HomeMy WebLinkAboutDISCUSSION AI Policy - Not final copy
Version: May 26, 2026
JEFFERSON
COUNTY
ARTIFICIAL
INTELLIGENCE
ACCEPTABLE
DEVELOPMENT
AND USE POLICY
This AI Policy governs all uses of artificial intelligence by or on behalf of Jefferson County, Washington.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page ii of ii
TABLE OF CONTENTS
TABLE OF CONTENTS ................................................................................................................ ii
(1) INTRODUCTION .............................................................................................................. 1
(2) PURPOSES ......................................................................................................................... 1
(3) GUIDING PRINCIPLES AND VALUES.......................................................................... 2
(4) DEFINITIONS .................................................................................................................... 3
(5) APPLICABILITY OF THIS AI POLICY .......................................................................... 7
(6) Compliance with Existing Laws and Policies ....................................................... 8
(7) Prohibited uses of an AI System ......................................................................................... 8
(8) PUBLIC RECORDS ACT COMPLIANCE ..................................................................... 10
(9) architectural and technical STANDARDS ....................................................................... 10
(10) ROLES AND RESPONSIBILITIES ................................................................................ 10
(11) AI SYSTEM AND USE AND CASE APPROVAL PROCESS ...................................... 13
(12) PROCEDURES................................................................................................................. 15
(13) CONSEQUENCES FOR NONCOMPLIANCE .............................................................. 18
(14) LIMITATIONS OF THIS AI POLICY ............................................................................ 18
APPENDIX A: REFERENCES .................................................................................................... 20
APPENDIX B: RELEVANT COMPLIANCE REQUIREMENTS ............................................. 22
APPENDIX C: .............................................................................................................................. 23
RECORDS PROTECTED FROM DISCLOSURE BY AN “OTHER STATUTE” THAT ARE NOT TO BE USED IN AN AI SYSTEM .................................................................................... 23
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 1 of 29
JEFFERSON COUNTY ARTIFICIAL INTELLIGENCE ACCEPTABLE DEVELOPMENT AND USE POLICY
(1) INTRODUCTION
Artificial Intelligence (AI) technology is increasingly becoming an integral part of local government operations, offering opportunities to enhance the efficiency and effectiveness
of public services. At the same time, the use of AI also presents ethical, legal, and social
challenges that require responsible management. This AI Policy provides a framework for the effective and responsible use of AI systems within the County, to maximize the benefits of these innovative tools while minimizing their potential risks to both the County and the public.
(2) PURPOSES
The purposes of this AI Policy are to:
A. Ensure ethical and responsible development, deployment, and use of AI technology in the County, ensuring they are in alignment with the principles of transparency, fairness, accountability, and public trust.
B. Enable effective use of AI technology by providing clear guidance to the County personnel,
vendors, and other partners who work with AI systems.
C. Inform community members and other stakeholders about how the County is utilizing AI technology and what measures it is taking to protect the public from potential adverse consequences of these systems.
D. Promote responsible and ethical use of AI technology by defining the principles and values
that govern the application of this technology within the County.
E. Ensure the compliance of AI systems with all applicable federal, state, and local laws and regulations as well as existing the County policies.
F. Assign roles and responsibilities related to the County’s use of AI systems.
G. Establish processes that encourage effective and responsible use of AI systems.
H. Define prohibited uses of AI systems.
I. Specify measures which may be taken in the event of failure to comply with these policies.
This AI Policy may be updated from time to time to account for changes in AI technology, laws and regulations, uses of AI systems within the County, and other considerations.
In addition, the Central Services Director may publish an AI User Guide to provide more detailed
guidance on how the requirements of this AI Policy is to be implemented. Unless otherwise stated,
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 2 of 29
any such additional guidance should be considered an extension of this AI Policy and carry the same requirements for compliance.
(3) GUIDING PRINCIPLES AND VALUES
The County’s AI development, deployment, and use of artificial intelligence systems shall be guided by the following guiding principles and values:
(a) We expect to retain appropriate human agency and oversight, allowing for intervention to prevent harm.
(b) We expect to use internal and external security testing of systems before
public release for high-risk artificial intelligence systems.
(c) We expect to protect data privacy and security.
(d) We expect to promote appropriate transparency for consumers when they interact with artificial intelligence systems or products created by artificial
intelligence.
(e) We expect to ensure accountability, considering oversight, impact assessment, auditability, and due diligence mechanisms.
(f) We expect to make AI accessible to all residents, including those with disabilities or limited access.
(g) We expect to govern the deployment and maintenance of AI systems with
human oversight ensuring adherence to relevant laws and regulations and by defining roles and responsibilities.
(h) We expect to implement measures to detect and mitigate biases in order to prevent harm.
(i) We expect to continuously monitor and enhance AI systems based on feedback and
technological advancements.
(j) We expect proper management, quality, and stewardship of data used by AI systems.
(k) We expect the county will be one source of digital literacy among residents to help them understand and engage with AI systems.
(l) We expect AI systems to be reliable, meet their objectives, and deliver
precise and dependable outcomes in their deployment contexts;
(m) We expect AI decisions to be understandable to those affected.
(n) We expect AI systems to prevent discrimination and bias, ensuring fair treatment for all residents.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 3 of 29
(o) We expect AI systems should be developed and deployed with a human-centered approach that evaluates their impact on the public.
(p) We expect technological innovation to be embraced responsibly while minimizing
environmental impacts.
(q) We expect AI systems to comply with all relevant laws and regulations.
(r) We expect privacy concerning personal data to be protected, while satisfying the requirements of the Washington Public Records Act, chapter 42.56 RCW.
(s) We expect AI systems to comply with data protection laws.
(t) We expect AI systems not to cause harm and to prioritize the safety of residents.
(u) We expect AI systems to be secure against unauthorized access and ensure consistent performance.
(v) We expect the use of AI systems to be proactively communicated to the
public, ensuring that AI systems, their data sources, operational models, and governing policies are understandable and documented.
(w) We expect Staff to be empowered to use AI in their roles through education, training, and collaborations that promote participation and opportunity.
These guiding principles and values are the inspiration for this AI Policy, and AI users are expected
to incorporate these same motivations in the implementation of this AI Policy. While the ideal course of action may not be obvious or practical in every circumstance, this AI Policy is designed to offer guidance to help AI users responsively navigate the use of AI systems.
(4) DEFINITIONS
(a) “Artificial Intelligence” (or “AI”) means a machine-based system that can,
for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments. Artificial intelligence systems use machine and human-based inputs to:
(i) Perceive real and virtual environments;
(ii) Abstract such perceptions into models through analysis in an automated
manner; and,
(iii) Use a model to formulate options for information or action.
(b) “AI best practices” means the best practices described in National Cyber Security Centre, Best Practices for Securing Data Used to Train & Operate
AI systems, Ver. 1.0 (May 2025).
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 4 of 29
(c) “AI model” means a set of programmed instructions that processes data to perform tasks, make decisions, or solve problems within an AI system.
(d) “AI Policy” means this Jefferson County Artificial Intelligence
Acceptable Development and Use Policy.
(e) “AI System” means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or
recommendations, that can influence physical or virtual environments and
includes any tool, software, process, workflow, or other system which is based on AI or which uses an AI tool.
(f) “AI Tool” means a piece of software which provides AI functionality and can be applied to a specific use case.
(g) “AI Use Case” means specific task or purpose for which an AI tool is used
or under consideration.
(h) “AI User” means any person using, developing, purchasing, configuring, or maintaining any AI used by or for the County on its behalf, including contractors, consultants, elected officials, employees, and volunteers.
(i) “AI User Guide” means a document which supplements an AI Policy with
more detailed guidance on how to implement this AI Policy.
(j) “Bias” means systematic tendencies that can exist within AI systems, often stemming from flawed data, algorithms, or design processes, that may lead to discriminatory or inaccurate outcomes affecting certain groups or
persons.
(k) “Central Services” means the County Central Services Department.
(l) “Central Services Director” means the person holding the title of Director of Central Services or a delegee that has been delegated in writing.
(m) “Chatbot” means a computer program that simulates human conversation
through text or voice interactions.
(n) “Consequential decision” means a decision that has a material legal or similarly significant effect on, or the cost of:
(i) Hiring or retention of a contractor, employee, vendor or volunteer;
(ii) Any budget decision;
(iii) The provision of any essential government service;
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 5 of 29
(iv) Health care (as defined in this AI Policy);
(v) Risk management, including but not limited to obtaining coverage for
any risks by an insurance company or a self-insurance program; or,
(vi) The provision of legal services.
(o) “County” means the County, Washington.
(p) “County Approved AI system” means an AI system approved for use by AI users as specified in section 7.a.
(q) “County Information Systems” means all county information systems,
including but not limited to computers or servers owned or operated by the County. For the avoidance of doubt, county operated systems include information systems owned by another person that contain data, information, programs or systems owned or controlled by the County such as cloud-based
information systems.
(r) “Data” means any digital representation of information, knowledge, facts, concepts, data programs or instructions that are being prepared or have been prepared in a formalized manner and are intended for use in a data network, data program, data services, or data system.
(s) “Health care provider” means a person who is licensed, certified,
registered, or otherwise authorized by the law of this state to provide health care in the ordinary course of business or practice of a profession.
(t) “Health care” means any care, service, or procedure provided by a health care provider:
(i) To diagnose, treat, or maintain a patient's physical or mental condition;
or,
(ii) That affects the structure or any function of the human body.
(u) “Health care information” means all information about health care that is protected from disclosure by the Health Insurance Portability and
Accountability Act of 1996 (HIPAA) Privacy Rule, 45 C.F.R. Parts 160 and
164, Chapter 70.02 RCW (Medical Records—Health Care Information Access and Disclosure) or RCW 42.56.360 (Health care exemption from disclosure of records under the Washington Public Records Act).
(v) “High-risk AI system” means any AI system that, when deployed, makes,
or is a substantial factor in making, a consequential decision. “High-risk
AI system” does not include an AI system if:
(i) The AI system is intended to:
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 6 of 29
(A) Perform a narrow procedural task;
(B) Detect decision-making patterns or deviations from prior
decision-making patterns and is not intended to replace or
influence a previously completed human assessment without sufficient human review;
(ii) The AI system uses the following technologies, unless the technologies, when deployed, make, or are a substantial factor in
making, a consequential decision:
(A) Anti-fraud technology that does not use facial recognition technology;
(B) Anti-malware;
(C) Anti-virus;
(D) AI-enabled video games;
(E) Calculators;
(F) Cybersecurity;
(G) Databases;
(H) Data storage;
(I) Firewall;
(J) Internet domain registration;
(K) Internet website loading;
(L) Networking;
(M) Spam- filtering;
(N) Robocall-filtering;
(O) Spell-checking;
(P) Spreadsheets;
(Q) Web caching;
(R) Web hosting or any similar technology; or,
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 7 of 29
(S) Technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or
recommendations, and answering questions and is subject to County policy
that prohibits generating content that is discriminatory or harmful.
(w) “IT” means the Jefferson County Information Technologies Department, a division of Central Services.
(x) “Public Record” has the same meaning as in RCW 42.56.010(3).
(y) “Risk management” means coordinated activities to direct and control an
organization with regard to risk.
(z) “Section” means a section of this AI Policy, unless there is clear language in this AI Policy that a section of this AI Policy does not apply.
(aa) “Substantial factor”8 means a factor that:
(A) Assists in making a consequential decision;
(B) Is capable of altering the outcome of a consequential decision; and,
(C) Is generated by an AI system.
“Substantial factor” includes any use of an AI system to generate any content, decision, prediction, or recommendation concerning consequential decision.
(bb) “Writing” has the same meaning as in RCW 42.56.010(4).
(5) APPLICABILITY OF THIS AI POLICY
(a) This AI Policy governs the development, procurement or use of any AI Systems (as defined in this AI Policy) on any County Information System or for input of results from the use of an external AI System into County Information Systems.
(b) All County boards, commissions, committees, departments, and task forces
shall comply with this AI Policy.
(c) This AI Policy applies to:
(i) Agents, contractors, elected officials, employees, officers, vendors and volunteers of the County who use or input data into County Information
Systems; and,
(ii) All AI users (as defined in this AI Policy).
8Adapted from the Colorado AI Act, Colo. Rev. Stat. § 6-1-1701 (2026).
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 8 of 29
(d) This AI Policy does not apply to any AI system which:
(i) Has been evaluated and determined in writing by the Central Services
Director to be safe for unrestricted usage;
(ii) Has AI features included in applications maintained by Central Services, which are not part of the AI feature’s core functionality or involve the use of sensitive data; and,
(iii) That does not use or input data into County Information Systems.
(6) COMPLIANCE WITH EXISTING LAWS AND POLICIES
Development and use of AI systems shall comply with:
(a) All applicable federal, state, and local laws and regulations; and,
(b) All County policies, including but not limited to:
(i) Jefferson County Social Media Policy (Resolution No. 14-20, March 16,
2020).
(ii) Jefferson County Public Records Act Compliance Policy (Resolution No. 10-22, February 28, 2022).
(iii) Open Public Meeting Act Guidelines for Jefferson County Boards, Commissions & Committees (Resolution No. 50-22, October 24, 2022).
(iv) Jefferson County Personnel Administration Manual (Resolution No. 19-0407-
25R, April 7, 2025).
(7) PROHIBITED USES OF AN AI SYSTEM
(a) The following AI systems are approved for use by the persons subject to this AI Policy listed in sections 5 and 6, subject to the limitations in this section 7:
(i) Microsoft’s Enterprise AI system called Co-Pilot (which is part of the Microsoft
365 suite of programs) is the preferred AI system to be used for generative AI that is approved for use by AI users (as defined in this policy).
(ii) The Central Services Director shall maintain a list of AI systems that are approved, being tested by the Central Services Department, or are
prohibited. AI users may only use AI systems that are authorized or are
being tested by the Central Services Department. The Central Services Director shall publish the list on the County’s web site.
(b) Use of an AI system on a County-owned computer, server or system that is not on the list of AI systems approved and made available on the County’s web site
is prohibited.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 9 of 29
(c) Use of an AI system on a County-owned computer, server or system that is on the list of AI systems being tested for possible authorized use pursuant to
section (11) is authorized until testing is complete. Once testing is complete,
the Central Services Director shall determine whether such system shall be added to either the list of AI systems that are approved or the list of AI systems that are not approved.
(d) Use of any high-risk AI system (as defined in this AI Policy) requires enhanced
review and specific written approval before it can be added to the list of
approved AI Systems in section 7(a)(i).
(e) Use of an AI system on a County-owned computer, server or system to create any deepfake, which is an image created by using machine learning to capture and encode unique biometric characteristics of targets to combine the subject’s
unique characteristics with the acquired knowledge of general human
expression in order to then synthesize the target’s facial features, voice, mannerisms, etc. is prohibited.
(f) Entry any of the following data into an AI system is prohibited:
(i) Personal financial information for any individual. This includes credit card
number, bank account number, PIN numbers, and any other financial
information.
(ii) Authentication information. Inputting any passwords, login credentials, or other authentication information into an AI system is prohibited.
(iii) Personally Identifying Information. Inputting any personally identifying
information into an AI system is prohibited. Personally identifying
information includes name, address, phone number, email address, social security number, passport number, driver’s license number, and any other information that can reasonably be used to identify an person.
(iv) Health care information (as defined in this AI Policy).
(v) Sensitive or confidential information. This includes any information that
could be used or disclosed to harm the County or its employees or volunteers, or residents such as information about political affiliations, religious beliefs, membership in a protected class, criminal history, or information related to the County information system.
(vi) Any information exempted from disclosure by the Public Records Act,
chapter 42.56 RCW or some other federal or state statute, including but not limited to:
(A) Attorney-client privileged records relating to representation of the County by its attorneys. The attorney-client privileged records are
protect communications and advice between an attorney and their
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 10 of 29
client. RCW 5.60.060(2)(a) constitutes an “other statute’ exemption under RCW 42.56.070(1)
(B) Attorney work product records. Attorney work product records are:
“Records that are relevant to a controversy to which an agency is a party but which records would not be available to another party under the rules of pretrial discovery for causes pending in the superior courts are exempt from disclosure under [the Public Records Act].” RCW
42.56.290.
(C) Autopsy records. Autopsy and post mortem reports and records are confidential and exempt from examination by the public. RCW 68.50.105(1).
(D) Records related to juvenile offenses. RCW 13.50.050(1), (3).
(E) Records of a person confined in jail. RCW 70.48.100(2).
(F) Personal information in files maintained for County employees, appointees, or elected officials of any public agency to the extent that disclosure would violate their right to privacy. RCW 42.56.230(3).
(G) Specific intelligence information. Secret information, information
about an enemy, or conclusions drawn from such information or that
would disclose particular methods or procedures for gathering or evaluating intelligence information. RCW 42.56.240(1).
(H) Specific investigative records. Information on active ongoing law enforcement investigations. RCW 42.56.240(1).
(I) Records protected by an “other statute which exempts or prohibits
disclosure of specific information or records.” RCW 42.56.070(1).
A list of “other statutes” is attached as Appendix D.
(8) PUBLIC RECORDS ACT COMPLIANCE
Any product created by any AI system necessarily will be a “public record,” as defined in RCW
42.56.010(3). All public records shall be managed in compliance with chapter 40.14 RCW
(Preservation And Destruction of Public Records), chapter 42.56 RCW (Public Records Act), and the County’s most recent version of the Jefferson County Public Records Act Compliance Policy.
(9) ARCHITECTURAL AND TECHNICAL STANDARDS
The architectural and technical standards associated with the enterprise use of AI systems shall be
maintained by IT.
(10) ROLES AND RESPONSIBILITIES
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 11 of 29
The following persons and groups are responsible for the duties involved in implementing this AI Policy, as described below:
(a) Central Services Director.
The Central Services Director shall be responsible for:
(i) Providing a public report at least annually to the Board of County Commissioners on County AI usage.
(ii) Developing this AI Policy and additional guidance.
(iii) Coordinating AI initiatives across departments and teams.
(iv) Overseeing compliance with laws, regulations and County policies.
(v) Providing guidance to AI users across the organization.
(vi) Convening and overseeing the AI Review Committee.
(vii) Leading the AI review process.
(viii) Directing technology resources, policies, projects, and services.
(ix) Reviewing the AI Review Committee recommendations on oversight and guidance on AI initiatives within the County.
(x) Facilitating collaboration between teams and departments for successful implementation of this AI Policy.
(xi) Overseeing enterprise security infrastructure and cybersecurity
operations.
(xii) Maintaining security policies, procedures, standards, and guidelines.
(xiii) Monitoring compliance with security policies and related requirements.
(xiv) Ensuring accurate data sensitivity classification and protections.
(xv) Advising on compliance on AI usage.
(xvi) Identifying legal issues and risks related to AI usage.
(xvii) Investigating alleged violations of this AI Policy and recommend corrective actions.
(b) AI Review Committee
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 12 of 29
The Board of County Commissioners shall establish an AI Review Committee with department representatives which shall be make recommendations to the Central Services
Director on oversight and guidance on AI initiatives within the County.
The AI Review Committee shall review and consider updates to this AI Policy, along with the Central Services Director, at least annually to reflect technological advancements and evolving community needs.
The AI Review Committee shall be responsible for making recommendations to the Central
Services Director on the following topics:
(i) AI systems being considered for use by the County.
(ii) Ethical concerns and conflicts.
(iii) Policy and guidance updates.
(c) County Administrator
The County Administrator shall be responsible for:
(i) Approving proposed changes to this AI Policy.
(ii) Making a final determination whether to allow AI use cases which involve substantial risks of harm or other negative consequences.
(iii) Enforcing corrective action for violations of this AI Policy.
(d) Electeds and Department Heads
Electeds and department heads or a delegee shall be responsible for:
(i) Ensuring employee, contractor and vendor compliance with this AI Policy.
(ii) Integrating AI systems into department operations that comply with this
AI Policy.
(iii) Facilitating training for staff on this AI Policy and AI best practices (as defined in this AI Policy).
Unless otherwise specified, the specific officials listed above may delegate to one or more
persons to act on their behalf with respect to this AI Policy, and in such cases those
designees are understood to inherit the same authorities and obligations as the named
officials.
(e) AI Users
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 13 of 29
(i) All AI users are responsible for complying with the requirements of this AI Policy.
(ii) All AI users have the responsibility to verify the accuracy of any
information acquired through the use of AI systems before using that information in any final, published, or production documents.
(11) AI SYSTEM AND USE AND CASE APPROVAL PROCESS
(a) AI Systems Review Process
The Central Services Director shall establish a process under which all AI systems and AI
Use Cases are subject to thorough testing to determine their compliance with this AI Policy prior to their implementation. The testing process shall:
(i) Confirm compliance with the specific requirements and prohibitions established under this AI Policy;
(ii) Consider the relative benefits and risks of each system or use case and determine
whether or not approval is reasonable and aligned with the values and principles in this AI Policy;
(iii) Specify the intended use cases of those systems and whether or not other use cases require additional review;
(iv) Document the results of each review using a standard template, which results shall be retained for either the full lifespan of the AI system or use case or the retention period required under law for similar documents (whichever is longer).
(b) Determination of High Risk Potential Negative Impacts
(i) The Central Services Director shall create a standard for determining whether or not a particular AI system or AI use case has a high risk of potential negative impacts to any relevant person, group, or organization.
(ii) A high-risk determination, that AI system or use case shall be presented to the full AI Review Committee for approval.
(iii) Lower-risk AI systems and use cases may be approved by the Central Services
Director at their discretion.
(iv) The Central Services Director shall revisit all previously-approved AI systems and use cases at least annually, or sooner in the event of substantial modifications (such as a major software upgrade or change in scope), and
confirm in writing to the County Administrator the continued compliance and reasonableness of the AI system or use case.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 14 of 29
(c) Monitoring, Evaluation, and Accountability
(i) The Central Services Director shall be responsible for implementing AI
systems to monitor AI system performance, effectiveness, and policy
compliance. The data collected from these AI systems shall be periodically reviewed to evaluate the effectiveness of AI systems and their impacts on the community.
(ii) The Central Services Director shall establish procedures and protocols for
responding to failures of AI systems and violations of this AI Policy, including
corrective actions with regard to both the AI systems themselves and the persons and organizations involved.
(iii) Upon the recommendation of the Central Services Director, , or County Administrator, independent audits shall be conducted to review AI systems for
compliance with policies and ethical standards. Findings from audits and
evaluations shall be used to refine AI policies, improve AI system functionalities, and determine any additional training or accountability requirements.
(d) Data Management, Privacy, and Retention
All AI systems shall comply with applicable data protection laws, regulations, and
policies to safeguard data protected by this AI Policy.
(e) Mitigation of Bias and Human Oversight
All AI users shall be responsible for taking steps to mitigate potential biases (including but
not limited to biases related to protected characteristics such as race, gender, sexual
orientation, national origin, disability, or language) in AI systems they interact with, in
accordance with training and recommendations provided by the Central Services
Director.
(f) Transparency and Explainability
Upon the consideration or introduction of a new AI system which is likely to have
major public impact, the Central Services Director shall ensure that key information
is provided to affected groups and other stakeholders in a timely manner. Such information shall be provided in multiple formats or languages if necessary, consistent with the County’s practice in communicating
To the greatest extent possible, AI systems should provide clear and understandable
explanations for their decisions and outputs, particularly in cases where erroneous
results may create a risk of substantial negative impacts.
(g) Training
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 15 of 29
(i) All users shall be provided with regular training on AI technologies, ethical considerations, and compliance requirements to ensure
knowledgeable and responsible use of AI systems, as recommended by the
Central Services Director.
(ii) The Central Services Director shall develop specific training requirements and content for users granted access to high-risk AI systems and associated data, focusing on compliance with this AI Policy and other associated laws,
regulations, policies, and AI best practices.
(iii) These trainings shall be updated on a regular basis to ensure their accuracy and relevance, and users’ continued access to high-risk AI systems and data shall be contingent upon completion of additional required trainings determined by the Central Services Director.
(h) Vendors and Third Parties
(i) All vendors and other third parties who provide or interact with AI systems shall be required to comply with this and all other applicable policies, and this compliance shall be explicitly included in all relevant contracts and similar agreements.
(ii) All technology vendors shall be required to disclose whether and how AI is used
in their products and services, and what mechanisms they provide to allow for auditing these AI systems. These disclosures shall be provided using a standard form developed and maintained by the Central Services Director and required in all technology procurements.
(iii) Vendors shall be evaluated based on their commitment to responsible AI
development and their history of adherence to ethical standards, and preference in procurement decisions shall be given to vendors which can effectively provide transparency into their AI systems and practices to both the County and the public.
(i) Labeling of AI-generated Content
All content generated by AI systems and presented to the public shall be clearly labeled as such. This shall include all text, audio, image, and video content, as well as interactive AI systems such as chatbots and automated decision-making tools.
All persons involved in disseminating content generated by an AI system on behalf of the
County shall be responsible for ensuring the accuracy of such content and its appropriate
labeling.
The Central Services Director or designee shall establish standard mechanisms for the County personnel and members of the public to report violations of this labeling requirement.
(12) PROCEDURES
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 16 of 29
(a) Attribution
(i) The use of AI systems and the resulting product(s) shall be attributed,
referenced, and cited in any electronic or paper material produced and
published by anyone subject to this AI Policy.
(ii) Attribution should include a description of the source application, how it was used, how the material was edited, by whom, and the date. For example:
“Microsoft Co-Pilot was used to generate the charts and data referenced above. The
content was reviewed and edited before being published by Sam Smith, Jefferson County Public Works Department, on 04/15/2026.”
(b) Intellectual Property
Content produced by AI systems may implicate intellectual property rights and likely will
include copyrighted material. AI systems shall be “trained” using Data (text, images, etc.)
that has been sourced from the internet without regard for copyright or licensing terms. It is extremely difficult to determine what content was used to train an AI system, and difficult to verify whether AI-generated content is wholly original or only a slight stylization of existing copyrighted material. Nevertheless, County AI users are required to
perform due diligence to ensure that no copyrighted material is published by the County
without proper attribution or without obtaining proper rights.
(c) Validation Required
(i) Complex algorithms of AI systems exponentially increase risk when incomplete or inaccurate data is involved. AI systems shall be validated
and regularly assessed to ensure completeness and accuracy. Results from
decisions, code, or research supported by AI systems should consistently align with those of a human subject matter expert.
(ii) AI users shall verify the accuracy of any information acquired through the use of AI systems before using that information in any final, published, or
production documents. If AI users are uncertain about the accuracy of the
obtained information, they should consult their supervisor or seek advice from a IT.
(iii) AI users shall independently verify any quotes or references generated by AI systems. AI users shall not assume that a quote or reference is accurate,
or real. AI systems rarely act as if they are uncertain, making false answers
difficult to spot. AI systems can generate:
(A) Fabricated content, sometimes called “hallucinations.” This is a phenomenon where an AI system, particularly those using large language models, generates false, inaccurate, or illogical
information while presenting it in a confident, authoritative, and
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 17 of 29
convincing manner. Fabricated content occurs when an AI system creates synthetic data, fabricates facts, or invents nonexistent
sources. An AI system may invent fake academic papers, legal
cases, scientific studies, or personal facts.
(B) Factual Errors: Stating incorrect facts, such as “Einstein won two Nobel Prizes.”
(C) Image Distortions: AI systems can create anatomically incorrect
figures (e.g., too many fingers).
Verification shall include cross-referencing sources included in the AI output, or independently verifying dates, names and events in peer reviewed or authoritative published literature on the internet or printed material.
(d) Decision Making
County departments shall utilize AI systems to enhance efficiency and effectiveness. AI
systems can be used for idea generation and as one source of information when researching a topic. AI systems products shall be human reviewed and edited before usage in any final, published, or production documents. This is particularly important when the content is public facing. AI users shall be responsible for their use of AI systems and the application
of any content or product in work tasks generated by AI systems.
(e) Equity and Inclusion
(i) While AI systems can reduce workloads, support capacity, and increase accessibility, the generated content reflects the cultural, economic, and social biases of the source materials used for training. The algorithms applied can be a source of
bias as well. Applying principles from the equity and empowerment lens, AI users
should thoroughly review any content generated by AI systems to ensure that any instances of bias, or potentially offensive or harmful material, is changed or removed.
(ii) When it comes to the adoption of AI systems, the County’s goal is to eliminate
digital disparities and ensure that persons who belong to a protected class and those
impacted by language or other accessibility barriers have equal access to and benefit from the County programs, activities, benefits, and services. To uphold this commitment, the County applies the equity and empowerment lens to address race, color, national origin, disability, religion, age, gender, sexual orientation, gender
identity and expression, marital status, veteran status, source of income, or any
other basis prohibited by federal, state, or local law.
(f) Final Requirements
(i) Under no circumstances is a County employee authorized to engage in any activity that is illegal under local, state, federal, or local law while utilizing County-owned
resources, including County Information Systems.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 18 of 29
(ii) County employees shall comply with all applicable County policies and are required to read and understand them. Responsibilities for protecting County
information do not end at the termination of employment. These responsibilities
continue until the information is reclassified to be public.
(13) CONSEQUENCES FOR NONCOMPLIANCE
(a) Department heads shall ensure compliance with this AI Policy and are accountable for any AI systems deployed by their department.
(b) Violations of this AI Policy shall be grounds for disciplinary action under the
current version of the County’s standards of conduct policy in Appendix C of to the Jefferson County Personnel Administration Manual, up to and including termination of employment; and enforcement action which shall include civil or criminal penalties.
(14) LIMITATIONS OF THIS AI POLICY10
(a) Nothing in this AI Policy restricts the County or any other person’s ability to:
(i) Comply with federal, state, or municipal laws, ordinances, or regulations;
(ii) Comply with a civil, criminal, or regulatory inquiry, investigation,
subpoena, or summons by a federal, a state, a municipal, or other governmental authority;
(iii) Cooperate with a law enforcement agency concerning conduct or activity that the developer, deployer, or other person reasonably and in
good faith believes may violate federal, state, or municipal laws,
ordinances, or regulations;
(iv) Investigate, establish, exercise, prepare for, or defend legal claims;
(v) Take immediate steps to protect an interest that is essential for the life or physical safety of a consumer or another person;
(vi) By any means other than the use of facial recognition technology,
prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or illegal activity; investigate, report, or prosecute the persons responsible for any such action; or preserve the integrity or security of
AI systems; or,
10 Adapted from the Colorado AI Act, Colo. Rev. Stat. § 6-1-1705 (2026).
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 19 of 29
(vii) Assist any other person with any of the obligations imposed under this AI Policy.
(b) Nothing in this AI Policy restricts the Central Services Department from
conducting research, testing, and development activities regarding an AI system or AI model, other than testing conducted under real-world conditions, before an AI system or AI model is deployed or put into service by the County;
(c) Nothing in this AI Policy imposes any obligation on any person that adversely
affects their rights or freedoms, including the rights to freedom of speech or freedom of the press that are guaranteed in:
(i) The first amendment to the United States constitution; or,
(ii) Section Article I, Section 5 of the Washington constitution.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 20 of 29
APPENDIX A: REFERENCES
Reference Topic Citation
Federal Law
National Artificial Intelligence Initiative
Act of 2020 (P.L. 116-283)
Shaping AI
development and use in
the United States
15 U.S.C. section
9401 et. seq.
Health Insurance Portability and
Accountability Act of 1996 (HIPAA)
Privacy Rule
Protection of heath
information
45 C.F.R. Parts 160
and 164.
Washington Law
Protection of the Right to Privacy Protection of privacy Chapter 9.73 RCW Preservation and Destruction of Public Records
Rules for preservation and destruction of public records
Chapter 40.14 RCW
Washington Public Records Act Promote open government Chapter 42.56 RCW
Health care exemption from disclosure of records under the Washington Public
Records Act
Protection of heath information RCW 42.56.360.
Medical Records—Health Care Information Access and Disclosure Law Protection of heath information Chapter 70.02 RCW.
SHB 1205 (2025) Reenacts and amends RCW 9A.60.010 and 9A.60.045 and makes it
a crime to knowingly distribute a forged digital likeness of another person to defraud, harass,
threaten, or intimidate another, or for an unlawful purpose
See the URL in the footnote below.11
Other References and Standards
National Cyber Security Centre, Best
Practices for Securing Data Used to Train & Operate AI systems, (Ver. 1.0 May 2025)
Best Practices for
development and use of AI systems
See the URL in the
footnote below. 12
National Institute of Standards and Technology, Artificial Intelligence Risk Standards for use of AI systems See the URL in the footnote below.13
11 https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bills/Session%20Laws/House/1205-S.SL.pdf, Accessed
April 11, 2026. 12 https://media.defense.gov/2025/May/22/2003720601/-1/-1/0/CSI_AI_DATA_SECURITY.PDF, Accessed April 12, 2026. 13 https://doi.org/10.6028/NIST.AI.100-1, Accessed April 11, 2026.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 21 of 29
Reference Topic Citation
Management Framework (AI RMF 1.0
2023)
Washington State Artificial Intelligence
Task Force’s Interim Report (December
1, 2025)
ESSB 5838 (2024)
established the
Washington State Artificial Intelligence Task Force to evaluate AI development, use
and risks
See the URL in the
footnote below.14
Mark H. Francis and Ashwini Jarrala, Legal Practitioner’s Guide to AI &
Hallucinations (February 16, 2026)
Washington State Artificial Intelligence
Task Force companion
report
See the URL in the footnote below.15
Colorado’s AI Act (March 26, 2026) Regulation of AI Colo. Rev. Stat. § 6-
1-1701 et. seq. See the URL in the footnote below.16
14https://agportal-s3bucket.s3.us-west-2.amazonaws.com/AI%20Task%20Force/WA%20AI%20Task%20Force%20-
%20Literature%20Review%20of%20AI%20Risks%20and%20Opportunities.pdf?VersionId=21mmRG_ns5c1ZqxE_tRqJtYuwtg7eC9q, Accessed April 1, 2026.
15 https://nationalcenterforstatecourts.app.box.com/v/Legal-practitioner-guide-AI, Accessed April 1, 2026. 16https://practicalcompliance.thomsonreuters.com/Browse/Home/Jurisdictions/UnitedStates/Colorado/ColoradoStatutes?guid=NBB934F3017CE11EF9141A71BA98479C6&originationContext=documenttoc&transitionType=Default&contextData=(sc.Default)&firstPage=true, Accessed April 15, 2026.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 22 of 29
APPENDIX B: RELEVANT COMPLIANCE REQUIREMENTS
This appendix provides references to applicable key regulations and standards. This appendix does
not replace the authoritative source and is only a reference to assist with further research. Please
use the Compliance Standard and Section No. to further research the entirety of the regulation, framework or standard from the authoritative source.
Compliance Standard Location Description
HIPAA 45 CFR 164, Subpart C Security Standards for the Protection of Electronic Protected Health Information.
45 CFR 164.316 Policies and procedures and documentation requirements.
PCI DSS v3.2
(Jun. 2024)
12.2 at page 295 Acceptable Uses of the Technology.
NIST CSF 2.0
(Feb. 2024)
Information Protection Processes and Procedures.
NIST 800-536, Revision 5
(Sep. 2020)
AC-8 at page 40
AI system Use Notification.
Various sections Policies and Procedures.
PL-4 at page 197 Rules of Behavior.
PS-6 at page 226 Access Agreements.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 23 of 29
APPENDIX C:
RECORDS PROTECTED FROM DISCLOSURE BY AN “OTHER
STATUTE” THAT ARE NOT TO BE USED IN AN AI SYSTEM
[ATTACHED]
Version: May 26, 2026
JEFFERSON
COUNTY
ARTIFICIAL
INTELLIGENCE
ACCEPTABLE
DEVELOPMENT
AND USE POLICY
This AI Policy governs all uses of artificial intelligence by or on behalf of Jefferson County, Washington.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page ii of ii
TABLE OF CONTENTS
TABLE OF CONTENTS ................................................................................................................ ii
(1) INTRODUCTION .............................................................................................................. 1
(2) PURPOSES ......................................................................................................................... 1
(3) GUIDING PRINCIPLES AND VALUES.......................................................................... 2
(4) DEFINITIONS .................................................................................................................... 3
(5) APPLICABILITY OF THIS AI POLICY .......................................................................... 7
(6) Compliance with Existing Laws and Policies ....................................................... 8
(7) Prohibited uses of an AI System ......................................................................................... 8
(8) PUBLIC RECORDS ACT COMPLIANCE ..................................................................... 10
(9) architectural and technical STANDARDS ....................................................................... 10
(10) ROLES AND RESPONSIBILITIES ................................................................................ 11
(11) AI SYSTEM AND USE AND CASE APPROVAL PROCESS ...................................... 13
(12) PROCEDURES................................................................................................................. 16
(13) CONSEQUENCES FOR NONCOMPLIANCE .............................................................. 18
(14) LIMITATIONS OF THIS AI POLICY ............................................................................ 18
APPENDIX A: REFERENCES .................................................................................................... 20
APPENDIX B: RELEVANT COMPLIANCE REQUIREMENTS ............................................. 22
APPENDIX C: RECORDS PROTECTED FROM DISCLOSURE BY AN “OTHER
STATUTE” THAT ARE NOT TO BE USED IN AN AI SYSTEM ........................................... 23
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 1 of 29
JEFFERSON COUNTY ARTIFICIAL INTELLIGENCE ACCEPTABLE DEVELOPMENT AND USE POLICY
(1) INTRODUCTION
Artificial Intelligence (AI) technology is increasingly becoming an integral part of local government operations, offering opportunities to enhance the efficiency and effectiveness
of public services. At the same time, the use of AI also presents ethical, legal, and social
challenges that require responsible management. This AI Policy provides a framework for the effective and responsible use of AI systems within the County, to maximize the benefits of these innovative tools while minimizing their potential risks to both the County and the public.
(2) PURPOSES
The purposes of this AI Policy are to:
A. Ensure ethical and responsible development, deployment, and use of AI technology in the County, ensuring they are in alignment with the principles of transparency, fairness, accountability, and public trust.
B. Enable effective use of AI technology by providing clear guidance to the County personnel,
vendors, and other partners who work with AI systems.
C. Inform community members and other stakeholders about how the County is utilizing AI technology and what measures it is taking to protect the public from potential adverse consequences of these systems.
D. Promote responsible and ethical use of AI technology by defining the principles and values
that govern the application of this technology within the County.
E. Ensure the compliance of AI systems with all applicable federal, state, and local laws and regulations as well as existing the County policies.
F. Assign roles and responsibilities related to the County’s use of AI systems.
G. Establish processes that encourage effective and responsible use of AI systems.
H. Define prohibited uses of AI systems.
I. Specify measures which may be taken in the event of failure to comply with these policies.
This AI Policy may be updated from time to time to account for changes in AI technology, laws and regulations, uses of AI systems within the County, and other considerations.
In addition, the Central Services Director may publish an AI User Guide to provide more detailed
guidance on how the requirements of this AI Policy is to be implemented. Unless otherwise stated,
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 2 of 29
any such additional guidance should be considered an extension of this AI Policy and carry the same requirements for compliance.
(3) GUIDING PRINCIPLES AND VALUES
The County’s AI development, deployment, and use of artificial intelligence systems shall be guided by the following guiding principles and values:
(a) We expect to retain appropriate human agency and oversight, allowing for intervention to prevent harm.
(b) We expect to use internal and external security testing of systems before
public release for high-risk artificial intelligence systems.
(c) We expect to protect data privacy and security.
(d) We expect to promote appropriate transparency for consumers when they interact with artificial intelligence systems or products created by artificial
intelligence.
(e) We expect to ensure accountability, considering oversight, impact assessment, auditability, and due diligence mechanisms.
(f) We expect to make AI accessible to all residents, including those with disabilities or limited access.
(g) We expect to govern the deployment and maintenance of AI systems with
human oversight ensuring adherence to relevant laws and regulations and by defining roles and responsibilities.
(h) We expect to implement measures to detect and mitigate biases in order to prevent harm.
(i) We expect to continuously monitor and enhance AI systems based on feedback and
technological advancements.
(j) We expect proper management, quality, and stewardship of data used by AI systems.
(k) We expect the county will be one source of digital literacy among residents to help them understand and engage with AI systems.
(l) We expect AI systems to be reliable, meet their objectives, and deliver
precise and dependable outcomes in their deployment contexts;
(m) We expect AI decisions to be understandable to those affected.
(n) We expect AI systems to prevent discrimination and bias, ensuring fair treatment for all residents.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 3 of 29
(o) We expect AI systems should be developed and deployed with a human-centered approach that evaluates their impact on the public.
(p) We expect technological innovation to be embraced responsibly while minimizing
environmental impacts.
(q) We expect AI systems to comply with all relevant laws and regulations.
(r) We expect privacy concerning personal data to be protected, while satisfying the requirements of the Washington Public Records Act, chapter 42.56 RCW.
(s) We expect AI systems to comply with data protection laws.
(t) We expect AI systems not to cause harm and to prioritize the safety of residents.
(u) We expect AI systems to be secure against unauthorized access and ensure consistent performance.
(v) We expect the use of AI systems to be proactively communicated to the
public, ensuring that AI systems, their data sources, operational models, and governing policies are understandable and documented.
(w) We expect Staff to be empowered to use AI in their roles through education, training, and collaborations that promote participation and opportunity.
These guiding principles and values are the inspiration for this AI Policy, and AI users are expected
to incorporate these same motivations in the implementation of this AI Policy. While the ideal course of action may not be obvious or practical in every circumstance, this AI Policy is designed to offer guidance to help AI users responsively navigate the use of AI systems.
(4) DEFINITIONS
(a) “Artificial Intelligence” (or “AI”) means a machine-based system that can, for
a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments. Artificial intelligence systems use machine and human-based inputs to:
(i) Perceive real and virtual environments;
(ii) Abstract such perceptions into models through analysis in an automated
manner; and,
(iii) Use a model to formulate options for information or action.
(b) “AI best practices” means the best practices described in National Cyber Security Centre, Best Practices for Securing Data Used to Train & Operate
AI systems, Ver. 1.0 (May 2025).
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 4 of 29
(c) “AI model” means a set of programmed instructions that processes data to perform tasks, make decisions, or solve problems within an AI system.
(d) “AI Policy” means this Jefferson County Artificial Intelligence
Acceptable Development and Use Policy.
(e) “AI System” means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or
recommendations, that can influence physical or virtual environments and
includes any tool, software, process, workflow, or other system which is based on AI or which uses an AI tool.
(f) “AI Tool” means a piece of software which provides AI functionality and can be applied to a specific use case.
(g) “AI Use Case” means specific task or purpose for which an AI tool is used
or under consideration.
(h) “AI User” means any person using, developing, purchasing, configuring, or maintaining any AI used by or for the County on its behalf, including contractors, consultants, elected officials, employees, and volunteers.
(i) “AI User Guide” means a document which supplements an AI Policy with
more detailed guidance on how to implement this AI Policy.
(j) “Bias” means systematic tendencies that can exist within AI systems, often stemming from flawed data, algorithms, or design processes, that may lead to discriminatory or inaccurate outcomes affecting certain groups or
persons.
(k) “Central Services” means the County Central Services Department.
(l) “Central Services Director” means the person holding the title of Director of Central Services or a delegee that has been delegated in writing.
(m) “Chatbot” means a computer program that simulates human conversation
through text or voice interactions.
(n) “Consequential decision” means a decision that has a material legal or similarly significant effect on, or the cost of:
(i) Hiring or retention of a contractor, employee, vendor or volunteer;
(ii) Any budget decision;
(iii) The provision of any essential government service;
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 5 of 29
(iv) Health care (as defined in this AI Policy);
(v) Risk management, including but not limited to obtaining coverage for
any risks by an insurance company or a self-insurance program; or,
(vi) The provision of legal services.
(o) “County” means the County, Washington.
(p) “County Approved AI system” means an AI system approved for use by AI users as specified in section 7.a.
(q) “County Information Systems” means all county information systems,
including but not limited to computers or servers owned or operated by the County. For the avoidance of doubt, county operated systems include information systems owned by another person that contain data, information, programs or systems owned or controlled by the County such as cloud-based
information systems.
(r) “Data” means any digital representation of information, knowledge, facts, concepts, data programs or instructions that are being prepared or have been prepared in a formalized manner and are intended for use in a data network, data program, data services, or data system.
(s) “Health care provider” means a person who is licensed, certified,
registered, or otherwise authorized by the law of this state to provide health care in the ordinary course of business or practice of a profession.
(t) “Health care” means any care, service, or procedure provided by a health care provider:
(i) To diagnose, treat, or maintain a patient's physical or mental condition;
or,
(ii) That affects the structure or any function of the human body.
(u) “Health care information” means all information about health care that is protected from disclosure by the Health Insurance Portability and
Accountability Act of 1996 (HIPAA) Privacy Rule, 45 C.F.R. Parts 160 and
164, Chapter 70.02 RCW (Medical Records—Health Care Information Access and Disclosure) or RCW 42.56.360 (Health care exemption from disclosure of records under the Washington Public Records Act).
(v) “High-risk AI system” means any AI system that, when deployed, makes,
or is a substantial factor in making, a consequential decision. “High-risk
AI system” does not include an AI system if:
(i) The AI system is intended to:
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 6 of 29
(A) Perform a narrow procedural task;
(B) Detect decision-making patterns or deviations from prior
decision-making patterns and is not intended to replace or
influence a previously completed human assessment without sufficient human review;
(ii) The AI system uses the following technologies, unless the technologies, when deployed, make, or are a substantial factor in
making, a consequential decision:
(A) Anti-fraud technology that does not use facial recognition technology;
(B) Anti-malware;
(C) Anti-virus;
(D) AI-enabled video games;
(E) Calculators;
(F) Cybersecurity;
(G) Databases;
(H) Data storage;
(I) Firewall;
(J) Internet domain registration;
(K) Internet website loading;
(L) Networking;
(M) Spam- filtering;
(N) Robocall-filtering;
(O) Spell-checking;
(P) Spreadsheets;
(Q) Web caching;
(R) Web hosting or any similar technology; or,
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 7 of 29
(S) Technology that communicates with consumers in natural language for the purpose of providing users with information, making referrals or
recommendations, and answering questions and is subject to County policy
that prohibits generating content that is discriminatory or harmful.
(w) “IT” means the Jefferson County Information Technologies Department, a division of Central Services.
(x) “Public Record” has the same meaning as in RCW 42.56.010(3).
(y) “Risk management” means coordinated activities to direct and control an
organization with regard to risk.
(z) “Section” means a section of this AI Policy, unless there is clear language in this AI Policy that a section of this AI Policy does not apply.
(aa) “Substantial factor” means a factor that:
(A) Assists in making a consequential decision;
(B) Is capable of altering the outcome of a consequential decision; and,
(C) Is generated by an AI system.
“Substantial factor” includes any use of an AI system to generate any content, decision, prediction, or recommendation concerning consequential decision.
(bb) “Writing” has the same meaning as in RCW 42.56.010(4).
(5) APPLICABILITY OF THIS AI POLICY
(a) This AI Policy governs the development, procurement or use of any AI Systems (as defined in this AI Policy) on any County Information System or for input of results from the use of an external AI System into County Information Systems.
(b) All County boards, commissions, committees, departments, and task forces
shall comply with this AI Policy.
(c) This AI Policy applies to:
(i) Agents, contractors, elected officials, employees, officers, vendors and volunteers of the County who use or input data into County Information
Systems; and,
(ii) All AI users (as defined in this AI Policy).
(d) This AI Policy does not apply to any AI system which:
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 8 of 29
(i) Has been evaluated and determined in writing by the Central Services Director to be safe for unrestricted usage;
(ii) Has AI features included in applications maintained by Central Services,
which are not part of the AI feature’s core functionality or involve the use of sensitive data; and,
(iii) That does not use or input data into County Information Systems.
(6) COMPLIANCE WITH EXISTING LAWS AND POLICIES
Development and use of AI systems shall comply with:
(a) All applicable federal, state, and local laws and regulations; and,
(b) All County policies, including but not limited to:
(i) Jefferson County Social Media Policy (Resolution No. 14-20, March 16, 2020).
(ii) Jefferson County Public Records Act Compliance Policy (Resolution No. 10-22,
February 28, 2022).
(iii) Open Public Meeting Act Guidelines for Jefferson County Boards, Commissions & Committees (Resolution No. 50-22, October 24, 2022).
(iv) Jefferson County Personnel Administration Manual (Resolution No. 19-0407-
25R, April 7, 2025).
(7) PROHIBITED USES OF AN AI SYSTEM
(a) The following AI systems are approved for use by the persons subject to this AI Policy listed in sections 5 and 6, subject to the limitations in this section 7:
(i) Microsoft’s Enterprise AI system called Co-Pilot (which is part of the Microsoft
365 suite of programs) is the preferred AI system to be used for generative AI that
is approved for use by AI users (as defined in this policy).
(ii) The Central Services Director shall maintain a list of AI systems that are approved, being tested by the Central Services Department, or are prohibited. AI users may only use AI systems that are authorized or are
being tested by the Central Services Department. The Central Services
Director shall publish the list on the County’s web site.
(b) Use of an AI system on a County-owned computer, server or system that is not on the list of AI systems approved and made available on the County’s web site is prohibited.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 9 of 29
(c) Use of an AI system on a County-owned computer, server or system that is on the list of AI systems being tested for possible authorized use pursuant to
section (11) is authorized until testing is complete. Once testing is complete,
the Central Services Director shall determine whether such system shall be added to either the list of AI systems that are approved or the list of AI systems that are not approved.
(d) Use of any high-risk AI system (as defined in this AI Policy) requires enhanced
review and specific written approval before it can be added to the list of
approved AI Systems in section 7(a)(i).
(e) Use of an AI system on a County-owned computer, server or system to create any deepfake, which is an image created by using machine learning to capture and encode unique biometric characteristics of targets to combine the subject’s
unique characteristics with the acquired knowledge of general human
expression in order to then synthesize the target’s facial features, voice, mannerisms, etc. is prohibited.
(f) Entry any of the following data into an AI system is prohibited:
(i) Personal financial information for any individual. This includes credit card
number, bank account number, PIN numbers, and any other financial
information.
(ii) Authentication information. Inputting any passwords, login credentials, or other authentication information into an AI system is prohibited.
(iii) Personally Identifying Information. Inputting any personally identifying
information into an AI system is prohibited. Personally identifying
information includes name, address, phone number, email address, social security number, passport number, driver’s license number, and any other information that can reasonably be used to identify an person.
(iv) Health care information (as defined in this AI Policy).
(v) Sensitive or confidential information. This includes any information that
could be used or disclosed to harm the County or its employees or volunteers, or residents such as information about political affiliations, religious beliefs, membership in a protected class, criminal history, or information related to the County information system.
(vi) Any information exempted from disclosure by the Public Records Act,
chapter 42.56 RCW or some other federal or state statute, including but not limited to:
(A) Attorney-client privileged records relating to representation of the County by its attorneys. The attorney-client privileged records are
protect communications and advice between an attorney and their
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 10 of 29
client. RCW 5.60.060(2)(a) constitutes an “other statute’ exemption under RCW 42.56.070(1)
(B) Attorney work product records. Attorney work product records are:
“Records that are relevant to a controversy to which an agency is a party but which records would not be available to another party under the rules of pretrial discovery for causes pending in the superior courts are exempt from disclosure under [the Public Records Act].” RCW
42.56.290.
(C) Autopsy records. Autopsy and post mortem reports and records are confidential and exempt from examination by the public. RCW 68.50.105(1).
(D) Records related to juvenile offenses. RCW 13.50.050(1), (3).
(E) Records of a person confined in jail. RCW 70.48.100(2).
(F) Personal information in files maintained for County employees, appointees, or elected officials of any public agency to the extent that disclosure would violate their right to privacy. RCW 42.56.230(3).
(G) Specific intelligence information. Secret information, information
about an enemy, or conclusions drawn from such information or that
would disclose particular methods or procedures for gathering or evaluating intelligence information. RCW 42.56.240(1).
(H) Specific investigative records. Information on active ongoing law enforcement investigations. RCW 42.56.240(1).
(I) Records protected by an “other statute which exempts or prohibits
disclosure of specific information or records.” RCW 42.56.070(1).
A list of “other statutes” is attached as Appendix D.
(8) PUBLIC RECORDS ACT COMPLIANCE
Any product created by any AI system necessarily will be a “public record,” as defined in RCW
42.56.010(3). All public records shall be managed in compliance with chapter 40.14 RCW
(Preservation And Destruction of Public Records), chapter 42.56 RCW (Public Records Act), and the County’s most recent version of the Jefferson County Public Records Act Compliance Policy.
(9) ARCHITECTURAL AND TECHNICAL STANDARDS
The architectural and technical standards associated with the enterprise use of AI systems shall be
maintained by IT.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 11 of 29
(10) ROLES AND RESPONSIBILITIES
The following persons and groups are responsible for the duties involved in implementing this
AI Policy, as described below:
(a) Central Services Director.
The Central Services Director shall be responsible for:
(i) Providing a public report at least annually to the Board of County Commissioners on County AI usage.
(ii) Developing this AI Policy and additional guidance.
(iii) Coordinating AI initiatives across departments and teams.
(iv) Overseeing compliance with laws, regulations and County policies.
(v) Providing guidance to AI users across the organization.
(vi) Convening and overseeing the AI Review Committee.
(vii) Leading the AI review process.
(viii) Directing technology resources, policies, projects, and services.
(ix) Reviewing the AI Review Committee recommendations on oversight and guidance on AI initiatives within the County.
(x) Facilitating collaboration between teams and departments for successful
implementation of this AI Policy.
(xi) Overseeing enterprise security infrastructure and cybersecurity operations.
(xii) Maintaining security policies, procedures, standards, and guidelines.
(xiii) Monitoring compliance with security policies and related requirements.
(xiv) Ensuring accurate data sensitivity classification and protections.
(xv) Advising on compliance on AI usage.
(xvi) Identifying legal issues and risks related to AI usage.
(xvii) Investigating alleged violations of this AI Policy and recommend corrective actions.
(b) AI Review Committee
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 12 of 29
The Board of County Commissioners shall establish an AI Review Committee with department representatives which shall be make recommendations to the Central Services
Director on oversight and guidance on AI initiatives within the County.
The AI Review Committee shall review and consider updates to this AI Policy, along with the Central Services Director, at least annually to reflect technological advancements and evolving community needs.
The AI Review Committee shall be responsible for making recommendations to the Central
Services Director on the following topics:
(i) AI systems being considered for use by the County.
(ii) Ethical concerns and conflicts.
(iii) Policy and guidance updates.
(c) County Administrator
The County Administrator shall be responsible for:
(i) Approving proposed changes to this AI Policy.
(ii) Making a final determination whether to allow AI use cases which involve substantial risks of harm or other negative consequences.
(iii) Enforcing corrective action for violations of this AI Policy.
(d) Electeds and Department Heads
Electeds and department heads or a delegee shall be responsible for:
(i) Ensuring employee, contractor and vendor compliance with this AI Policy.
(ii) Integrating AI systems into department operations that comply with this
AI Policy.
(iii) Facilitating training for staff on this AI Policy and AI best practices (as defined in this AI Policy).
Unless otherwise specified, the specific officials listed above may delegate to one or more
persons to act on their behalf with respect to this AI Policy, and in such cases those
designees are understood to inherit the same authorities and obligations as the named
officials.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 13 of 29
(e) AI Users
(i) All AI users are responsible for complying with the requirements of this AI
Policy.
(ii) All AI users have the responsibility to verify the accuracy of any information acquired through the use of AI systems before using that information in any final, published, or production documents.
(11) AI SYSTEM AND USE AND CASE APPROVAL PROCESS
(a) AI Systems Review Process
The Central Services Director shall establish a process under which all AI systems and AI Use Cases are subject to thorough testing to determine their compliance with this AI Policy prior to their implementation. The testing process shall:
(i) Confirm compliance with the specific requirements and prohibitions established
under this AI Policy;
(ii) Consider the relative benefits and risks of each system or use case and determine whether or not approval is reasonable and aligned with the values and principles in this AI Policy;
(iii) Specify the intended use cases of those systems and whether or not other use cases
require additional review;
(iv) Document the results of each review using a standard template, which results shall be retained for either the full lifespan of the AI system or use case or the retention period required under law for similar documents (whichever is longer).
(b) Determination of High Risk Potential Negative Impacts
(i) The Central Services Director shall create a standard for determining whether or not a particular AI system or AI use case has a high risk of potential negative impacts to any relevant person, group, or organization.
(ii) A high-risk determination, that AI system or use case shall be presented to the
full AI Review Committee for approval.
(iii) Lower-risk AI systems and use cases may be approved by the Central Services Director at their discretion.
(iv) The Central Services Director shall revisit all previously-approved AI systems and use cases at least annually, or sooner in the event of substantial
modifications (such as a major software upgrade or change in scope), and
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 14 of 29
confirm in writing to the County Administrator the continued compliance and reasonableness of the AI system or use case.
(c) Monitoring, Evaluation, and Accountability
(i) The Central Services Director shall be responsible for implementing AI systems to monitor AI system performance, effectiveness, and policy compliance. The data collected from these AI systems shall be periodically reviewed to evaluate the effectiveness of AI systems and their impacts on the
community.
(ii) The Central Services Director shall establish procedures and protocols for responding to failures of AI systems and violations of this AI Policy, including corrective actions with regard to both the AI systems themselves and the persons and organizations involved.
(iii) Upon the recommendation of the Central Services Director, , or County
Administrator, independent audits shall be conducted to review AI systems for compliance with policies and ethical standards. Findings from audits and evaluations shall be used to refine AI policies, improve AI system functionalities, and determine any additional training or accountability requirements.
(d) Data Management, Privacy, and Retention
All AI systems shall comply with applicable data protection laws, regulations, and
policies to safeguard data protected by this AI Policy.
(e) Mitigation of Bias and Human Oversight
All AI users shall be responsible for taking steps to mitigate potential biases (including but
not limited to biases related to protected characteristics such as race, gender, sexual
orientation, national origin, disability, or language) in AI systems they interact with, in
accordance with training and recommendations provided by the Central Services
Director.
(f) Transparency and Explainability
Upon the consideration or introduction of a new AI system which is likely to have major public impact, the Central Services Director shall ensure that key information is provided to affected groups and other stakeholders in a timely manner. Such information shall be provided in multiple formats or languages if necessary, consistent
with the County’s practice in communicating
To the greatest extent possible, AI systems should provide clear and understandable explanations for their decisions and outputs, particularly in cases where erroneous results may create a risk of substantial negative impacts.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 15 of 29
(g) Training
(i) All users shall be provided with regular training on AI technologies,
ethical considerations, and compliance requirements to ensure
knowledgeable and responsible use of AI systems, as recommended by the Central Services Director.
(ii) The Central Services Director shall develop specific training requirements and content for users granted access to high-risk AI systems and associated data,
focusing on compliance with this AI Policy and other associated laws,
regulations, policies, and AI best practices.
(iii) These trainings shall be updated on a regular basis to ensure their accuracy and relevance, and users’ continued access to high-risk AI systems and data shall be contingent upon completion of additional required trainings determined by
the Central Services Director.
(h) Vendors and Third Parties
(i) All vendors and other third parties who provide or interact with AI systems shall be required to comply with this and all other applicable policies, and this compliance shall be explicitly included in all relevant contracts and similar
agreements.
(ii) All technology vendors shall be required to disclose whether and how AI is used in their products and services, and what mechanisms they provide to allow for auditing these AI systems. These disclosures shall be provided using a standard form developed and maintained by the Central Services Director and required in
all technology procurements.
(iii) Vendors shall be evaluated based on their commitment to responsible AI development and their history of adherence to ethical standards, and preference in procurement decisions shall be given to vendors which can effectively provide transparency into their AI systems and practices to both the County
and the public.
(i) Labeling of AI-generated Content
All content generated by AI systems and presented to the public shall be clearly labeled as such. This shall include all text, audio, image, and video content, as well as interactive AI systems such as chatbots and automated decision-making tools.
All persons involved in disseminating content generated by an AI system on behalf of the
County shall be responsible for ensuring the accuracy of such content and its appropriate labeling.
The Central Services Director or designee shall establish standard mechanisms for the County personnel and members of the public to report violations of this labeling requirement.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 16 of 29
(12) PROCEDURES
(a) Attribution
(i) The use of AI systems and the resulting product(s) shall be attributed,
referenced, and cited in any electronic or paper material produced and published by anyone subject to this AI Policy.
(ii) Attribution should include a description of the source application, how it was used, how the material was edited, by whom, and the date. For
example:
“Microsoft Co-Pilot was used to generate the charts and data referenced above. The content was reviewed and edited before being published by Sam Smith, Jefferson County Public Works Department, on 04/15/2026.”
(b) Intellectual Property
Content produced by AI systems may implicate intellectual property rights and likely will
include copyrighted material. AI systems shall be “trained” using Data (text, images, etc.) that has been sourced from the internet without regard for copyright or licensing terms. It is extremely difficult to determine what content was used to train an AI system, and difficult to verify whether AI-generated content is wholly original or only a slight
stylization of existing copyrighted material. Nevertheless, County AI users are required to
perform due diligence to ensure that no copyrighted material is published by the County without proper attribution or without obtaining proper rights.
(c) Validation Required
(i) Complex algorithms of AI systems exponentially increase risk when
incomplete or inaccurate data is involved. AI systems shall be validated
and regularly assessed to ensure completeness and accuracy. Results from decisions, code, or research supported by AI systems should consistently align with those of a human subject matter expert.
(ii) AI users shall verify the accuracy of any information acquired through the
use of AI systems before using that information in any final, published, or
production documents. If AI users are uncertain about the accuracy of the obtained information, they should consult their supervisor or seek advice from a IT.
(iii) AI users shall independently verify any quotes or references generated by
AI systems. AI users shall not assume that a quote or reference is accurate,
or real. AI systems rarely act as if they are uncertain, making false answers difficult to spot. AI systems can generate:
(A) Fabricated content, sometimes called “hallucinations.” This is a phenomenon where an AI system, particularly those using large
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 17 of 29
language models, generates false, inaccurate, or illogical information while presenting it in a confident, authoritative, and
convincing manner. Fabricated content occurs when an AI system
creates synthetic data, fabricates facts, or invents nonexistent sources. An AI system may invent fake academic papers, legal cases, scientific studies, or personal facts.
(B) Factual Errors: Stating incorrect facts, such as “Einstein won two
Nobel Prizes.”
(C) Image Distortions: AI systems can create anatomically incorrect figures (e.g., too many fingers).
Verification shall include cross-referencing sources included in the AI output, or independently verifying dates, names and events in peer reviewed or authoritative
published literature on the internet or printed material.
(d) Decision Making
County departments shall utilize AI systems to enhance efficiency and effectiveness. AI systems can be used for idea generation and as one source of information when researching a topic. AI systems products shall be human reviewed and edited before usage in any final,
published, or production documents. This is particularly important when the content is
public facing. AI users shall be responsible for their use of AI systems and the application of any content or product in work tasks generated by AI systems.
(e) Equity and Inclusion
(i) While AI systems can reduce workloads, support capacity, and increase
accessibility, the generated content reflects the cultural, economic, and social biases
of the source materials used for training. The algorithms applied can be a source of bias as well. Applying principles from the equity and empowerment lens, AI users should thoroughly review any content generated by AI systems to ensure that any instances of bias, or potentially offensive or harmful material, is changed or
removed.
(ii) When it comes to the adoption of AI systems, the County’s goal is to eliminate digital disparities and ensure that persons who belong to a protected class and those impacted by language or other accessibility barriers have equal access to and benefit from the County programs, activities, benefits, and services. To uphold this
commitment, the County applies the equity and empowerment lens to address race,
color, national origin, disability, religion, age, gender, sexual orientation, gender identity and expression, marital status, veteran status, source of income, or any other basis prohibited by federal, state, or local law.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 18 of 29
(f) Final Requirements
(i) Under no circumstances is a County employee authorized to engage in any activity
that is illegal under local, state, federal, or local law while utilizing County-owned
resources, including County Information Systems.
(ii) County employees shall comply with all applicable County policies and are required to read and understand them. Responsibilities for protecting County information protected by an exemption in the Public Records Act do not end at the
termination of employment. These responsibilities continue until the information is
reclassified to be public.
(13) CONSEQUENCES FOR NONCOMPLIANCE
(a) Department heads shall ensure compliance with this AI Policy and are accountable for any AI systems deployed by their department.
(b) Violations of this AI Policy shall be grounds for disciplinary action under the
current version of the County’s standards of conduct policy in Appendix C of to the Jefferson County Personnel Administration Manual, up to and including termination of employment; and enforcement action which shall include civil or criminal penalties.
(14) LIMITATIONS OF THIS AI POLICY1
(a) Nothing in this AI Policy restricts the County or any other person’s ability to:
(i) Comply with federal, state, or municipal laws, ordinances, or regulations;
(ii) Comply with a civil, criminal, or regulatory inquiry, investigation,
subpoena, or summons by a federal, a state, a municipal, or other governmental authority;
(iii) Cooperate with a law enforcement agency concerning conduct or activity that the developer, deployer, or other person reasonably and in
good faith believes may violate federal, state, or municipal laws,
ordinances, or regulations;
(iv) Investigate, establish, exercise, prepare for, or defend legal claims;
(v) Take immediate steps to protect an interest that is essential for the life or physical safety of a consumer or another person;
1 Adapted from the Colorado AI Act, Colo. Rev. Stat. § 6-1-1705 (2026).
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 19 of 29
(vi) By any means other than the use of facial recognition technology, prevent, detect, protect against, or respond to security incidents,
identity theft, fraud, harassment, malicious or deceptive activities, or
illegal activity; investigate, report, or prosecute the persons responsible for any such action; or preserve the integrity or security of AI systems; or,
(vii) Assist any other person with any of the obligations imposed under this
AI Policy.
(b) Nothing in this AI Policy restricts the Central Services Department from conducting research, testing, and development activities regarding an AI system or AI model, other than testing conducted under real-world conditions, before an AI system or AI model is deployed or put into service by the
County;
(c) Nothing in this AI Policy imposes any obligation on any person that adversely affects their rights or freedoms, including the rights to freedom of speech or freedom of the press that are guaranteed in:
(i) The first amendment to the United States constitution; or,
(ii) Section Article I, Section 5 of the Washington constitution.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 20 of 29
APPENDIX A: REFERENCES
Reference Topic Citation
Federal Law
National Artificial Intelligence Initiative
Act of 2020 (P.L. 116-283)
Shaping AI
development and use in
the United States
15 U.S.C. section
9401 et. seq.
Health Insurance Portability and
Accountability Act of 1996 (HIPAA)
Privacy Rule
Protection of heath
information
45 C.F.R. Parts 160
and 164.
Washington Law
Protection of the Right to Privacy Protection of privacy Chapter 9.73 RCW Preservation and Destruction of Public Records
Rules for preservation and destruction of public records
Chapter 40.14 RCW
Washington Public Records Act Promote open government Chapter 42.56 RCW
Health care exemption from disclosure of records under the Washington Public
Records Act
Protection of heath information RCW 42.56.360.
Medical Records—Health Care Information Access and Disclosure Law Protection of heath information Chapter 70.02 RCW.
SHB 1205 (2025) Reenacts and amends RCW 9A.60.010 and 9A.60.045 and makes it
a crime to knowingly distribute a forged digital likeness of another person to defraud, harass,
threaten, or intimidate another, or for an unlawful purpose
See the URL in the footnote below.2
Other References and Standards
National Cyber Security Centre, Best
Practices for Securing Data Used to Train & Operate AI systems, (Ver. 1.0 May 2025)
Best Practices for
development and use of AI systems
See the URL in the
footnote below. 3
National Institute of Standards and Technology, Artificial Intelligence Risk Standards for use of AI systems See the URL in the footnote below.4
2 https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bills/Session%20Laws/House/1205-S.SL.pdf, Accessed April
11, 2026. 3 https://media.defense.gov/2025/May/22/2003720601/-1/-1/0/CSI_AI_DATA_SECURITY.PDF, Accessed April 12, 2026. 4 https://doi.org/10.6028/NIST.AI.100-1, Accessed April 11, 2026.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 21 of 29
Reference Topic Citation
Management Framework (AI RMF 1.0
2023)
Washington State Artificial Intelligence
Task Force’s Interim Report (December
1, 2025)
ESSB 5838 (2024)
established the
Washington State Artificial Intelligence Task Force to evaluate AI development, use
and risks
See the URL in the
footnote below.5
Mark H. Francis and Ashwini Jarrala, Legal Practitioner’s Guide to AI &
Hallucinations (February 16, 2026)
Washington State Artificial Intelligence
Task Force companion
report
See the URL in the footnote below.6
Colorado’s AI Act (March 26, 2026) Regulation of AI Colo. Rev. Stat. § 6-
1-1701 et. seq. See the URL in the footnote below.7
5https://agportal-s3bucket.s3.us-west-2.amazonaws.com/AI%20Task%20Force/WA%20AI%20Task%20Force%20-
%20Literature%20Review%20of%20AI%20Risks%20and%20Opportunities.pdf?VersionId=21mmRG_ns5c1ZqxE_tRqJtYuwtg7eC9q, Accessed April 1, 2026.
6 https://nationalcenterforstatecourts.app.box.com/v/Legal-practitioner-guide-AI, Accessed April 1, 2026. 7https://practicalcompliance.thomsonreuters.com/Browse/Home/Jurisdictions/UnitedStates/Colorado/ColoradoStatutes?guid=NBB934F3017CE11EF9141A71BA98479C6&originationContext=documenttoc&transitionType=Default&contextData=(sc.Default)&firstPage=true, Accessed April 15, 2026.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 22 of 29
APPENDIX B: RELEVANT COMPLIANCE REQUIREMENTS
This appendix provides references to applicable key regulations and standards. This appendix does
not replace the authoritative source and is only a reference to assist with further research. Please
use the Compliance Standard and Section No. to further research the entirety of the regulation, framework or standard from the authoritative source.
Compliance Standard Location Description
HIPAA 45 CFR 164, Subpart C Security Standards for the Protection of Electronic Protected Health Information.
45 CFR 164.316 Policies and procedures and documentation requirements.
PCI DSS v3.2
(Jun. 2024)
12.2 at page 295 Acceptable Uses of the Technology.
NIST CSF 2.0
(Feb. 2024)
Information Protection Processes and Procedures.
NIST 800-536, Revision 5
(Sep. 2020)
AC-8 at page 40
AI system Use Notification.
Various sections Policies and Procedures.
PL-4 at page 197 Rules of Behavior.
PS-6 at page 226 Access Agreements.
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 23 of 29
APPENDIX C:
RECORDS PROTECTED FROM DISCLOSURE BY AN “OTHER
STATUTE” THAT ARE NOT TO BE USED IN AN AI SYSTEM
[ATTACHED]
Title: Jefferson County Artificial Intelligence Acceptable Development and Use Policy
Page 24 of 29
[This page intentionally left blank]