A new toggle appears in the meeting platform. Notes, summaries, action items, speaker identification. The license covers it and the platform is approved, so the question looks settled.
It is not. Virginia’s standard is written around the use, not the product, and registration turns on six conditions of which any one is enough. The exemption that agencies reach for requires all three of its own conditions at the same time.
This article will not tell any agency whether its case needs registration — that belongs to the assigned reviewers. What it gives is the intake that reaches them with the facts already assembled.
Before opening the platform admin console:
| Ask | Because |
|---|---|
| Which feature, not which product | The standard covers AI embedded within other systems or applications, not just standalone products |
| Any one of six triggers? | External exposure, people data, production use, mission-critical, SEC530 data, cloud evaluation |
| All three exemption conditions? | Internally facing, no people data, non-production — together, or not at all |
| Notes, or actions? | An AI that writes a summary is a different decision from one that opens a ticket |
| Who signs? | The agency and its assigned reviewers. Not the vendor, and not an integrator |
Key Takeaways
- Virginia’s standard is EA-225, covering “both existing and new uses of AI; stand-alone, AI embedded and generative AI within other systems or applications” (VITA, retrieved 2026-08-20).
- The non-registration exemption requires all three of its conditions at once, which is a narrow space. Whether a given deployment clears it is a question for the agency’s assigned reviewers, not one this article answers.
- The embedded-product exemption is written for products “where the Commonwealth does not control the software or the data it uses” — read that clause closely if the agency administers its own tenant.
- Registration happens in Archer and the Commonwealth Technology Portfolio.
On this page
- Why the Product Label Settles Nothing
- The Six Registration Triggers
- The Exemptions, Read Slowly
- The Ten-Question Intake
- Notes, Summaries and Actions Are Three Decisions
- Questions Only the Room Can Answer
- Pilot Design and the Written Decision
- Who Decides, and Where the Record Goes
- Take the Intake Into the Review
Why the Product Label Settles Nothing
EA-225 “provides requirements for Commonwealth agencies and suppliers on the acceptable and ethical use of AI,” with scope covering “both existing and new uses of AI; stand-alone, AI embedded and generative AI within other systems or applications” (VITA, retrieved 2026-08-20).
The AI is not necessarily something an agency bought on purpose. It arrives inside a platform already in use, or inside a camera, a transcription service, or a workflow connector.
Two features from the same vendor, in the same tenant, can land on opposite sides of the line because the data and the exposure differ. Evaluate the feature and the use, not the product label.
Existing guidance on what AI meeting rooms actually improve covers the capability side of these features.
The Six Registration Triggers
Registration is required when the AI solution meets any of these:
- “Externally facing”
- “Uses people data”
- “Utilized in a production system”
- “Supports agency mission essential or business critical processes”
- “Includes sensitive data as defined in SEC530 Information Security Standard”
- “Requires review for the evaluation of cloud services”
Those are the conditions as published (VITA AI FAQs, retrieved 2026-08-20).
Several are easy to hit without meaning to. A transcript implicates people data. A meeting held in the tenant that staff actually use sits in a production system. A session including a member of the public, a contractor or another jurisdiction reaches outward.
The Exemptions, Read Slowly
Two kinds of exemption exist, and they behave differently.
The first is a non-registration exemption with three conditions, applying where the use is:
- “Internally facing”
- “Does not use people data”
- “Not incorporated in a production system (examples of non-production systems are sandbox, development and test systems only using synthetic or publicly available data)”
All three have to hold at once. A sandbox trial using recordings of real staff meetings fails the second. A pilot in the live tenant fails the third. The exemption is built for evaluation with synthetic or public data.
The second kind is policy-wide. Three categories sit outside the policy altogether:
- “AI used for defense or Commonwealth security systems, such as cybersecurity tools, HVAC controls, or SCADA systems”
- “AI embedded in common commercial products where the Commonwealth does not control the software or the data it uses. Examples include consumer devices like an Apple Watch or iPhone, commercial desktop software such as Adobe Photoshop, or managed SaaS applications”
- “AI used in research and development (R&D) or instructional programs at public institutions of higher education”
The middle one is what meeting technology reaches for, and the qualifying clause deserves slow reading: “where the Commonwealth does not control the software or the data it uses.” An agency administering its own tenant, holding its own recordings and setting its own retention is not obviously in that position.
None of this is a determination. The text is published, the reasoning is the agency’s, and the conclusion belongs to the assigned reviewers.
The Ten-Question Intake
Assemble the facts before the review, not during it.
- What is the feature, and what business outcome does enabling it serve?
- Who owns the feature, and who is accountable for switching it on?
- Who are the users, and can members of the public be present?
- What exactly is captured: audio, video, transcript, derived summary, speaker labels?
- How is the captured content classified, including against SEC530 in VITA’s policies and standards index?
- Where does processing occur, and does anything leave the Commonwealth’s control?
- Where do transcripts and derived records live, for how long, and who can reach them?
- Can the feature take an action, or does it only produce text?
- Who reviews the output before it is relied on, how is an error corrected, and how is the feature monitored once enabled?
- What happens on exit: how is the feature disabled and the accumulated content handled?
Two questions sit behind those ten: what changes if the vendor swaps a subprocessor, and what the agency would have to produce if someone asked for the record in six months.
Notes, Summaries and Actions Are Three Decisions
Approving all three at once collapses three different risk decisions into one signature.
| Step | What it produces | What widens | Question a reviewer is likely to ask |
|---|---|---|---|
| Transcription | A record of what was said | People data, retention, access | Who can reach the transcript, and for how long |
| Summarization | A document no participant wrote | Accuracy, attribution, records status | Who checks it, and how an error is corrected |
| Agentic action | A change in another system | Authority, traceability, blast radius | Which human approved it, and can that be shown |
A summary can be wrong in ways a transcript cannot, because it asserts rather than records. An action can be wrong in ways a summary cannot, because it has already happened.
Questions Only the Room Can Answer
Policy review tends to stop at the platform. Answer these about the specific room:
- Is the microphone always listening, or does capture start on a deliberate action?
- How is active capture signaled to everyone present, including someone arriving late?
- Who may start it, and can any participant stop it immediately?
- How are in-room speakers attributed when several people share one microphone?
- What happens in an impromptu gathering that was never scheduled?
- Does the signal path change when a remote participant joins?
- Does the room behave the same way after a reboot or a firmware update?
These are answerable facts about a specific room, and they are discovery work rather than policy work. Existing guidance on giving every networked AV endpoint a clear owner covers the ownership record they depend on.
Pilot Design and the Written Decision
Where the three conditions can genuinely be met, run the pilot with synthetic or publicly available content in a non-production system. Where they cannot, the pilot is itself likely a registrable use — a finding for the reviewers to confirm rather than an obstacle.
Either way, define in advance what success looks like, what would stop it, which room types are represented, and who signs the written decision.
Who Decides, and Where the Record Goes
VITA states that “all agencies and vendors are required to formally register both planned and active AI uses in their operational environments” through the Archer system and the Commonwealth Technology Portfolio via Planview Portfolios, under Executive Order 30 (VITA enterprise architecture, retrieved 2026-08-20).
Enterprise architecture review checks that “proposed designs comply with VITA standards, meet required service expectations, and properly document any exceptions,” with architects preparing “approval or rejection comments based on completeness, accuracy, and alignment with Commonwealth principles.”
Route the intake to the assigned enterprise architect, the AITR, the ISO and the agency head process as applicable. Whether these processes reach a local government is a question for that locality’s counsel, though the intake still works as a governance pattern for one that wants it.
Take the Intake Into the Review
The ten questions, the six triggers, the three exemption conditions and the room questions are on a one-page intake form.
Download the VITA AI meeting-feature intake — PDF, one page, no registration.
Related Reading
What VIcom Can Do Here
VIcom can assemble the room-layer facts an intake needs, document capture paths and signaling behavior, configure only what has been approved, and stage a pilot across representative room types.
VIcom does not make the registration determination, does not speak for VITA, and does not substitute for the agency’s assigned reviewers. Standards, FAQs and workflows change; confirm current requirements with VITA before relying on anything here.
Connect with VIcom by filling out the form below.