Tips for Creatinga Generative AI Policy for Local Governments

Generative artificial intelligence (AI) is here. 

Generative AI is impactful; it’s changing how the average office worker synthesizes information and creates content, and it’s not going away anytime soon, which means, local governments, just like their private sector counterparts, need policies and procedures for its safe, responsible and efficacious adoption.

The first step local government IT leaders should take to empower staff to safely and securely leverage AI is to establish governance through formal documentation and distribution of  an AI policy. The policy should clearly outline the types/classification of data that can and cannot be used with generative AI tools and emphasize that staff should never enter proprietary or personally identifiable information into generative AI tools to avoid potential data leaks or breaches. Other considerations to include in policy language are as follows:

• Access Controls: Establish strict access controls for generative AI systems to limit usage to authorized personnel only. Implement multi-factor authentication and role-based access to prevent unauthorized access and potential misuse of AI tools.

• Determine if Your Administration will Leverage Open or Closed AI Models: Open AI involves the transparent sharing of AI models, the origin of training data, and the underlying code, while Closed AI conceals or safeguards one or more of these components. Closed AI typically offers higher speed and accessibility through various cloud services. While not as swift, Open AI fosters enhanced scrutiny of the underlying code, models, and data, often leading to improved explainability and security. Additionally, transparency regarding data sources can serve as a protective measure for enterprises against potential intellectual property and copyright infringements as the legal landscape continues to evolve.

• Data Anonymization: Ensure that any data used with generative AI tools is anonymized and devoid of personal identifiers to protect individual privacy and prevent data exposure.

• Regular Auditing and Monitoring: Implement regular audits and monitoring of generative AI systems to detect anomalies or potential security breaches promptly. Monitor data inputs and outputs to ensure compliance with security policies.

• Training and Awareness: Provide comprehensive training to employees on the responsible use of generative AI tools and the importance of following security policies. Raise awareness about the risks associated with improper data usage and potential consequences. Use the training to assuage concerns that AI will replace full-time staff positions and help employees see generative AI systems as tools to expedite content organization, copy outlines, and first drafts to expedite the often time-consuming content creation process.

• Third-Party Vendor Security: If third-party vendors provide generative AI tools, ensure that these vendors adhere to strict security standards and regularly assess their security practices.

• Data Retention and Disposal: Establish data retention and disposal guidelines in compliance with data privacy regulations. Data should only be stored for the necessary period and disposed of securely once it is no longer needed.

• Disaster Recovery and Incident Response: Develop robust disaster recovery and incident response plans specific to generative AI systems. This strategy will help minimize the impact of potential security incidents and ensure a swift response to security breaches.

• Encryption and Secure Transmission: Implement encryption for data transmission and storage to protect against unauthorized access to sensitive data used with generative AI tools.

• Ethical Considerations: Address ethical considerations in the policy, emphasizing the responsible use of generative AI tools. Avoid generating content that may be harmful, offensive, biased or that infringes on copyright and intellectual property rights.

Finally, local governments should regularly review their generative AI security policies to remain up-to-date and aligned with evolving security threats and best practices.

Conclusion

As local governments strive to provide secure and efficient services to residents, adopting processes that leverage the best of what generative AI can offer in tandem with comprehensive security measures will be crucial. Embracing generative AI with thoughtful policies and transparent practices allows local governments to enhance customer service, optimize operations, and build stronger connections with their communities, all while maintaining robust local government cybersecurity and data privacy solutions. Local governments can seize the transformative potential of generative AI to serve their residents better by staying informed, proactive, and committed to responsible generative AI adoption.