Building the Transportation AI Policy Tracker: the state DOT layer

Can you paste a project memo into a public AI tool on your federal-aid contract? Forty-eight of the fifty-two state DOTs in the country do not publish their own AI policy. The rule exists. It just lives one level up: at the state CIO, the Office of Information Technology, or a Governor’s executive order. Most working PEs have never read theirs.

I compiled every state DOT’s published AI policy last week, plus the parent state CIO policy and Governor’s executive order that applies in each. Fifty states plus DC and Puerto Rico. Fifty-two entities. The data was messier than I expected, the regional split was sharper than I expected, and the consultant question (whether the policy reaches the engineer drafting the deliverable) is answered by only seven states.

This is installment 1 of the Transportation AI Policy Tracker, a maintained scoring of what every major transportation agency in the country publishes about AI use. The state DOT layer ships first. Over the next four months I am adding the federal layer (USDOT, FHWA, FAA, FTA, FRA, NHTSA, FMCSA, MARAD, USACE Civil Works), the major transit authorities, and the ports, tolls, and MPOs that sit above your contract. The full Tracker lives on GitHub. The dataset is open. You can fork it, fact-check it, and rerun the analysis on your own state.

What 52 state DOT policies actually say

I compiled every state DOT’s published AI policy last week. Fifty states plus DC and Puerto Rico. Fifty-two entities. Two findings did most of the work.

Forty-eight of fifty-two state DOTs inherit their AI policy from somewhere else. Only four publish their own. Minnesota DOT shipped GenAI Standard IT-003 on July 14, 2025. Missouri DOT names ChatGPT and Bing Chat by brand in its Employee Conduct guidance. Florida DOT published its AI Policy in May 2024. Texas DOT runs an AI Strategic Plan FY 2025-2027 (updated January 21, 2026) that reports 22,000 staff hours saved annually by automating invoice workflows in its Professional Engineering Procurement Services Division. Every other DOT operates under the parent state CIO, the state Office of Information Technology, or a Governor’s executive order, and most of those policies live on the state IT website, not the DOT’s.

For a working PE on a federal-aid contract, that means the rule that governs whether you can paste a project memo into a public AI tool is almost certainly not at your DOT. You are looking in the wrong place.

The bucket distribution across all 52 entities: 10 explicitly forbid putting non-public agency data into commercial GenAI. 27 explicitly permit it with stated guardrails. 3 are partial or hybrid. 12 are silent at every level, neither DOT nor parent state has published an AI-specific policy.

The regional split is sharper than I expected. The Midwest forbids: eight of twelve Midwestern DOTs prohibit non-public data into commercial AI, including Illinois (DoIT AI Policy v2, April 2025), Indiana (State Agency AI Systems Policy, December 2024), Iowa (PY-AI, March 2025), and Ohio (DAS IT-17, late 2023). The West permits: zero of thirteen Western DOTs forbid, and seven explicitly encourage with guardrails (Caltrans, ADOT, NDOT, ODOT, UDOT, WSDOT, plus Alaska under Admin Orders 359 and 360). The Northeast publishes the most formal frameworks: ten of thirteen entities sit in the encourage column, anchored by Massachusetts EOTSS, New Jersey OIT Circular 25-OIT-001, and the Maryland DoIT Responsible AI Policy v1.0. The South splits, with two operational leaders (Florida DOT and Texas DOT) plus two silent states (Arkansas DOT and West Virginia DOT, where the WVOT Acceptable Use Policy was still listed “coming soon” as of April 2026).

Only seven states extend their AI rules to contractors. This is the finding that matters most to a consulting PE.

Iowa (PY-AI, March 2025), Kansas (Statewide Policy P8200.00, signed by Governor Laura Kelly in August 2023), Ohio (DAS IT-17), Minnesota (MnDOT IT-003, July 2025), Louisiana (OTS AI Acceptable Use Policy, effective September 29, 2025), the District of Columbia (Mayor’s Order 2024-028, February 2024), and New Jersey (Joint Circular 25-OIT-001). Seven states. The other forty-five are silent on whether the policy reaches the consulting engineer drafting the deliverable.

MnDOT IT-003 says it cleanly: “Third parties working on behalf of MnDOT must work with MnDOT staff to ensure that any tools they use are approved by MnDOT before submitting private, confidential, protected, or otherwise not public data.” Kansas P8200.00 requires contractors to “disclose any use of generative AI or integrations with such platforms in their contracts.” Ohio DAS IT-17 explicitly applies to “state employees, contractors or temporary personnel.” The DC Mayor’s Order 2024-028 made DC the first major US city to mandate Responsible AI training for all government employees plus contractors.

Forty-five states leave the consultant question unanswered. Silence is not permission. The default reading: the consultant inherits the same rule as the agency until the contract says otherwise.

What to do before you touch AI on a federal-aid project

Four steps, in order, before you let AI near any deliverable:

1. Find the contract’s AI clause first. Most contracts written before 2024 are silent on AI. Silence is not permission. Read the IT acceptable-use language attached to the contract or your firm’s standard agreement, since that is what governs in silence.
2. Check the state DOT’s policy as of the contract date using the Tracker as the lookup. The Tracker tells you whether to look at the DOT itself, the state CIO, or the Governor’s EO. Most of the time it is not the DOT.
3. Check the federal preemption layer if federal-aid funding is involved. OMB Memo M-25-22 (“Driving Efficient Acquisition of Artificial Intelligence in Government,” effective September 30, 2025) added AI procurement guardrails on top of any state rule. The Trump executive order of December 11, 2025 preempts state AI laws on certain dimensions. The April 7, 2026 NIST concept note on the Trustworthy AI in Critical Infrastructure Profile applies to federal-aid infrastructure projects directly. Tracker installment 2 (about six weeks from now) covers this layer in detail.
4. If the consultant question is unanswered in your contract, default to no-cloud-uploads. Use on-prem or local models, or redacted prompts that strip agency-identifying data. If the workflow really needs cloud AI, get written permission from the contracting officer before you start. Written permission is the only thing that survives a deposition.

This is the protocol I use on my own consulting work. It does not replace your firm’s policy, your contract’s AI clause, or your state DOT’s published rule. It tells you which one applies and in what order. ASCE Policy Statement 573 (July 2024) reminds every PE that the engineer remains accountable for any deliverable bearing their stamp, AI-assisted or not. The rule does not get easier to find when something goes wrong. Find it now.

Reply with the agency you most want to see in the next Tracker installment. The federal layer (USDOT, FHWA, FAA, FTA, FRA, NHTSA, FMCSA, MARAD, USACE Civil Works) lands as installment 2 in about six weeks. Major transit authorities follow. Multi-state, port, toll, and MPO authorities close out the launch arc. If you have an agency I should add to the list, tell me.

The full Tracker, the source spreadsheet, and the methodology live at github.com/JosephD130/transportation-ai-policy-tracker. Refreshes quarterly once the launch arc closes.