Full Text
Page 1 of 6 USE OF ARTIFICIAL INTELLIGENCE (AI) POLICY 1. Purpose This Artificial Intelligence Policy (Policy) establishes procedures and guidelines for AI systems used by, or on behalf of, the City of Woodburn (City). This Policy enables the City to use AI systems for the benefit of the community while safeguarding against potential harms. The primary objectives of the Policy are to: • Provide guidance that is clear, easy to follow, and supports effective decision-making regarding usage of the City’s AI systems or leveraging AI systems to provide services to the City and its residents. • Manage risk to information security and privacy related to the use of AI systems. • Define how AI systems may be used for legitimate City purposes in accordance with applicable local, state, and federal laws, and existing City policies. • Define prohibited uses of AI systems. 2. Scope This Policy applies to all City elected officials, employees, contractors, consultants, interns, and volunteers who may be using the City’s AI systems or who may be leveraging AI systems to provide services to the City. This Policy applies to all AI systems deployed by the City. 3. Definitions AI system: Any system, software, sensor, or process that automatically generates outputs in whole or in part using Artificial Intelligence. Artificial Intelligence (AI): A technology that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems use machine- and human-based inputs to perceive real and virtual environments; abstract such perceptions into models through analysis in an automated manner; and use model inference to formulate options for ---PAGE BREAK--- Page 2 of 6 information or action. AI Hallucinations: A response generated by AI that includes incorrect, fictional, fabricated, distorted, or misleading information that is presented as if it were fact. Chatbots: Computer programs that uses AI to simulate and process human conversation, allowing simplified human interaction with computers. Confidential Information: Any information deemed by the City to be confidential. The following is a non-exhaustive list of information that is considered confidential: i. Social Security Numbers (SSN) or Personal Information ii. Customer data iii. City financial data that is not publicly available iv. Network diagrams and security configurations v. Attorney-Client privileged documents or information vi. Documents or materials exempted under Oregon Public Records Law vii. viii. Bank account information and routing numbers ix. Payroll information x. Credit card information xi. Any confidential data held for a third party Generative AI: Generative Artificial Intelligence (Generative AI) is a class of computer software and systems, or functionality within systems, that use large language models, algorithms, deep-learning, and machine learning models, and are capable of generating new content, including but not limited to text, images, video, and audio, based on patterns and structures of input data. These also include systems capable of ingesting input and translating that input into another form, such as text-to-code systems. Generative AI can be used in stand-alone applications or incorporated into other applications. IT. The Information Technology Department. Personal Information: Information that can be used to distinguish or trace an individual’s identity, specifically, an individual’s first name or first initial and last name in combination with one or more of the following elements: a Social Security Number (SSN); a driver license number or state identification card issued by the Department of Transportation; a passport number or other identification number issued by the United States; a financial account number, credit card number, or debit card number in ---PAGE BREAK--- Page 3 of 6 combination with any required security code or password that would permit access to a financial account; or any biometric records, such as an image of a fingerprint, retina or iris, that are used to authenticate an individual’s identity. 4. Policy It is the policy of the City of Woodburn to leverage AI as a productive tool while also ensuring the City continues to meet its legal obligations in a responsible and ethical manner. When not managed carefully, the use of AI technologies can pose risks such as potential copyright infringement, breach of confidentiality, the circulation of inaccurate information, and unintentional bias. The use of AI at the City should never introduce undue risk to the City or its constituents. Rather, the use of AI should be focused on improving business efficiencies and enhancing the City’s ability to fulfill its mission and achieve the City Council’s Goals and Priorities. The City’s use of AI will adhere to the following: i. The use of any AI systems, tools, or Chatbots must be approved by Department Directors, Legal Department and the Information Technology Department (IT). IT will maintain a list of approved AI systems and make that list available to staff. The use of embedded AI features within other approved applications or software is allowed provided those features do not violate provisions of this policy; and IT has not placed limitations or conditions related to a specific application’s AI features in the approved applications list. The City’s Legal Department and IT Department must review and approve contracts with service providers that utilize AI. ii. Prior to using an AI system, Checklist for AI form must be completed and all concerns that are identified on the checklist are addressed with the City’s Legal and IT departments. iii. When using AI systems, staff must use a city-issued account, or an account created using a City-assigned email address. iv. All images and videos created by Generative AI systems must be attributed to the appropriate Generative AI system. Wherever possible, attributions and citations to the city should be embedded in the image or video via digital watermark). All attributions should include the name of the AI system used plus a human-in-the- loop assertion (which should include the department or group who reviewed/edited the content). Example: Some material in this brochure was generated using ChatGPT 4.0 and was reviewed for accuracy by a member of the XXX Department before publication. Staff using a Generative AI system must have expertise in the subject matter for which the system is used or must consult with someone who has such expertise. Generative AI systems are not a substitute for expertise. For example, if using a Generative AI system for creating development code, the individual using the system must have expertise in city planning and drafting code. v. All content produced by Generative AI or Chatbots (writing, datasets, graphs, pictures, etc.) must be thoroughly reviewed by an individual with expertise to ---PAGE BREAK--- Page 4 of 6 evaluate such content for accuracy and to ensure the content is proofread and edited. Users must also be diligent in screening for AI Hallucinations in generated work product. Users of generative AI will be responsible for errors in work and unintended consequences from use of AI-derived work product that is false, inaccurate, or misleading. vi. To the extent feasible, when using a given AI system or tool, users should opt out of any voluntary data training scheme that allows the AI system provider to use City provided data as training data to update its system. Users should also elect zero-data retention such that any input provided is not stored by the AI system provider. vii. All uses of AI systems must comply with the City’s Cybersecurity Policy and must adhere to the AI system’s terms of use. viii. In the event of an Electronic Incident involving the use of an AI system, the City will follow its Cybersecurity Incident Response Process. Refer to the definition of an Electronic Incident in the Cybersecurity Policy. Special Considerations in use of AI i. Confidentiality: There is no expectation of confidentiality for information entered into AI platforms, systems, or tools and no practical way to limit its dissemination thereafter. Therefore, the use of AI shall be limited only to information that is or would otherwise be available to the public. Confidential and non-public information entered into AI systems becomes available to both the vendor of the software and, in some cases, to the public. Thus, entering non-public information or data into AI systems could lead to unauthorized disclosures, legal liabilities, and other consequences. ii. Public Records: Staff should be aware that use of AI systems may result in the creation of a public record that must be retained under Oregon’s Public Records and Meetings Law. For example, both Ring Central and Microsoft Teams have AI Assistants that can transcribe your phone call or take minutes of your meeting. These AI applications are turned off by IT as default. If transcription capabilities of any software is turned on by staff, it should be recognized that these transcriptions and minutes are public records and must be retained. As is the case with e-mail or other forms of communication that are subject to Oregon Public Records and Meetings law, staff should ensure that they are comfortable with the entire contents of the communication being recorded by the AI system being released to the public. Once the AI system begins documenting your communication, that entire communication may be subject to a public records request and public disclosure, even if the communication is informal or does not pertain to official city business. iii. Intellectual Property: Content generated by AI systems may include copyrighted material. AI systems may be “trained” using data (text, images, etc.) that has been sourced from the internet without regard to copyright or licensing terms. It is extremely difficult to determine what content was used to train an AI system, and difficult to verify whether AI-generated content is wholly original or only a slight stylization of existing copyrighted material. Nevertheless, staff are required ---PAGE BREAK--- Page 5 of 6 to perform due diligence to ensure that no copyrighted material is published by the City without obtaining proper rights. Staff should also refrain from needlessly entering or uploading creative works protected by City copyright into AI systems (e.g. photographs, graphics, etc.). iv. Attribution and Accountability: Audiences should know when content was produced by Generative AI in whole or in part. If staff uses AI-generated content in an official city capacity, the content should be clearly labeled as having been produced using Generative AI tools. This allows consumers of the content to understand its authorship and be able to evaluate the content accordingly. v. Reduction of Harm & Bias: AI systems can reflect the cultural, economic and social biases of the source materials used for training the AI, and the algorithms used to parse and process that content can be a source of bias as well. Staff should carefully review any content generated by AI to ensure that unintended or undesirable instances of bias, or even potentially offensive or harmful material, is changed or removed. vi. Data Privacy: Staff must not submit sensitive, confidential or regulated data, or any personally identifiable data about members of the public to a generative AI system. Prohibited uses of AI systems include: i. Using any AI system not previously approved by IT. ii. Entering or uploading any Confidential Information, unless the AI system has been explicitly approved for use with Confidential Information by IT and Legal. In the event of such an approval, IT and Legal will provide guidance and limitations about the appropriate use (e.g. Anonymizing data before inputting it into an AI system may be an acceptable solution when necessary to carry out a critical project.). iii. Using personal Generative AI system accounts to conduct City business. iv. Storing anything related to City business within a Generative AI system that was created for personal use or storing personal data in a Generative AI system that was created for City business purposes. v. Creating images with likenesses of City staff or volunteers or members of the public without permission or approval from the City Administrator or their designee. vi. Using AI systems for any activities that are harmful, biased, discriminatory, deceptive, illegal, or in violation of City policies. vii. Using AI systems for employment-related decisions, including for hiring, firing, or promotion. viii. Performing real-time and covert biometric identification. ix. Performing emotion analysis, or the use of computer vision techniques to classify human facial and body movements into certain emotions or sentiment positive, negative, neutral, happy, angry, nervous). x. Making fully automated decisions that do not require any meaningful human ---PAGE BREAK--- Page 6 of 6 oversight but substantially impact individuals. xi. Using social scoring, or the use of algorithmic systems to track and classify individuals based on their behaviors, socioeconomic status, or personal characteristics. xii. Conducting cognitive behavioral manipulation of people or specific vulnerable groups. xiii. Using fully autonomous weapons systems. If City staff become aware of an instance where an AI system has caused harm, staff must report the instance to their supervisor and IT. 5. References • City of San Francisco Generative AI guidelines. • City of San Francisco AI Guidelines Video. • City IT List of Approved AI Systems and Tools 6. Forms • AI Checklist form 7. Review of Policy and Procedures This policy will be reviewed every two years or as state and federal regulations are revised and necessitate change in the policy or procedures. Adopted: March 2025