Loading...
HomeMy WebLinkAboutWORKSHOP AI Policy JEFFERSON COUNTY BOARD OF COUNTY COMMISSIONERS AGENDA REQUEST TO: Board of Commissioners FROM: Shawn Frederick, Central Services Director DATE: May 18,2026 RE: Workshop of Artificial Intelligence Policy STATEMENT OF ISSUE: Artificial Intelligence has become a tool integrated into nearly every software platform used to conduct business in the modern world. It is vital the county take appropriate steps to monitor the use of AI at work to protect sensitive information. The county also needs to take intentional steps to improve staffs ability to recognize the appropriate use of AI tools and develop processes that lead to more efficient public services ANALYSIS: Work on the AI policy began nearly two years ago and has gone through several iterations prior to being submitted to the PAO office for review.The proposed Al Policy relies for completeness on the Darwin Al Organizational Policy (also attached),which was developed by adding inputs to the Darwin GovernTM Al Policy Wizard (https://www.darwingov.com/ai-policy-wizard). In addition, important protections were developed using the references in Appendix A of the proposed policy.This proposed policy, if adopted will be used to configure guardrails for the Darwin Govern system allowing for effective monitoring of AI tools within the county system. FISCAL IMPACT: N/A RECOMMENDATION: The Board of County Commissioners adopt by resolution the attached Artificial Intelligence policy. REVIEWED BY: • 5(13(36 Josh •. Peters, County Administrator Date STATE OF WASHINGTON County of Jefferson In the Matter of Adopting the Jefferson County Artificial Intelligence Acceptable RESOLUTION NO. XX-XXXX-XXR Development and Use Policy WHEREAS, generative artificial intelligence (AI)represents a significant leap forward in technology, by generating novel text, images, and other content, which has the capacity to transform the way Jefferson County conducts business and serves the public; and, WHEREAS, generative AI can enhance human potential and creativity but must be deployed and regulated carefully to mitigate and guard against a new generation of risks, harms, and perpetuation of existing inequities; and, WHEREAS, Jefferson County is committed to accuracy, reliability, and ethical outcomes when adopting generative AI technology, and serving all of those who reside, work, and do business in Jefferson County in a transparent, engaged, and equitable way; and, WHEREAS, Jefferson County seeks to realize the potential benefits of generative AI through the deployment of generative AI tools that improve the equitable and timely delivery of services, while balancing the benefits and risks of these new technologies; and, WHEREAS, a generative AI policy is necessary to govern the development, deployment, management and use of generative AI use in Jefferson County government affairs in a thoughtful manner that upholds the public trust, ensures safety and security, and promotes ethical standards; NOW, THEREFORE, THE BOARD OF COUNTY COMMISSIONERS OF JEFFERSON COUNTY,WASHINGTON,HEREBY RESOLVE AS FOLLOWS: Section 1. Whereas Clauses are Findings of Fact. The Jefferson County Board of Commissioners hereby adopts the above "Whereas"clauses as Findings of Fact. Section 2. Purpose. The purpose of this resolution is to adopt the Jefferson County Artificial Intelligence Acceptable Development and Use Policy. Section 3. Adoption of the Jefferson County Artificial Intelligence Acceptable Development and Use Policy. The Jefferson County Artificial Intelligence Acceptable Development and Use Policy is hereby adopted. Section 4. Repealing and Replacing Any Inconsistent Policy that Addresses the Topic of this Ordinance. This Ordinance controls over any other ordinance, resolution or policy on the same topic. Section 5. Severability. If any section, subsection, sentence, clause, phrase or section of this Ordinance or its application to any person or circumstance is held invalid, the remainder of this 1 Ordinance or its application to other persons or circumstances shall be fully valid and shall not be affected. Section 7. Effective Date. The Ordinance becomes effective upon the dated of adoption. Section 8. SEPA Categorical Exemption. This ordinance is categorically exempt from the State Environmental Policy Act under WAC 197-11-800 (19). (SIGNATURES FOLLOW ON THE NEXT PAGE) 2 APPROVED and ADOPTED this day of , 2026. JEFFERSON COUNTY BOARD OF COMMISSIONERS Greg Brotherton, Chair SEAL: Heidi Eisenhour, Member Heather Dudley-Nollette, Member ATTEST: Carolyn Gallaway, CMC Date Clerk of the Board Approved as to form only: Philip C. Hunsucker Date Chief Civil Deputy Prosecuting Attorney 3 JEFFERSON COUNTY ARTIFICIAL -02i°n: April l5, INTELLIGENCE ACCEPTABLE DEVELOPMENT AND USE POLICY This AI Policy governs all uses of artificial intelligence by or on behalf of Jefferson County, Washington. Document Code No.: Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page ii of ii TABLE OF CONTENTS TABLE OF CONTENTS ii (1) INTRODUCTION 1 (2) PURPOSES 1 (3) GUIDING PRINCIPLES AND VALUES (4) DEFINITIONS 3 (5) APPLICABILITY OF THIS AI POLICY 8 (6) Compliance with Existing Laws and Policies 8 (7) Prohibited uses of an AI System 9 (8) PUBLIC RECORDS ACT COMPLIANCE 11 (9) architectural and technical STANDARDS 11 (10) ROLES AND RESPONSIBILITIES 11 (11) AI SYSTEM AND USE CASE APPROVAL PROCESS 13 (12) PROCEDURES 16 (13) CONSEQUENCES FOR NONCOMPLIANCE 18 (14) LIMITATIONS OF THIS AI POLICY 18 APPENDIX A: REFERENCES 20 APPENDIX B: RELEVANT COMPLIANCE REQUIREMENTS 22 APPENDIX C: Records protected from disclosure that should not be used in an ai system 23 Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 1 of 23 JEFFERSON COUNTY ARTIFICIAL INTELLIGENCE ACCEPTABLE DEVELOPMENT AND USE POLICY (1)INTRODUCTION Artificial Intelligence (AI) technology is increasingly becoming an integral part of local government operations, offering opportunities to enhance the efficiency and effectiveness of public services. At the same time, the use of AI also presents ethical, legal, and social challenges that require responsible management. This AI Policy provides a framework for the effective and responsible use of AI systems within the County, to maximize the benefits of these innovative tools while minimizing their potential risks to both the County and the public. (2)PURPOSES The purposes of this AI Policy are to: A. Ensure ethical and responsible development, deployment, and use of AI technology in the County, ensuring they are in alignment with the principles of transparency, fairness, accountability, and public trust. B. Enable effective use of AI technology by providing clear guidance to the County personnel, vendors, and other partners who work with AI systems. C. Inform community members and other stakeholders about how the County is utilizing AI technology and what measures it is taking to protect the public from potential adverse consequences of these systems. D. Promote responsible and ethical use of AI technology by defining the principles and values that govern the application of this technology within the County. E. Ensure the compliance of AI systems with all applicable federal, state, and local laws and regulations as well as existing the County policies. F. Assign roles and responsibilities related to the County's use of AI systems. G. Establish processes that encourage effective and responsible use of AI systems. H. Define prohibited uses of AI systems. I. Specify measures which may be taken in the event of failure to comply with these policies. This AI Policy may be updated from time to time to account for changes in AI technology, laws and regulations, uses of AI systems within the County, and other considerations. In addition, the Central Services Director may publish an AI User Guide to provide more detailed guidance on how the requirements of this AI Policy is to be implemented. Unless otherwise stated, Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 2 of 23 any such additional guidance should be considered an extension of this AI Policy and carry the same requirements for compliance. (3)GUIDING PRINCIPLES AND VALUES The County's AI development, deployment, and use of artificial intelligence systems shall be guided by the following guiding principles and values: (a) We expect to retain appropriate human agency and oversight,allowing for intervention to prevent harm. (b) We expect to use internal and external security testing of systems before public release for high-risk artificial intelligence systems. (c) We expect to protect data privacy and security. (d) We expect to promote appropriate transparency for consumers when they interact with artificial intelligence systems or products created by artificial intelligence. (e) We expect to ensure accountability, considering oversight, impact assessment, auditability, and due diligence mechanisms. (f) We expect to make AI accessible to all residents, including those with disabilities or limited access. (g) We expect to govern the deployment and maintenance of AI systems with human oversight ensuring adherence to relevant laws and regulations and by defining roles and responsibilities. (h) We expect to implement measures to detect and mitigate biases in order to prevent harm. (i) We expect to continuously monitor and enhance AI systems based on feedback and technological advancements. (j) We expect proper management, quality,and stewardship of data used by AI systems. (k) We will promote digital literacy among residents to help them understand and engage with AI systems. (1) We expect AI systems reliable, meet their objectives, and deliver precise and dependable outcomes in their deployment contexts; (m) We expect AI decisions to be understandable to those affected. (n) We expect AI systems to prevent discrimination and bias,ensuring fair treatment for all residents. Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 3 of 23 (o) We expect AI systems should be developed and deployed with a human- centered approach that evaluates their impact on the public. (p) We expect technological innovation to be embraced responsibly while minimizing environmental impact. (q) We expect AI systems to comply with all relevant laws and regulations. (r) We expect privacy concerning personal data to be protected, while satisfying the requirements of the Washington Public Records Act, chapter 42.56 RCW. (s) We expect AI systems to comply with data protection laws. (t) We expect AI systems not to cause harm and to prioritize the safety of residents. (u) We expect AI systems to be secure against unauthorized access and ensure consistent performance. (v) We expect the use of AI systems to be proactively communicated to the public, ensuring that AI systems,their data sources,operational models,and governing policies are understandable and documented. (w) We expect Staff to be empowered to use AI in their roles through education,training, and collaborations that promote participation and opportunity. These guiding principles and values are the inspiration for this AI Policy,and AI users are expected to incorporate these same motivations in the implementation of this AI Policy. While the ideal course of action may not be obvious or practical in every circumstance,this AI Policy is designed to offer guidance to help AI users responsively navigate the use of AI systems. (4)DEFINITIONS (a)"Artificial Intelligence" (or"Al")' means a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments. Artificial intelligence systems use machine and human-based inputs to: (i) Perceive real and virtual environments; (ii) Abstract such perceptions into models through analysis in an automated manner; and, (iii) Use a model to formulate options for information or action. I Slightly modified, this is the definition from the National Artificial Intelligence Initiative Act of 2020, 15 U.S.0 section 9401. Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 4 of 23 (b) "AI best practices" means the best practices described in National Cyber Security Centre, Best Practices for Securing Data Used to Train & Operate AI systems, Ver. 1.0 (May 2025). (c) "AI model" means a set of programmed instructions that processes data to perform tasks, make decisions, or solve problems within an AI system. (d) "AI Policy" means this Jefferson County Artificial Intelligence Acceptable Development and Use Policy. (e) "AI System"2 means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments and includes any tool, software, process, workflow, or other system which is based on AI or which uses an AI tool. (f) "AI Tool" means a piece of software which provides AI functionality and can be applied to a specific use case. (g) "AI Use Case" means specific task or purpose for which an AI tool is used or under consideration. (h) "AI User" means any person is using, developing, purchasing, configuring, or maintaining any AI used by or for the County, including contractors, consultants, elected officials, employees, and volunteers. (i) "AI User Guide" means a document which supplements an AI Policy with more detailed guidance on how to implement this AI Policy. (j) "Bias" means systematic tendencies that can exist within AI systems, often stemming from flawed data, algorithms, or design processes, that may lead to discriminatory or inaccurate outcomes affecting certain groups or persons. (k) "Central Services" means the County Central Services Department. (1) "Central Services Director" means the person holding the title of Director of Central Services or a delegee that has been delegated in writing. (m) "Chatbot" means a computer program that simulates human conversation through text or voice interactions. 2 For greater precision, this defmition was modified, using Colorado's AI Act, Colo. Rev. Stat. § 6-1-1701 (Lexis Advance through Chapter 22 of the 2026 Regular Session,effective as of March 26,2026). Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 5 of 23 (n) "Consequential decision"3 means a decision that has a material legal or similarly significant effect on, or the cost of: (i) Hiring or retention of a contractor, employee, vendor or volunteer; (ii) Any budget decision; (iii) The provision of any essential government service; (iv) Health care (as defined in this AI Policy); (v) Risk management, including but not limited to obtaining coverage for any risks by an insurance company or a self-insurance program; or, (vi) The provision of legal services. (o) "County" means the County, Washington. (p) "County Approved AI system" means an AI system approved for use by AI users as specified in section 7.a. (q) "Data" means any digital representation of information, knowledge, facts, concepts, data programs or instructions that are being prepared or have been prepared in a formalized manner and are intended for use in a data network, data program, data services, or data system. (r) "Health care provider"4 means a person who is licensed, certified, registered, or otherwise authorized by the law of this state to provide health care in the ordinary course of business or practice of a profession. (s) "Health care"' means any care, service, or procedure provided by a health care provider: (i) To diagnose, treat, or maintain a patient's physical or mental condition; or, (ii)That affects the structure or any function of the human body. (t) "Health care information" means all information about health care that is protected from disclosure by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, 45 C.F.R. Parts 160 and 164, Chapter 70.02 RCW (Medical Records—Health Care Information Access and Disclosure) or RCW 42.56.360 (Health care 'Adapted from the Colorado AI Act,Colo. Rev.Stat. §6-1-1701 (2026). a Definition from RCW 70.02.010(19). 5 Definition from RCW 70.02.010(15). Document Code No.: Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 6 of 23 exemption from disclosure of records under the Washington Public Records Act). (u) "High-risk AI system"6 means any AI system that, when deployed, makes, or is a substantial factor in making, a consequential decision. "High-risk AI system" does not include an AI system if: (i) The AI system is intended to: (A) Perform a narrow procedural task; (B) Detect decision-making patterns or deviations from prior decision-making patterns and is not intended to replace or influence a previously completed human assessment without sufficient human review; (ii) The AI system uses the following technologies, unless the technologies, when deployed, make, or are a substantial factor in making, a consequential decision: (iii) Anti-fraud technology that does not use facial recognition technology; (iv) Anti-malware; (v) Anti-virus; (vi) AI-enabled video games; (vii) Calculators; (viii)Cybersecurity; (ix) Databases; (x) Data storage; (xi) Firewall; (xii) Internet domain registration; (xiii)Internet website loading; (xiv)Networking; 6 Adapted from the Colorado AI Act,Colo. Rev. Stat. §6-1-1701 (2026). Document Code No.: Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 7 of 23 (xv) Spam- filtering; (xvi)Robocall-filtering; (xvii) Spell-checking; (xviii) Spreadsheets; (xix)Web caching; (xx) Web hosting or any similar technology; or, (xxi)Technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or recommendations, and answering questions and is subject to County policy that prohibits generating content that is discriminatory or harmful. (v) "IT" means the Jefferson County Information Technologies Department, a division of Central Services. (w) "Public Record" has the same meaning as in RCW 42.56.010(3).7 (x) "Risk management" means coordinated activities to direct and control an organization with regard to risk. (y) "Section" means a section of this AI Policy, unless there is clear language in this AI Policy that a section of this AI Policy does not apply. (z) "Substantial factor"8 means a factor that: (A) Assists in making a consequential decision; (B) Is capable of altering the outcome of a consequential decision; and, (C) Is generated by an AI system. ' "`Public record' includes any writing containing information relating to the conduct of government or the performance of any governmental or proprietary function prepared, owned, used, or retained by any state or local agency regardless of physical form or characteristics.For the office of the secretary of the senate and the office of the chief clerk of the house of representatives,public records means legislative records as defined in RCW 40.14.100 and also means the following: All budget and financial records; personnel leave, travel, and payroll records; records of legislative sessions;reports submitted to the legislature;and any other record designated a public record by any official action of the senate or the house of representatives. This definition does not include records that are not otherwise required to be retained by the agency and are held by volunteers who: (a)Do not serve in an administrative capacity; (b)Have not been appointed by the agency to an agency board,commission,or internship;and (c)Do not have a supervisory role or delegated agency authority."RCW 42.56.010(3). 'Adapted from the Colorado AI Act,Colo.Rev. Stat. § 6-1-1701 (2026). Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 8 of 23 "Substantial factor" includes any use of an AI system to generate any content, decision,prediction, or recommendation concerning consequential decision. (aa) "Writing" has the same meaning as in RCW 42.56.010(4).9 (5)APPLICABILITY OF THIS AI POLICY (a) This AI Policy governs the development, procurement or use of any AI systems (as defined in this AI Policy) by or on behalf of the County. (b) All County boards, commissions, committees, departments, and task forces shall comply with this AI Policy. (c) This AI Policy applies to: (i) Agents, contractors, elected officials, employees, officers, vendors and volunteers of the County who operate on behalf of the County; and, (ii)All AI users (as defined in this AI Policy). (d)This AI Policy does not apply to any AI system which: (i) Has been evaluated and determined in writing by the Central Services Director to be safe for unrestricted usage; (ii)Has AI features included in applications maintained by Central Services, which are not part of the AI feature's core functionality or involve the use of sensitive data; and, (iii) That is only are for personal use, outside of work hours, and that does not use the County resources, including but not limited to computers or servers owned or operated by the County. (6)COMPLIANCE WITH EXISTING LAWS AND POLICIES Development and use of AI systems shall comply with: (a) All applicable federal, state, and local laws and regulations; and, (b) All County policies, including but not limited to: 9 "`Writing' means handwriting, typewriting, printing, photostating, photographing, and every other means of recording any form of communication or representation including,but not limited to,letters,words,pictures,sounds, or symbols, or combination thereof, and all papers, maps, magnetic or paper tapes, photographic films and prints, motion picture,film and video recordings,magnetic or punched cards,discs,drums,diskettes,sound recordings,and other documents including existing data compilations from which information may be obtained or translated."RCW 42.56.010(3). Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 9 of 23 (i) Jefferson County Social Media Policy (Resolution No. 14-20, March 16, 2020). (ii) Jefferson County Public Records Act Compliance Policy (Resolution No. 10- 22,February 28,2022). (iii) Open Public Meeting Act Guidelines for Jefferson County Boards, Commissions & Committees (Resolution No. 50-22, October 24, 2022). (iv) Jefferson County Personnel Administration Manual (Resolution No. 19-0407- 25R, April 7, 2025). (7)PROHIBITED USES OF AN AI SYSTEM (a) The following AI systems are approved for use by the persons subject to this AI Policy listed in section 5, subject to the limitations in this section 7: (i) Microsoft's Enterprise AI system called Co-Pilot(which is part of the Microsoft 360 suite of programs) is the only AI system to be used for generative AI that is approved for use by AI users (as defined in this policy). (ii) The Central Services Director shall maintain a list of any other approved AI systems. (b)Use of an AI system on a County-owned computer, server or system that is not approved pursuant to this AI Policy is prohibited. (c)Use of any high-risk AI system (as defined in this AI Policy) is prohibited. (d)Use of an AI system on a County-owned computer, server or system to create any deepfake, which is an image created by using machine learning to capture and encode unique biometric characteristics of targets to combine the subject's unique characteristics with the acquired knowledge of general human expression in order to then synthesize the target's facial features, voice, mannerisms, etc. is prohibited. (e) Entry any of the following data into an AI system is prohibited: (i) Personal financial information for any individual. This includes credit card number, bank account number, PIN numbers, and any other financial information. (ii) Authentication information. Inputting any passwords, login credentials, or other authentication information into an AI system is prohibited. (iii) Personally Identifying Information. Inputting any personally identifying information into an AI system is prohibited. Personally identifying information includes name, address, phone number, email address, social Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 10 of 23 security number, passport number, driver's license number, and any other information that can reasonably be used to identify an person. (iv) Health care information (as defined in this AI Policy). (v) Sensitive or confidential information. This includes any information that could be used or disclosed to harm the County or its employees or volunteers, or residents such as information about political affiliations, religious beliefs, membership in a protected class, criminal history, or information related to the County information system. (vi) Any information exempted from disclosure by the Public Records Act, chapter 42.56 RCW or some other federal or state statute, including but not limited to: (A) Attorney-client privileged records relating to representation of the County by its attorneys. The attorney-client privileged records are protect communications and advice between an attorney and their client. RCW 5.60.060(2)(a) constitutes an "other statute' exemption under RCW 42.56.070(1) (B) Attorney work product records. Attorney work product records are: "Records that are relevant to a controversy to which an agency is a party but which records would not be available to another party under the rules of pretrial discovery for causes pending in the superior courts are exempt from disclosure under [the Public Records Act]." RCW 42.56.290. (C) Autopsy records. Autopsy and post mortem reports and records are confidential and exempt from examination by the public. RCW 68.50.105(1). (D) Records related to juvenile offenses. RCW 13.50.050(1), (3). (E) Records of a person confined in jail. RCW 70.48.100(2). (F) Personal information in files maintained for County employees, appointees, or elected officials of any public agency to the extent that disclosure would violate their right to privacy. RCW 42.56.230(3). (G) Specific intelligence information. Secret information, information about an enemy, or conclusions drawn from such information or that would disclose particular methods or procedures for gathering or evaluating intelligence information. RCW 42.56.240(1). (H) Specific investigative records. Information on active ongoing law enforcement investigations. RCW 42.56.240(1). Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 11 of 23 (I) Records protected by an "other statute which exempts or prohibits disclosure of specific information or records." RCW 42.56.070(1). A list of"other statutes" is attached as Appendix D. (8)PUBLIC RECORDS ACT COMPLIANCE Any product created by any AI system necessarily will be a "public record," as defined in RCW 42.56.010(3). All public records shall be managed in compliance with chapter 40.14 RCW (Preservation And Destruction of Public Records), chapter 42.56 RCW(Public Records Act), and the County's most recent version of the Jefferson County Public Records Act Compliance Policy. (9)ARCHITECTURAL AND TECHNICAL STANDARDS The architectural and technical standards associated with the enterprise use of AI systems shall be maintained by IT. (10) ROLES AND RESPONSIBILITIES The following persons and groups are responsible for the duties involved in implementing this AI Policy, as described below: (a) Central Services Director. The Central Services Director shall be responsible for: (i) Providing a public report at least annually to the Board of County Commissioners on County AI usage. (ii) Developing this AI Policy and additional guidance. (iii) Coordinating AI initiatives across departments and teams. (iv) Overseeing compliance with laws, regulations and County policies. (v) Providing guidance to AI users across the organization. (vi) Convening and overseeing the AI Working Group. (vii) Leading the AI review process. (viii)Directing technology resources, policies, projects, and services. (ix) Approving AI Policy and related guidance. (x) Facilitating collaboration between teams and departments for successful implementation of this AI Policy. Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 12 of 23 (xi) Overseeing enterprise security infrastructure and cybersecurity operations. (xii) Maintaining security policies, procedures, standards, and guidelines. (xiii)Monitoring compliance with security policies and related requirements. (xiv)Ensuring accurate data sensitivity classification and protections. (xv) Advising on compliance on AI usage. (xvi)Identifying legal issues and risks related to AI usage. (xvii) Investigating alleged violations of this AI Policy and recommend corrective actions. (b)AI Review Committee The Board of County Commissioners shall establish an AI Review Committee with department representatives which shall be make recommendations to the Central Services Director on oversight and guidance on AI initiatives within the County. The AI Review Committee shall review and consider updates to this AI Policy at least annually to reflect technological advancements and evolving community needs. The AI Review Committee shall be responsible for making recommendations to the Central Services Director on the following topics: (i) AI systems being considered for use by the County. (ii) Ethical concerns and conflicts. (iii) Policy and guidance updates. (c)County Administrator The County Administrator shall be responsible for: (i) Approving proposed changes to this AI Policy. (ii) Making a final determination whether to allow AI use cases which involve substantial risks of harm or other negative consequences. (iii) Enforcing corrective action for violations of this AI Policy. (d)Electeds and Department Heads Electeds and department heads or a delegee shall be responsible for: Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 13 of 23 (i) Ensuring employee, contractor and vendor compliance with this AI Policy. (ii) Integrating AI systems into department operations that comply with this AI Policy. (iii) Facilitating training for staff on this AI Policy and AI best practices (as defined in this AI Policy). Unless otherwise specified, the specific officials listed above may delegate to one or more persons to act on their behalf with respect to this AI Policy, and in such cases those designees are understood to inherit the same authorities and obligations as the named officials. (e)AI Users (i) All AI users are responsible for complying with the requirements of this Al Policy. (ii) All AI users have the responsibility to verify the accuracy of any information acquired through the use of AI systems before using that information in any final, published, or production documents. (11) AI SYSTEM AND USE AND CASE APPROVAL PROCESS (a) AI Systems Review Process The Central Services Director shall establish a process under which all AI systems and AI Use Cases are subject to a thorough review to determine their compliance with this AI Policy prior to their implementation. The review process shall: (i) Confirm compliance with the specific requirements and prohibitions established under this AI Policy; (ii) Consider the relative benefits and risks of each system or use case and determine whether or not approval is reasonable and aligned with the values and principles in this AI Policy; (iii) Specify the intended use cases of those systems and whether or not other use cases require additional review; (iv) Document the results of each review using a standard template, which results shall be retained for either the full lifespan of the AI system or use case or the retention period required under law for similar documents (whichever is longer). (b)Determination of High Risk Potential Negative Impacts Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 14 of 23 (i) The Central Services Director shall create a standard for determining whether or not a particular AI system or AI use case has a high risk of potential negative impacts to any relevant person, group, or organization. (ii) A high-risk determination,that AI system or use case shall be presented to the full AI Review Committee for approval. (iii) Lower-risk AI systems and use cases may be approved by the Central Services Director at their discretion. (iv) The Central Services Director shall revisit all previously-approved AI systems and use cases at least annually, or sooner in the event of substantial modifications(such as a major software upgrade or change in scope), and confirm in writing to the County Administrator the continued compliance and reasonableness of the AI system or use case. (c)Monitoring,Evaluation, and Accountability (i) The Central Services Director shall be responsible for implementing AI systems to monitor AI system performance,effectiveness, and policy compliance. The data collected from these AI systems shall be periodically reviewed to evaluate the effectiveness of AI systems and their impacts on the community. (ii) The Central Services Director shall establish procedures and protocols for responding to failures of AI systems and violations of this AI Policy, including corrective actions with regard to both the AI systems themselves and the persons and organizations involved. (iii) Upon the recommendation of the Central Services Director, Central Services Director, and/or County Administrator, independent audits shall be conducted to review AI systems for compliance with policies and ethical standards. Findings from audits and evaluations shall be used to refine AI policies, improve AI system functionalities, and determine any additional training or accountability requirements. (d)Data Management, Privacy, and Retention All AI systems shall comply with applicable data protection laws, regulations, and policies to safeguard data protected by this AI Policy. (e)Mitigation of Bias and Human Oversight All AI users shall be responsible for taking steps to mitigate potential biases(including but not limited to biases related to protected characteristics such as race, gender, sexual orientation,national origin, disability, or language)in AI systems they interact with, in Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 15 of 23 accordance with training and recommendations provided by the Central Services Director. (f) Transparency and Explainability Upon the consideration or introduction of a new AI system which is likely to have major public impact, the Central Services Director shall ensure that key information is provided to affected groups and other stakeholders in a timely manner. Such information shall be provided in multiple formats or languages if necessary, consistent with the County's practice in communicating To the greatest extent possible,AI systems should provide clear and understandable explanations for their decisions and outputs,particularly in cases where erroneous results may create a risk of substantial negative impacts. (g)Training (i) All users shall be provided with regular training on Al technologies, ethical considerations, and compliance requirements to ensure knowledgeable and responsible use of AI systems, as recommended by the Central Services Director. (ii) The Central Services Director shall develop specific training requirements and content for users granted access to high-risk AI systems and associated data, focusing on compliance with this AI Policy and other associated laws, regulations, policies, and AI best practices. (iii) These trainings shall be updated on a regular basis to ensure their accuracy and relevance, and users' continued access to high-risk AI systems and data shall be contingent upon completion of additional required trainings determined by the Central Services Director. (h)Vendors and Third Parties (i) All vendors and other third parties who provide or interact with AI systems shall be required to comply with this and all other applicable policies, and this compliance shall be explicitly included in all relevant contracts and similar agreements. (ii) All technology vendors shall be required to disclose whether and how AI is used in their products and services, and what mechanisms they provide to allow for auditing these AI systems. These disclosures shall be provided using a standard form developed and maintained by the Central Services Director and required in all technology procurements. (iii) Vendors shall be evaluated based on their commitment to responsible AI development and their history of adherence to ethical standards, and preference in procurement decisions shall be given to vendors which can Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 16 of 23 effectively provide transparency into their AI systems and practices to both the County and the public. (i) Labeling of AI-generated Content All content generated by AI systems and presented to the public shall be clearly labeled as such. This shall include all text, audio, image, and video content, as well as interactive AI systems such as chatbots and automated decision-making tools. All persons involved in disseminating content generated by an AI system on behalf of the County shall be responsible for ensuring the accuracy of such content and its appropriate labeling. The Central Services Director or designee shall establish standard mechanisms for the County personnel and members of the public to report violations of this labeling requirement. (12) PROCEDURES (a)Attribution (i) The use of AI systems and the resulting product(s) shall be attributed, referenced, and cited in any electronic or paper material produced and published by anyone subject to this AI Policy. (ii) Attribution should include a description of the source application, how it was used, how the material was edited, by whom, and the date. For example: "Microsoft Co-Pilot was used to generate the charts and data referenced above. The content was reviewed and edited before being published by Sam Smith, Jefferson County Public Works Department, on 04/15/2026." (b)Intellectual Property Content produced by AI systems may implicate intellectual property rights and likely will include copyrighted material. AI systems shall be "trained" using Data(text, images, etc.) that has been sourced from the internet without regard for copyright or licensing terms. It is extremely difficult to determine what content was used to train an AI system, and difficult to verify whether AI-generated content is wholly original or only a slight stylization of existing copyrighted material.Nevertheless, County AI users are required to perform due diligence to ensure that no copyrighted material is published by the County without proper attribution or without obtaining proper rights. (c)Validation Required (i) Complex algorithms of AI systems exponentially increase risk when incomplete or inaccurate data is involved. AI systems shall be validated and regularly assessed to ensure completeness and accuracy. Results • Document Code No.: Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 17 of 23 from decisions, code, or research supported by AI systems should consistently align with those of a human subject matter expert. (ii) AI users shall verify the accuracy of any information acquired through the use of AI systems before using that information in any final, published, or production documents. If AI users are uncertain about the accuracy of the obtained information, they should consult their supervisor or seek advice from a IT. (iii) AI users shall independently verify any quotes or references generated by AI systems. AI users shall not assume that a quote or reference is accurate, or real. AI systems rarely act as if they are uncertain, making false answers difficult to spot. AI systems can generate: (A) Fabricated content, sometimes called "hallucinations." This is a phenomenon where an AI system, particularly those using large language models, generates false, inaccurate, or illogical information while presenting it in a confident, authoritative, and convincing manner. Fabricated content occurs when an AI system creates synthetic data, fabricates facts, or invents nonexistent sources. An AI system may invent fake academic papers, legal cases, scientific studies, or personal facts. (B) Factual Errors: Stating incorrect facts, such as "Einstein won two Nobel Prizes." (C) Image Distortions: AI systems can create anatomically incorrect figures (e.g., too many fingers). Verification shall include cross-referencing sources included in the AI output, or independently verifying dates, names and events in peer reviewed or authoritative published literature on the interne or printed material. (d)Decision Making County departments shall utilize AI systems to enhance efficiency and effectiveness. AI systems can be used for idea generation and as one source of information when researching a topic. AI systems products shall be human reviewed and edited before usage in any final, published, or production documents. This is particularly important when the content is public facing. AI users shall be responsible for their use of AI systems and the application of any content or product in work tasks generated by AI systems. (e)Equity and Inclusion While AI systems can reduce workloads, support capacity, and increase accessibility, the generated content reflects the cultural, economic, and social biases of the source materials used for training. The algorithms applied can be a source of bias as well. Applying Document Code No.: Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 18 of 23 principles from the equity and empowerment lens, AI users should thoroughly review any content generated by AI systems to ensure that any instances of bias, or potentially offensive or harmful material, is changed or removed. When it comes to the adoption of AI systems, the County's goal is to eliminate digital disparities and ensure that persons who belong to a protected class and those impacted by language or other accessibility barriers have equal access to and benefit from the County programs,activities,benefits,and services.To uphold this commitment,the County applies the equity and empowerment lens to address race,color,national origin,disability,religion, age, gender, sexual orientation, gender identity and expression, marital status, veteran status, source of income, or any other basis prohibited by federal, state, or local law. (f) Final Requirements Under no circumstances is a County employee authorized to engage in any activity that is illegal under local, state, federal, or local law while utilizing County-owned resources. AI users shall comply with all applicable County policies and are required to read and understand them. Responsibilities for protecting County information do not end at the termination of employment. These responsibilities continue until the information is reclassified to be public. (13) CONSEQUENCES FOR NONCOMPLIANCE Departments shall ensure compliance with this AI Policy and are accountable for any AI systems deployed. Violations of this AI Policy shall be grounds for disciplinary action,up to and including termination of employment;and enforcement action which shall include civil or criminal penalties. (14) LIMITATIONS OF THIS AI POLICY1° (a) Nothing in this AI Policy restricts the County or any other person's ability to: (i) Comply with federal, state, or municipal laws, ordinances, or regulations; (ii) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, a state, a municipal, or other governmental authority; (iii) Cooperate with a law enforcement agency concerning conduct or activity that the developer, deployer, or other person reasonably and in good faith believes may violate federal, state, or municipal laws, ordinances, or regulations; 1'Adapted from the Colorado AI Act,Colo.Rev. Stat. §6-1-1705 (2026). Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 19 of 23 (iv) Investigate, establish, exercise, prepare for, or defend legal claims; (v) Take immediate steps to protect an interest that is essential for the life or physical safety of a consumer or another person; (vi) By any means other than the use of facial recognition technology, prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or illegal activity; investigate, report, or prosecute the persons responsible for any such action; or preserve the integrity or security of AI systems; (vii) Conduct research, testing, and development activities regarding an AI system or AI model, other than testing conducted under real- world conditions, before the AI system or AI model is deployed or put into service; or, (viii)Assist any other person with any of the obligations imposed under this AI Policy. (b)Nothing in this AI Policy imposes any obligation on any person that adversely affects their rights or freedoms, including the rights to freedom of speech or freedom of the press that are guaranteed in: (i) The first amendment to the United States constitution; or, (ii) Section Article I, Section 5 of the Washington constitution. Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 20 of 23 APPENDIX A: REFERENCES Reference To is Federal Law National Artificial Intelligence Initiative Shaping AI 15 U.S.C. section Act of 2020 (P.L. 116-283) development and use in 9401 et. seq. the United States Health Insurance Portability and Protection of heath 45 C.F.R. Parts 160 Accountability Act of 1996(HIPAA) information and 164. Privac Rule Protection of the Right to Privacy Protection of privacy Chapter 9.73 RCW Preservation and Destruction of Public Rules for preservation Chapter 40.14 RCW Records and destruction of public records Washington Public Records Act Promote open Chapter 42.56 government RCW Health care exemption from disclosure of Protection of heath RCW 42.56.360. records under the Washington Public information Records Act Medical Records—Health Care Protection of heath Chapter 70.02 RCW. Information Access and Disclosure Law information SHB 1205 (2025) Reenacts and amends See the URL in the RCW 9A.60.010 and footnote below." 9A.60.045 and makes it a crime to knowingly distribute a forged digital likeness of another person to defraud, harass, threaten, or intimidate another, or for an unlawful su sose other References and Standards National Cyber Security Centre, Best Best Practices for See the URL in the Practices for Securing Data Used to development and use of footnote below. 12 Train& Operate AI systems, (Ver. 1.0 AI systems May 2025) " https://lawfilesext.leg.wa.gov/biennium/2025-26/PdfBills/Session%20Laws/House/1205-S.SL.pdf, Accessed April 11,2026. 12 https://media.defense.gov/2025/Ma1/22/2003720601/-1/-1/0/CSI Al DATA SECURITY.PDF, Accessed April 12,2026. Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Pa s e 21 of 23 Reference I opic Citation National Institute of Standards and Standards for use of AI See the URL in the Technology, Artificial Intelligence Risk systems footnote below.13 Management Framework(AI RMF 1.0 2023) Washington State Artificial Intelligence ESSB 5838 (2024) See the URL in the Task Force's Interim Report(December established the footnote below.14 1, 2025) Washington State Artificial Intelligence Task Force to evaluate AI development, use and risks Mark H. Francis and Ashwini Jarrala, Washington State See the URL in the Legal Practitioner's Guide to AI& Artificial Intelligence footnote below.15 Hallucinations (February 16, 2026) Task Force companion report Colorado's AI Act(March 26, 2026) Regulation of AI Colo. Rev. Stat. § 6- 1-1701 et. seq. See the URL in the footnote below.16 13 https://doi.org/10.6028/NIST.AI.100-1,Accessed April 11,2026. 14https://agportal-s3 bucket.s3.us-west- 2.am azonaws.com/A I%20Task%20Force/WA%20AI%20Task%20Force%20- %20Literature%20Review%20oh/o20AI%20Risks%20and%20Opportunities.pdf?Vers ion Id=2ImmRG ns5cIZgxE tRqJtYuwtg7eC9q,Accessed April 1,2026. 15 https://nationalcenterforstatecourts.app.box.com/v/Legal-practitioner-guide-AI,Accessed April 1,2026. 16https://practicalcompIiance.thomsonreuters.com/Browse/Home/Jurisdictions/UnitedStates/Colorado/ColoradoStatu tes?guid=NBB934F3017CE 11 EF9141 A71 BA98479C6&originationContext=documenttoc&transitionType=Default &contextData=(sc.Default)&firstPage=true,Accessed April 15,2026. Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 22 of 23 APPENDIX B: RELEVANT COMPLIANCE REQUIREMENTS This appendix provides references to applicable key regulations and standards. This appendix does not replace the authoritative source and is only a reference to assist with further research. Please use the Compliance Standard and Section No. to further research the entirety of the regulation, framework or standard from the authoritative source. Compliance Standard Location Description HIPAA 45 CFR 164, Subpart C Security Standards for the Protection of Electronic Protected Health Information. 45 CFR 164.316 Policies and procedures and documentation requirements. PCI DSS v3.2 12.2 at page 295 Acceptable Uses of the Technology. (Jun. 2024) NIST CSF 2.0 Information Protection Processes and Procedures. (Feb. 2024) NIST 800-536, AI system Use Notification. Revision 5 AC-8 at page 40 (Sep. 2020) Various sections Policies and Procedures. PL-4 at page 197 Rules of Behavior. PS-6 at page 226 Access Agreements. Document Code No.: *** Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy Page 23 of 23 APPENDIX C: RECORDS PROTECTED FROM DISCLOSURE BY AN "OTHER STATUTE" THAT ARE NOT BE USED IN AN AI SYSTEM [add chart here] Artificial Intelligence Systems Policy for Jefferson County Introduction Artificial Intelligence(AI)technology is increasingly becoming an integral part of local government operations, offering opportunities to enhance the efficiency and effectiveness of public services. At the same time,the use of AI also presents ethical, legal, and social challenges that require responsible management. This policy provides a framework for the effective and responsible use of AI systems within Jefferson County, to maximize the benefits of these innovative tools while minimizing their potential risks to both the organization and the public. The purpose of this policy is to: •Enable effective use of AI technology by providing clear guidance to Jefferson County personnel, vendors, and other partners who work with AI systems. • Inform community members and other stakeholders about how Jefferson County is utilizing AI technology and what measures it is taking to protect the public from potential adverse consequences of these systems. • Promote responsible and ethical use of AI technology by defining the principles and values that govern the application of this technology within Jefferson County. • Ensure the compliance of AI systems with all applicable federal, state, and local laws and regulations as well as existing Jefferson County policies. •Assign roles and responsibilities related to Jefferson County's use of AI systems. • Establish processes that encourage effective and responsible use of AI systems. • Define prohibited uses of AI systems. • Specify measures which may be taken in the event of failure to comply with these policies. This policy may be updated from time to time to account for changes in AI technology, laws and regulations, uses of AI systems within Jefferson County, and other considerations. In addition,the Central Services Director may publish an AI User Guide or other related documents that provide more detailed guidance on how the requirements of this policy are to be implemented. Unless otherwise stated, any such additional guidance should be considered an extension of this policy and carry the same requirements for compliance. This policy is written using 1 Definitions •AI(Artificial Intelligence): The capability of a machine or system to perform tasks that typically require human intelligence, such as generating text or audiovisual content, making or recommending decisions, analyzing data, or automating processes. •AI Algorithm/AI Model:A set of programmed instructions that processes data to perform tasks,make decisions, or solve problems within an AI system. •AI Assistant: An AI tool which is intended to aid a user in their day-to-day work by suggesting content, retrieving information, automating processes, and performing other similar tasks. • Al Policy: A document that provides a framework for the effective and responsible use of AI systems within an organization. •AI System: Any tool, software, process, and workflow, or other system which is based on AI technology or which uses AI technology as a key component of that system. • AI Tool: A piece of software which provides AI functionality and can be applied to a specific use case. • AI Use Case: A specific task or purpose for which an AI tool is used or under consideration. •AI User: An individual who is responsible for using,developing,purchasing, configuring, or maintaining AI systems. • AI User Guide: A document which supplements an AI policy with more detailed guidance on how to implement the policy. •Anonymization: A process by which data is altered so that it cannot be connected to specific individuals or organizations. • Bias: Systematic tendencies that can exist within AI systems,often stemming from flawed data, algorithms, or design processes,that may lead to discriminatory or inaccurate outcomes affecting certain groups or individuals. • Black Box Algorithm: An AI algorithm which produces decisions or other outputs with little or no mechanism for the user to analyze the logic which led to that result. • Data Privacy: The protection of non-public information about a person or organization from disclosure without their consent. • Generative AI: AI systems which use algorithms to create text,audio,image,or video content based on some combination of user prompts and stored data and instructions. • Machine Learning: A type of AI which uses algorithms to extract information from and recognize patterns in data, often used for forecasting, prediction, classification, or analysis. • Open Data: Information derived from an organization's operations which is shared publicly to This policy is written using 2 promote transparency or for use by external parties. • Protected Data: Information generated or acquired in the course of an organization's operations which is not intended or approved for public disclosure. • Public Record: Records stemming from an organization's operations which must by law be shared upon request, whether or not it is actively published as open data. Scope This policy governs the use of AI-based and AI-enabled tools, software, processes, and workflows (hereafter, "AI systems"),by: • All departments, agencies,teams and other groups within Jefferson County. • All individuals (including officials, employees, contractors, consultants, interns, volunteers, and other persons) within those departments, agencies, teams, or other groups who are responsible for using,developing, purchasing,configuring, or maintaining AI systems (hereafter referred to as"AI users"). The policy covers all AI systems used by these individuals and groups, with the following exceptions: • AI systems which have been evaluated by the Central Services Director and determined to be safe for unrestricted usage • AI features included within Jefferson County-maintained applications which are not part of their core functionality or involve the use of sensitive data. • AI systems used only for personal use, outside of work hours and not using Jefferson County resources. Values and Principles Our commitment to effective and responsible AI use is grounded in the following foundational values and principles: • Accessibility and Inclusivity: AI technologies should be accessible to all residents, including those with disabilities or limited access. • Accountability: Roles and responsibilities should govern the deployment and maintenance of AI systems,with human oversight ensuring adherence to relevant laws and regulations. • Bias and Harm Reduction: Measures should be implemented to detect and mitigate biases to prevent harm. • Continuous Improvement: AI systems should be continuously monitored and enhanced based on feedback and technological advancements. •Data Governance: Proper management,quality,and stewardship of data used by AI systems should be ensured. This policy is written using 3 • Digital Literacy: Digital literacy should be promoted among residents to help them understand and engage with AI technologies. This policy is written using 4 • Effectiveness: AI systems should be reliable, meet their objectives, and deliver precise and dependable outcomes in their deployment contexts. • Explainability and Interpretability: AI decisions should be understandable to those affected. • Fairness and Equity:AI systems should prevent discrimination and bias,ensuring fair treatment for all residents. •Human-Centered Design: AI systems should be developed and deployed with a human-centered approach that evaluates their impact on the public. •Human Oversight:Appropriate human control over AI systems should be ensured,allowing for intervention to prevent harm. • Innovation and Sustainability: Technological innovation should be embraced responsibly while minimizing environmental impact. • Legal Compliance:AI systems should comply with all relevant laws and regulations. • Privacy Protection: Residents'privacy concerning their personal data should be protected,and AI systems must comply with data protection laws. • Safety: AI systems should not cause harm and should prioritize the safety of residents. • Security and Reliability: AI technologies should be secure against unauthorized access and ensure consistent performance. • Transparency: The purpose and use of AI systems should be proactively communicated to the public, ensuring that AI systems,their data sources,operational models, and governing policies are understandable and documented. •Workforce Empowerment: Staff should be empowered to use AI in their roles through education,training, and collaborations that promote participation and opportunity. These values and principles are the inspiration for this policy, and users are expected to incorporate these same motivations in its implementation. While the ideal course of action may not be obvious or practical in every circumstance,this policy is designed to offer guidance to help users navigate such situations responsibly. Existing Laws and Policies This policy is designed to facilitate Jefferson County's compliance with all applicable federal, state, and local laws and regulations,as well as existing Jefferson County policies. In particular,the following laws, regulations, and policies are relevant to Jefferson County's use of AI systems: • Resolution No. 50 22.pdf • 2022-02-28 Jefferson County Public Records Act Compliance Policy(1).pdf • 2022-02-28 Jefferson County Public Records Act Compliance Policy(1).pdf • Resolution No. 19-0407-25R(Personnel Admin. Manual).pdf This policy is written using 5 Roles and Responsibilities The following individuals and groups are responsible for the duties involved in implementing this policy, as described below: Central Services Director • Developing the AI policy and additional guidance • Coordinating AI initiatives across departments and teams • Overseeing compliance with laws and regulations • Providing guidance to AI users across the organization • Convening and overseeing the AI Working Group • Leading the AI review process AI Working Group • Reviewing and approving AI projects •Addressing ethical concerns and conflicts • Investigating policy violations and recommend corrective actions • Recommending policy and guidance updates • Providing regular public reports on Jefferson County AI usage Central Services Director • Directing technology resources, policies, projects, and services • Approving AI policy and related guidance • Facilitating collaboration between teams and departments for successful AI policy implementation Central Services Director • Overseeing enterprise security infrastructure and cybersecurity operations • Maintaining security policies, procedures, standards, and guidelines • Monitoring compliance with security policies and related requirements • Ensuring accurate data sensitivity classification and protections This policy is written using 6 Central Services Director •Advising the Central Services Director and others on compliance or legal issues and risks related to AI usage County Administrator • Approving AI policy and subsequent changes • Providing final determination for AI use cases which involve substantial risks of harm or other negative consequences • Enforcing corrective action in the event of policy violations Department Heads and Managers • Ensuring personnel and vendor compliance with the policy and integrating policy requirements into operations. • Facilitating training for staff on AI policies and practices. Unless otherwise specified,the specific officials listed above may designate one or more individuals to act on their behalf with respect to this policy,and in such cases those designees are understood to inherit the same authorities and obligations as the named officials. Requirements Under this policy,all AI users are responsible for complying with the requirements described in this section. AI System and Use Case Approval Process •The Central Services Director shall establish a process under which all Al systems and use cases are subject to a thorough review to determine their compliance with this policy prior to their implementation. • In addition to confirming compliance with the specific requirements and prohibitions established under this policy,the review process will also consider the relative benefits and risks of each system and use case and determine whether or not approval is reasonable and aligned with the values and principles defined herein. • Reviews of AI systems should specify the intended use cases of those systems and whether or not other other use cases require additional review. • The results of each review will be documented using a standard template and retained for either the full lifespan of the system or use case or the retention period required under law for similar documents (whichever is longer). This policy is written using 7 • The Central Services Director will create a standard for determining whether or not a particular system or use case has a high risk of potential negative impacts to any relevant individual,group, or organization. In the event of a high-risk determination,that system or use case will be presented to the full AI working group for approval. Lower-risk systems and use cases may be approved by the Central Services Director at their own discretion, provided that the Central Services Director is notified of such approval and given the opportunity to review the documentation and request that the approval be submitted to the full AI working group when appropriate. • The Central Services Director will revisit all previously-approved AI systems and use cases at least once per year,or sooner in the event of substantial modifications(such as a major software upgrade or change in scope), and confirm the continued compliance and reasonableness of the system or use case. Monitoring,Evaluation,and Accountability •The Central Services Director is responsible for implementing systems to monitor AI system performance,effectiveness,and policy compliance.The data collected from these systems will be periodically reviewed to evaluate the effectiveness of AI systems and their impacts on the community. •The Central Services Director will establish procedures and protocols for responding to failures of AI systems and violations of this policy, including corrective actions with regard to both the systems themselves and the individuals and organizations involved. • Upon the recommendation of the Central Services Director, Central Services Director, and/or County Administrator, independent audits shall be conducted to review AI systems for compliance with policies and ethical standards. Findings from audits and evaluations shall be used to refine AI policies, improve system functionalities, and determine any additional training or accountability requirements. Data Management, Privacy, and Retention • All AI systems shall comply with applicable data protection laws, regulations, and policies to safeguard personal and sensitive information. Bias Mitigation and Human Oversight •All AI users shall be responsible for taking steps to mitigate potential biases(including but not limited to biases related to protected characteristics such as race,gender, sexual orientation, national origin, disability,or language)in AI systems they interact with, in accordance with training and recommendations provided by the Central Services Director. Transparency and Explainability This policy is written using 8 •Upon the consideration or introduction of a new AI system which is likely to have major public impact, the Central Services Director will ensure that key information is provided to affected groups and other stakeholders in a timely manner. Such information will be provided in multiple formats and/or languages if necessary, consistent with Jefferson County's practice in communicating • To the greatest extent possible,AI systems should provide clear and understandable explanations for their decisions and outputs,particularly in cases where erroneous results may create a risk of substantial negative impacts. Training and Education •All users shall be provided with regular training on AI technologies, ethical considerations, and compliance requirements to ensure knowledgeable and responsible use of AI systems, as recommended by the Central Services Director. • The Central Services Director will develop specific training requirements and content for users granted access to high-risk AI systems and associated data, focusing on compliance with this policy and other associated laws,regulations, policies, and best practices. •These trainings will be updated on a regular basis to ensure their accuracy and relevance,and users' continued access to high-risk systems and data will be contingent upon completion of additional required trainings determined by the Central Services Director. Vendors and Third Parties • All vendors and other third parties who provide or interact with AI systems shall be required to comply with this and all other applicable policies, and this compliance shall be explicitly included in all relevant contracts and similar agreements. • All technology vendors will be required to disclose whether and how AI is used in their products and services, and what mechanisms they provide to allow for auditing these systems. These disclosures will be provided using a standard form developed and maintained by the Central Services Director and required in all technology procurements. • Vendors shall be evaluated based on their commitment to responsible AI development and their history of adherence to ethical standards, and preference in procurement decisions will be given to vendors which can effectively provide transparency into their systems and practices to both Jefferson County and the public. Labeling of AI-generated Content •All content generated by AI systems and presented to the public shall be clearly labeled as such. This shall include all text, audio, image, and video content, as well as interactive systems such as chatbots and automated decision-making tools. • All individuals involved in disseminating such content on behalf of Jefferson County will be This policy is written using 9 responsible for ensuring the accuracy of such content and its appropriate labeling,and the Central Services Director will establish standard mechanisms for Jefferson County personnel and members of the public to report violations of this requirement. This policy is written using in Prohibitions The following actions are expressly prohibited under this policy: • Deployment or use of AI systems on Jefferson County IT systems or for Jefferson County business without required authorization,whether or not such the tools used in systems have been approved for other use cases • Use of AI systems to impersonate or misrepresent a person, group, or organization or to otherwise convey potentially misleading information • Use of AI systems with a high risk of potential negative impacts by individuals without required authorization and training • Use of Jefferson County-owned or -licensed AI tools, data, or other infrastructure for purposes other than those related to Jefferson County operations • Use of AI systems for purposes which may impact the administration or results of elections •Use of AI tools which consume excessive energy or resources without consideration for environmental impacts These prohibitions are given in addition to the general prohibition on actions which do not comply with the other provisions of this policy or of other applicable laws, regulations, or policies. Exceptions to these prohibitions can only be made with the approval of the County Administrator or their designee. Such exceptions also require appropriate notification to all affected parties and other stakeholders, including the public when appropriate. Enforcement In the event of non-compliance with this policy, the following enforcement actions may be taken against individuals,vendors,or other parties in order to address specific incidents or repeated patterns of non-compliance: • Denial or revocation of access to AI systems and tools • Disciplinary actions, up to and including termination of employment • Ineligibility for future employment • Termination of vendor contracts and other third party agreements. • Disqualification from future contracts or partnerships • Personal liability for harms caused by malicious use or negligence Any such actions will be taken in accordance with the procedures and provisions established in applicable laws, regulations, policies, contracts, and other standards, in line with the practices applied for other violations of Jefferson County's information technology-related policies.