Seven things: which tools staff may use, what they may never enter, how AI chats are kept as public records, who reviews the output, what record of use the county keeps, what contracts require, and when the policy is reviewed. The National Association of Counties (NACo) recommends a stand-alone generative AI policy that points to the policies you already have. Our free county AI use policy template is ready to copy.
Where should a county start?
With one policy that ties the others together. NACo’s AI County Compass advises counties to “begin with a stand-alone policy on GenAI that will include references to other policies that have applicable guidelines and are relevant.” Your records, security, privacy and procurement policies already apply to AI; the AI policy says how.
What may staff use, and what may they never enter?
Name the approved tools and what each is approved for. NACo lists “Areas of permissible and non-permissible use” among the legal questions to settle. Then name the data that stays out: personal information, confidential records, and criminal justice information, which brings in the CJIS rules. NACo’s training advice covers elected officials too: “Develop a training plan for both your employees and elected officials that avoids putting PII in the AI or GenAI tool or process.”
Are staff AI chats public records?
In many states, yes, when they are about county business, whatever the account. The policy should say so, map AI chats to your retention schedule, and say how a records request for AI chats is answered.
Who reviews the output?
A person, every time it matters. NACo: “Keep humans in the loop from start to finish when using GenAI tools and reviewing results.” Decisions about benefits, permits or enforcement stay with staff.
What record of AI use should the county keep?
One the county can search. NACo: “Accountability also includes assessing impact, remediating risk, creating an audit trail and validating results,” and “Be sure that your IT team or the solution provider has demonstrated that there are audit logs for an agreed period (follow your records retention policy or practices here).” New York’s state IT office goes further for its own agencies: “All interactions with approved GenAI tools (e.g., ChatGPT, Copilot) should be logged for a minimum of 90 days.” Say where the log lives, how long it is kept and who may search it.
What belongs in the contract?
NACo advises checking that “protective clauses are included in requests for proposals (RFPs), requests for information (RFIs) and final contracts.” At minimum: county data is not used for training, where it is stored, how it is exported, and support for records requests.
How often should it be reviewed?
NACo suggests “every six months.” The tools change faster than most policies.
What should a county do now?
- Copy the template and adapt it with your county attorney.
- List the AI tools staff already use, approved or not, before you write the approved list.
- Set the review date when you adopt it.
Where Verillian fits
Verillian keeps the record of every captured AI interaction on your county’s own servers, so the audit trail your policy calls for stays with the county. Verillian never receives your prompts, responses or records.
Sources read on 28 October 2026.