reflects burgeoning enthusiasm about AI’s ability to streamline public services and increase government efficiency.

Yet two key roadblocks stand in the way: inconsistent rules and uneven capacity. AI regulations vary widely across jurisdictions — sometimes offering contradictory guidance — and public agencies often lack the staff and skills needed to implement them. In a 2024 survey, six in ten public sector professionals cited the AI skills gap as their biggest obstacle in implementing AI tools. This reflects a broader IT staffing crisis, with over 450,000 unfilled cybersecurity roles nationwide, which is particularly acute in the public sector given lower salaries and smaller budgets.

These roadblocks at the state and local level pose a major risk to the entire country. In the cyber space, ransomware attacks on state and local targets have demonstrated that hackers can exploit small vulnerabilities in legacy systems to gain broad access and cause major disruption, extending far beyond their initial targets. The same threat trajectory is conceivable with AI. States and cities, lacking the necessary workforce and adhering to a patchwork of different regulations, will find themselves unable to safely adopt AI tools and mount a uniform response in an AI-related crisis. 

In 2021, Congress established the State and Local Cybersecurity Grant Program (SLCGP) at CISA, which focused on resourcing states, localities, and tribal territories to better respond to cyber threats. States have received almost $1 billion in funding to implement CISA’s security best practices like multifactor authentication and establish cybersecurity planning committees, which effectively coordinate strategic planning and cyber governance among state, municipal, and private sector information technology leaders. 

Federal investment in state and local AI capacity-building can help standardize the existing, disparate guidance and bridge resource gaps, just as it has in the cybersecurity space. AI coordination is less mature today than the cybersecurity space was when the SLCGP was established in 2021. The updated Federal Information Security Modernization Act, which enabled the Department of Homeland Security to set information security standards across government, had been in effect for seven years by 2021, and some of its best practices had already trickled down to states and localities. 

Thus, the need for clear AI state capacity, guardrails, and information-sharing across all levels of government is even greater. A small federal investment now can unlock large returns by enabling safe, effective AI adoption and avoiding costly failures. Local governments are eager to deploy AI but lack the resources to do so securely. Modest funding can align fragmented rules, train high-impact personnel, and surface replicable models—lowering the cost of responsible AI use nationwide. Each successful pilot creates a multiplier effect, accelerating progress while reducing risk.

Plan of Action 

Recommendation 1. Congress should authorize a three-year pilot grant program focused on state and local AI capacity-building.

SLCGP’s authorization expires on August 31, 2025, which provides two unique pathways for a pilot grant program. The Homeland Security Committees in the House and Senate could amend and renew the existing SLCGP provision to make room for an AI-focused pilot. Alternatively, Congress could pass a new authorization, which would likely set the stage for a sustained grant program, upon successful completion of the pilot. A separate authorization would also allow Congress to consider other federal agencies as program facilitators or co-facilitators, in case they want to cover AI integrations that do not directly touch critical infrastructure, which is CISA’s primary focus. 

Alternatively, the House Energy and Commerce and Senate Commerce, Science, and Transportation Committees could authorize a program coordinated by the National Institute of Standards and Technology, which produced the AI Risk Management Framework and has strong expertise in a range of vulnerabilities embedded within AI models. Congress might also consider mandating an interagency advisory committee to oversee the program, including, for example, experts from the Department of Energy to provide technical assistance and guidance on projects related to energy infrastructure.

In either case, the authorization should be coupled with a starting appropriation of $55 million over three years, which would fund ten statewide pilot projects totaling up to $5 million plus administrative costs. The structure of the program will broadly parallel SLCGP’s goals. First, it would align state and local AI approaches with existing federal guidance, such as the NIST AI Risk Management Framework and the Trump Administration’s OMB guidance on the regulation and procurement of artificial intelligence applications. Second, the program would establish better coordination between local and state authorities on AI rules. A new authorization for AI, however, allows Congress and the agency tasked with managing the program the opportunity to improve upon SLCGP’s existing provisions. This new program should permit states to coordinate their AI activities through existing leadership structures rather than setting up a new planning committee. The legislative language should also prioritize skills training and allocate a portion of grant funding to be spent on recruiting and retaining AI professionals within state and local government who can oversee projects.

Recommendation 2. Pilot projects should be implementation-focused and rooted in one of three significant risks: cybersecurity, energy usage, or data privacy.

Similar to SLCGP, this pilot grant program should be focused on implementation. The target product for a grant is a functional local or state AI application that has undergone risk mitigation, rather than a report that identifies issues in the abstract. For example, under this program, a state would receive federal funding to integrate AI into the maintenance of its cities’ wastewater treatment plants without compromising cybersecurity. Funding would support AI skills training for the relevant municipal employees and scaling of certain cybersecurity best practices like data encryption that minimize the project’s risk. States will submit reports to the federal government at each phase of their project: first documenting the risks they identified, then explaining their prioritization of risks to mitigate, then walking through their specific mitigation actions, and later, retrospectively reporting on the outcomes of those mitigations after the project has gone into operational use.

This approach would maximize the pilot’s return on investment. States will be able to complete high-impact AI projects without taking on the associated security costs. The frameworks generated from the project can be reused many times over for later projects, as can the staff who are hired or trained with federal support. 

Given the inconsistency of priorities surfaced in state and local AI directives, the federal government should set the agenda of risks to focus on. The clearest set of risks for the pilot are cybersecurity, energy usage, and data privacy, all of which are highlighted in NIST’s Risk Management Framework. 

• Cybersecurity. Cybersecurity projects should focus on detecting AI-assisted social engineering tactics, used to gain access into secure systems, and adversarial attacks like “poisoning” or “jailbreaking”, which manipulate AI models to produce undesirable outputs. Consider emergency response systems: the transition to IP-based, interconnected 911 systems increases the cyberattack surface, making it easier for an attack targeting one response center to spread across other jurisdictions. A municipality  could seek funding to trial an AI dispatcher with necessary guardrails. As part of their project, they could ensure they have the appropriate cyber hygiene protocols in place to prevent cyberattacks from rendering the dispatcher useless or exploiting vulnerabilities in the dispatcher to gain access to underlying 911 systems that multiple localities rely on. 

• Energy Usage. Energy usage projects should calculate power needs associated with AI development and implementation and the additional energy resources available to prevent outages. Much of the country faces a heightened risk of power outages due to antiquated grids, under-resourced providers, and a dearth of new electricity generation. AI integrations and supportive infrastructure that require significant power will place a heavy burden on states and potentially impact the operation of other critical infrastructure. A sample project might examine the energy demands of a new data center, powering an AI integration into traffic monitoring, and determine where that data center can best be constructed to accommodate available grid capacity.

• Data Privacy. Finally, data privacy projects should focus on bringing AI systems into compliance with existing data laws like the Health Insurance Portability and Accountability Act (HIPAA) and the Children’s Online Privacy Protection Act (COPPA) for AI interventions in healthcare and education, respectively. Because the U.S. lacks a comprehensive data privacy law, states might also experiment with additional best practices, such as training models to detect and reject prompts that contain personally identifiable information. A sample project in this domain might integrate a chatbot into the state Medicaid system to more efficiently triage patients and identify the steps the state can take to prevent the chatbot from handling PII in a manner that does not comply with HIPAA.

If successful, the pilot could expand to address additional risks or support broader, multi-risk, multi-state interventions.

Recommendation 3. The pilot program must include opportunities for grantees to share their ideas with other states and localities.

Arguably the most important facet of this new AI program will be forums where grantees share their learnings. Administrative costs for this program should go toward funding a twice-yearly (bi-annual) in-person forum, where grantees can publicly share updates on their projects. An in-person forum would also provide states with the space to coordinate further projects on the margins. CISA is particularly well positioned to host a forum like this given its track record of convening critical infrastructure operators. Grantees should be required to publish guidance, tools, and templates in a public, digital repository. Ideally, states that did not secure grants can adopt successful strategies from their peers and save taxpayers the cost of duplicate planning work. 

Conclusion 

Congress should establish a new grant program to assist state and local governments in addressing AI risks, including cybersecurity, energy usage, and data privacy. Such federal investments will give structure to the dynamic yet disparate national AI regulatory conversation. The grant program, which will cost $55 million to pilot over three years, will yield a high return on investment for both the ten grantee states and the peers that learn from its findings. By making these investments now, Congress can keep states moving fast toward AI without opening the door to critical, costly vulnerabilities.

This memo was written by an AI Safety Policy Entrepreneurship Fellow over the course of a six-month, part-time program that supports individuals in advancing their policy ideas into practice. You can read more policy memos and learn about Policy Entrepreneurship Fellows here.

The federal government transfers approximately $1.1 trillion dollars every year to state and local governments. Yet most states and localities are not evaluating whether the programs deploying these funds are increasing community well-being. Similarly, achieving important national goals like increasing clean energy production and transmission often requires not only congressional but also state and local policy reform. Yet many states and localities are not implementing the evidence-based policy reforms necessary to achieve these goals.

State and local government innovation is a problem not only of politics but also of capacity. State and local governments generally lack the technical capacity to conduct rigorous evaluations of the efficacy of their programs, search for reliable evidence about programs evaluated in other contexts, and implement the evidence-based programs with the highest chances of improving outcomes in their jurisdictions. This lack of capacity severely constrains the ability of state and local governments to use federal funds effectively and to adopt more effective ways of delivering important public goods and services. To date, efforts to increase the use of evaluation evidence in federal agencies (including the passage of the Evidence Act) have not meaningfully supported the production and use of evidence by state and local governments.

Despite an emerging awareness of the importance of state and local government innovation capacity, there is a shortage of plausible strategies to build that capacity. In the words of journalist Ezra Klein, we spend “too much time and energy imagining the policies that a capable government could execute and not nearly enough time imagining how to make a government capable of executing them.”

Yet an emerging body of research is revealing that an effective strategy to build government innovation capacity is to partner government agencies with local universities on scientifically rigorous evaluations of the efficacy of their programs, curated syntheses of reliable evaluation evidence from other contexts, and implementation of evidence-based programs with the best chances of success. Leveraging these findings, along with recent evidence of the striking efficacy of the national network of university-based “Agriculture Experiment Stations” established by the Hatch Act of 1887, we propose a national network of university-based “Policy Experiment Stations” or policy innovation labs in each state, supported by continuing federal and state appropriations and tasked with accelerating state and local government innovation.  

Challenge

Advocates of abundance have identified “failed public policy” as an increasingly significant barrier to economic growth and community flourishing. Of particular concern are state and local policies and programs, including those powered by federal funds, that do not effectively deliver critically important public goods and services like health, education, safety, clean air and water, and growth-oriented infrastructure.

Part of the challenge is that state and local governments lack capacity to conduct rigorous evaluations of the efficacy of their policies and programs. For example, the American Rescue Plan, the largest one-time federal investment in state and local governments in the last century, provided $350 billion in State and Local Fiscal Recovery Funds to state, territorial, local, and Tribal governments to accelerate post-pandemic economic recovery. Yet very few of those investments are being evaluated for efficacy. In a recent survey of state policymakers, 59% of those surveyed cited “lack of time for rigorous evaluations” as a key obstacle to innovation. State and local governments also typically lack the time, resources, and technical capacity to canvass evaluation evidence from other settings and assess whether a program proven to improve outcomes elsewhere might also improve outcomes locally. Finally, state and local governments often don’t adopt more effective programs even when they have rigorous evidence that these programs are more effective than the status quo, because implementing new programs disrupts existing workflows. 

If state and local policymakers don’t know what works and what doesn’t, and/or aren’t able to overcome even relatively minor implementation challenges when they do know what works, they won’t be able to spend federal dollars more effectively, or more generally to deliver critical public goods and services.

Opportunity

A growing body of research on government innovation is documenting factors that reliably increase the likelihood that governments will implement evidence-based policy reform. First, government decision makers are more likely to adopt evidence-based policy reforms when they are grounded in local evidence and/or recommended by local researchers. Boston-based researchers sharing a Boston-based study showing that relaxing density restrictions reduces rents and house prices will do less to convince San Francisco decision makers than either a San Francisco-based study, or San Francisco-based researchers endorsing the evidence from Boston. Proximity matters for government innovation.

Second, government decision makers are more likely to adopt evidence-based policy reforms when they are engaged as partners in the research projects that produce the evidence of efficacy, helping to define the set of feasible policy alternatives and design new policy interventions. Research partnerships matter for government innovation.

Third, evidence-based policies are significantly more likely to be adopted when the policy innovation is part of an existing implementation infrastructure, or when agencies receive dedicated implementation support. This means that moving beyond incremental policy reforms will require that state and local governments receive more technical support in overcoming implementation challenges. Implementation matters for government innovation. 

We know that the implementation of evidence-based policy reform produces returns for communities that have been estimated to be on the order of 17:1. Our partners in government have voiced their direct experience of these returns. In Puerto Rico, for example, decision makers in the Department of Education have attributed the success of evidence-based efforts to help students learn to the “constant communication and effective collaboration” with researchers who possessed a “strong understanding of the culture and social behavior of the government and people of Puerto Rico.” Carrie S. Cihak, the evidence and impact officer for King County, Washington, likewise observes, 

“It is critical to understand whether the programs we’re implementing are actually making a difference in the communities we serve. Throughout my career in King County, I’ve worked with  County teams and researchers on evaluations across multiple policy areas, including transportation access, housing stability, and climate change. Working in close partnership with researchers has guided our policymaking related to individual projects, identified the next set of questions for continual learning, and has enabled us to better apply existing knowledge from other contexts to our own. In this work, it is essential to have researchers who are committed to valuing local knowledge and experience–including that of the community and government staff–as a central part of their research, and who are committed to supporting us in getting better outcomes for our communities.” 

The emerging body of evidence on the determinants of government innovation can help us define a plan of action that galvanizes the state and local government innovation necessary to accelerate regional economic growth and community flourishing. 

Plan of Action 

An evidence-based plan to increase state and local government innovation needs to facilitate and sustain durable partnerships between state and local governments and neighboring universities to produce scientifically rigorous policy evaluations, adapt evaluation evidence from other contexts, and develop effective implementation strategies. Over a century ago, the Hatch Act of 1887 created a remarkably effective and durable R&D infrastructure aimed at agricultural innovation, establishing university-based Agricultural Experiment Stations (AES) in each state tasked with developing, testing, and translating innovations designed to increase agricultural productivity. 

Locating university-based AES in every state ensured the production and implementation of locally-relevant evidence by researchers working in partnership with local stakeholders. Federal oversight of the state AES by an Office of Experiment Stations in the US Department of Agriculture ensured that work was conducted with scientific rigor and that local evidence was shared across sites. Finally, providing stable annual federal appropriations for the AES, with required matching state appropriations, ensured the durability and financial sustainability of the R&D infrastructure. This infrastructure worked: agricultural productivity near the experiment stations increased by 6% after the stations were established.

Congress should develop new legislation to create and fund a network of state-based “Policy Experiment Stations.”

 The 119th Congress that will convene on January 3, 2025 can adapt the core elements of the proven-effective network of state-based Agricultural Experiment Stations to accelerate state and local government innovation. Mimicking the structure of 7 USC 14, federal grants to states would support university-based “Policy Experiment Stations” or policy innovation labs in each state, tasked with partnering with state and local governments on (1) scientifically rigorous evaluations of the efficacy of state and local policies and programs; (2) translations of evaluation evidence from other settings; and (3) overcoming implementation challenges. 

As in 7 USC 14, grants to support state policy innovation labs would be overseen by a federal office charged with ensuring that work was conducted with scientific rigor and that local evidence was shared across sites. We see two potential paths for this oversight function, paths that in turn would influence legislative strategy.

Pathway 1: This oversight function could be located in the Office of Evaluation Sciences (OES) in the General Services Administration (GSA). In this case, the congressional committees overseeing GSA, namely the House Committee on Oversight and Responsibility and the Senate Committee on Homeland Security and Governmental Affairs, would craft legislation providing for an appropriation to GSA to support a new OES grants program for university-based policy innovation labs in each state. The advantage of this structure is that OES is a highly respected locus of program and policy evaluation expertise. 

Pathway 2: Oversight could instead be located in the Directorate of Technology, Innovation, and Partnerships in the National Science Foundation (NSF TIP). In this case, the House Committee on Science, Space, and Technology and the Senate Committee on Commerce, Science, and Transportation would craft legislation providing for a new grants program within NSF TIP to support university-based policy innovation labs in each state. The advantage of this structure is that NSF is a highly respected grant-making agency. 

Either of these paths is feasible with bipartisan political will. Alternatively, there are unilateral steps that could be taken by the incoming administration to advance state and local government innovation. For example, the Office of Management and Budget (OMB) recently released updated Uniform Grants Guidance clarifying that federal grants may be used to support recipients’ evaluation costs, including “conducting evaluations, sharing evaluation results, and other personnel or materials costs related to the effective building and use of evidence and evaluation for program design, administration, or improvement.” The Uniform Grants Guidance also requires federal agencies to assess the performance of grant recipients, and further allows federal agencies to require that recipients use federal grant funds to conduct program evaluations. The incoming administration could further update the Uniform Grants Guidance to direct federal agencies to require that state and local government grant recipients set aside grant funds for impact evaluations of the efficacy of any programs supported by federal funds, and further clarify the allowability of subgrants to universities to support these impact evaluations.

Conclusion

Establishing a national network of university-based “Policy Experiment Stations” or policy innovation labs in each state, supported by continuing federal and state appropriations, is an evidence-based plan to facilitate abundance-oriented state and local government innovation. We already have impressive examples of what these policy labs might be able to accomplish. At MIT’s Abdul Latif Jameel Poverty Action Lab North America, the University of Chicago’s Crime Lab and Education Lab, the University of California’s California Policy Lab, and Harvard University’s The People Lab, to name just a few, leading researchers partner with state and local governments on scientifically rigorous evaluations of the efficacy of public policies and programs, the translation of evidence from other settings, and overcoming implementation challenges, leading in several cases to evidence-based policy reform. Yet effective as these initiatives are, they are largely supported by philanthropic funds, an infeasible strategy for national scaling.

In recent years we’ve made massive investments in communities through federal grants to state and local governments. We’ve also initiated ambitious efforts at growth-oriented regulatory reform which require not only federal but also state and local action. Now it’s time to invest in building state and local capacity to deploy federal investments effectively and to galvanize regional economic growth. Emerging research findings about the determinants of government innovation, and about the efficacy of the R&D infrastructure for agricultural innovation established over a century ago, give us an evidence-based roadmap for state and local government innovation.

This action-ready policy memo is part of Day One 2025 — our effort to bring forward bold policy ideas, grounded in science and evidence, that can tackle the country’s biggest challenges and bring us closer to the prosperous, equitable and safe future that we all hope for whoever takes office in 2025 and beyond.

PLEASE NOTE (February 2025): Since publication several government websites have been taken offline. We apologize for any broken links to once accessible public data.