--- title: "County AI use policy template, free to copy and adapt | Verillian" description: "A free, plain-language AI use policy template for counties. Covers public records, CJIS, HIPAA, human review and procurement. No sign-up." url: "https://verillian.ai/resources/county-ai-use-policy-template/" --- # A free county AI use policy you can copy This is a plain-language AI use policy template for county governments, written for IT directors, records officers and county attorneys. It is free to copy and adapt, with no sign-up. It is a starting point to adapt with your county's own attorney, not legal advice. [Download the Word template](https://verillian.ai/downloads/county-ai-use-policy-template.docx) \[County Name\] Policy on the Use of Generative Artificial Intelligence This policy is a starting point to adapt with the county's own attorney and is not legal advice. 1. Purpose \[County Name\] uses technology to serve residents. Generative AI tools can help staff draft, summarize and analyze, and they also create risks for privacy, accuracy, security and public records. This policy sets plain rules so staff can use approved tools with confidence and know what is not allowed. 2. Scope This policy applies to all county employees, interns, volunteers and contractors who use AI tools for county business, on any device and any account, whether county-owned or personal. Elected offices and other independent county officers may adopt this policy by written notice to the \[County Administrator or equivalent\]. Offices that do not opt in are encouraged to follow it. 3. Definitions - Generative AI means software that produces text, images, audio, code or other content in response to a prompt. This includes chatbots, writing assistants, image generators and AI features built into other software. - Approved tool means a generative AI tool, at a specific version or plan, that has been approved under Section 4 and appears on the county's approved tools list. - Personal account means any account on an AI tool that is not issued and managed by the county. - Prompt means anything a person types, pastes, uploads or says to an AI tool. Output means what the tool returns. - Sensitive information means the categories listed in Section 5. 4. Approved tools and the approval process Staff may use only approved tools for county business. The \[Department\] of Information Technology maintains the approved tools list and publishes it on \[location\]. A tool is approved only after review by three groups together: Information Technology, the \[Records Officer or Clerk\], and \[County Attorney or Legal\]. Where the tool may touch criminal justice or health information, the county's CJIS point of contact or privacy officer also joins the review. The review asks at least these questions: - What data does the tool collect, and where is it stored? - Does the vendor use county prompts, files or outputs to train or improve its models? - Can the county retrieve, export and delete prompts and outputs? - Does the tool keep a log of use the county can reach, for the period the county's retention schedule sets? - Does the vendor's contract meet Section 11? - Which data categories is the tool approved for, and which is it not? Approval is specific. A tool approved for drafting a meeting agenda is not automatically approved for case files. The approved tools list states the permitted uses for each tool. New AI features that appear inside software the county already uses are treated as new tools until reviewed. 5. What staff may and may not enter into AI tools Staff may enter information that is already public or that is intended for public release, such as published ordinances, public meeting notices and general questions. Unless the approved tools list says otherwise for that tool, staff must not enter any of the following: - Personal information about residents, employees or applicants, including names with account numbers, Social Security numbers, driver license numbers, financial account details and dates of birth. - Criminal justice information, as described in Section 9. - Protected health information and other health records, as described in Section 10. - Records that are confidential, privileged or exempt from disclosure under \[State public records law\], including attorney-client communications, personnel and disciplinary files, investigation files and pending litigation materials. - Security details such as passwords, access keys, network diagrams, vulnerability reports, building security plans and incident response plans. - Procurement information that is protected before award, such as sealed bids and evaluation scores. - Any information a vendor or partner has given the county under a confidentiality agreement. When in doubt, do not enter it, and ask your supervisor or the Information Technology help desk. 6. Public records and retention Prompts and outputs about county business can be public records under \[State public records law\]. This is true whatever the device or account used. Using a personal account for county business does not remove the record from the county's obligations. Staff must follow these rules: - Treat prompts and outputs that relate to county business as records, and keep them under the county's records retention schedule, \[State retention law or records schedule\]. - Brainstorming, rough drafts and other transitory use may carry little or no retention requirement under the schedule. Output that is used in a decision, a final document, a policy or a response to a resident is kept for the period that applies to the final document. - Do not rely on an AI tool as the place where records are kept. Save records that must be retained to the county's records system. - Tell the \[Records Officer or Clerk\] promptly when a records request, subpoena or litigation hold may reach AI prompts or outputs. - Do not delete prompts or outputs that are subject to a pending request or hold. The \[Records Officer or Clerk\] decides how requests for AI prompts and outputs are answered, with advice from \[County Attorney or Legal\]. 7. Accuracy and human review Generative AI can produce text that sounds right and is wrong, incomplete or biased. A person owns every output they use. - Any AI output used in a decision, a legal or financial document, or anything sent to the public must be read and checked by a qualified staff member before use. - Staff must verify facts, figures, names, citations and legal references against reliable sources. Do not assume an AI-supplied citation exists. - AI must not make final decisions about benefits, licenses, employment, enforcement or service eligibility. A person makes and signs those decisions. - Staff should watch for outputs that treat people differently based on protected characteristics, and must report concerns to their supervisor. 8. Disclosure of AI-drafted public content When AI materially drafted content that the county publishes or sends to the public, the department must say so in a short note, for example: "This content was drafted with the help of an AI tool and reviewed by county staff." Light edits such as spelling, grammar or formatting do not need a note. A resident who contacts the county must be told when they are talking to an automated system rather than a person, and must be able to reach a person. 9. Criminal justice information Criminal justice information (CJI) is governed by the FBI CJIS Security Policy, currently version 6.1, and by the county's own CJIS agreements and rules. Those rules apply in full to any use of AI tools. - No CJI may be entered into any AI tool unless the \[Sheriff or criminal justice agency head\] and the agency's CJIS point of contact have approved that tool in writing for that use. - Approval follows the CJIS Security Policy rules for external systems, including a signed agreement with the vendor where those rules require one. - The approval must be recorded on the approved tools list. - Suspected exposure of CJI to an AI tool is reported under Section 12 and to the CJIS point of contact within the time the county's CJIS agreement requires. 10. Health information Where the county or a county department is a covered entity or business associate under HIPAA, protected health information (PHI) may be entered into an AI tool only if all of the following are true: - The \[Privacy Officer\] has approved the tool for that use. - A business associate agreement is in place with the vendor. - The use is permitted by the county's HIPAA policies. Free or consumer versions of AI tools are not approved for PHI unless the \[Privacy Officer\] says so in writing. Health information held by the county outside HIPAA is still sensitive information under Section 5. 11. Procurement and contracts Contracts for AI tools, and for any software that includes AI features, must be reviewed by \[County Attorney or Legal\] and must address at least the following: - County prompts, files and outputs remain county data and are not used to train or improve the vendor's models, or those of any third party, without the county's written consent. - The location where county data is stored and processed, and any subcontractors that handle it. - Retention, export and deletion of county data, including at the end of the contract. - Breach notice to the county within \[number\] hours. - Support for the county's public records obligations, including retrieval of prompts and outputs. - Where applicable, the CJIS and HIPAA terms described in Sections 9 and 10. Departments must not accept click-through terms for an AI tool on behalf of the county. 12. Security and incidents - Use county-issued accounts and county-managed devices for county business. Do not use personal accounts for county business. - Do not share county credentials with an AI tool or connect an AI tool to county systems without Information Technology approval. - Do not install AI browser extensions, plug-ins or agents that read county data unless they appear on the approved tools list. - Report any suspected misuse, exposure of sensitive information or unapproved tool use to \[Information Technology Security Contact\] immediately and no later than \[number\] hours after discovery. Reporting in good faith will not be treated as misconduct in itself. The county's existing computer use and monitoring policies continue to apply to AI tools used on county systems. 13. Training Staff must complete \[County Name\] AI training before they use an approved tool, and again \[annually or every number months\]. Training covers this policy, the data limits in Section 5, records duties, checking outputs, and how to report an incident. Supervisors receive additional guidance on reviewing AI-assisted work. 14. Roles - Department heads make sure their staff know this policy and approve department-level uses within it. - Information Technology maintains the approved tools list, reviews tools and handles security incidents. - The \[Records Officer or Clerk\] advises on retention and answers records requests. - \[County Attorney or Legal\] advises on contracts, exemptions and legal risk. - The \[Privacy Officer\] and CJIS point of contact advise on health and criminal justice information. - Every user is responsible for following this policy and for the outputs they use. 15. Exceptions A department may request an exception in writing to \[Information Technology Director\]. The request states the tool, the data involved, the reason and the safeguards. An exception requires the approval of the Information Technology Director, the \[Records Officer or Clerk\] and \[County Attorney or Legal\], is time-limited, and is recorded. No exception may permit use of CJI or PHI contrary to Sections 9 and 10 or to applicable law. 16. Violations Violating this policy may lead to loss of access to AI tools and to discipline under \[County personnel rules\], up to and including termination. Contractors may face contract remedies. 17. Review cycle This policy is reviewed at least every \[6 or 12\] months by Information Technology, the \[Records Officer or Clerk\] and \[County Attorney or Legal\], and sooner when law, guidance or the county's tools change. Effective date: \[date\]. Last reviewed: \[date\]. Policy owner: \[Title\]. 18. Acknowledgment I have read and understand the \[County Name\] Policy on the Use of Generative Artificial Intelligence, and I agree to follow it. Name: \[Employee name\] Signature: \[Signature\] Department: \[Department\] Date: \[date\] We can show you the record of AI use on a county device in a short demo. ## See Verillian on a real device. [Request a demo](https://verillian.ai/demo/)