Section 2: GenAI Business Process and Data Classification

Generative Artificial Intelligence (GenAI) Reporting Form

CALIFORNIA PUBLIC UTILITIES COMMISSION

GENAI REPORTING FORM

CPUC 1000A (REV. 02/2025)

Solicitation / Contract # Business Name

Business E-mail Address Business Telephone Number

1. Will you and/or your subcontractor(s) be using or offering GenAI technology, model, service, or system (collectively, “product”) to meet the needs of the agreement?

Yes (Answer question 2 of this form) No (Skip to Section 4: Signature of this form.)

2. Will the proposed GenAI product(s) use State data?

Yes (Complete Sections 2, 3, and 4 of this form) No (Skip to Section 4: Signature of this form.)

Notice:

Failure to provide information requested on this form may result in disqualification or void any resulting contract.

GenAI Special Provisions are required to be part of a solicitation, award process, and contract when a Generative AI Risk Assessment (SIMM 5305-F) and a CDT GenAI consultation indicate moderate or high risk GenAI. This may result in changes to solicitation and/or contract language.

1. Select the applicable checkbox(es) that best describe the proposed GenAI product business process(es):

Inputs and processing of confidential data types. Examples: Privacy, authentication, biometric identification, financial, medical, procurement, investigative, national security, network architecture schematics, ports, protocols, Diversity, /equity Inclusion and Accessibility (DEIA), and others.

Inputs and processing of confidential data that inform safety decisions. Examples: Water treatment ratios, load-bearing specifications for bridges, and similar critical information.

Code Analysis and Development Tools. Examples: Static and dynamic code analysis, code generation tools, code assistant tools, platforms used to create GenAI solutions.

Chatbots. Examples: Internal chatbots for resource finding and process advice, resident-facing chatbots for public interaction and information retrieval.

Public and Direct Contact Services. Examples: Customer service, public relations, jurisprudence, output providing recommendations such as legal, tax, and/or regulatory advice.

Critical Infrastructure and Safety. Examples: Handling mission-critical apps/systems, service eligibility

Section 1: Bidder / Offeror / Contractor Information assessments for housing or income assistance, drafting organizations documents, generating data for public use like soil composition or seismic considerations.

Network and Security Tools. Examples: Packet inspection, system monitoring, intrusion prevention/detection, spam filtering tools, malware detection tools like anti-virus, anti-malware, and endpoint detection and response.

Content and Communication Tools. Examples: Grammar correction tools, summarization tools, reference generating tools like laws, case law, policies, translation tools, text to speech, and content creation tools for image, video, ads, and marketing.

2. Select the applicable checkbox(es) that best classifies the proposed GenAI product data:

Personal Identifiable Information. Information that identifies or describes an individual.

Confidential. Information maintained by state agencies that is exempt from disclosure under the provisions of the California Public Records Act, or has restrictions on disclosure in accordance with other state or federal laws.

Public Information. Information maintained by state agencies that is not exempt from disclosure under the provisions of the California Public Records Act or other state or federal laws.

A. What is the vendor’s name for the proposed GenAI?

B. What is the proposed GenAI’s application or product name?

C. What is the model and version of the proposed GenAI product?

D. If applicable, identify the license tier of the proposed GenAI product.

(i.e.: free, enterprise, platinum license)

E. Identify how the GenAI solution will be delivered. (i.e.: IaaS, PaaS, SaaS, deployed on-premises.)

F. Provide a brief overview of the workflow that is currently being performed.

SECTION 3, ITEM F IS FOR CPUC USE ONLY.

VENDOR/BIDDER/OFFEROR/CONTRACTOR SHALL NOT ENTER

ANY INFORMATION IN SECTION 3, ITEM F.

G. Provide a brief overview of what the proposed GenAI product will provide (i.e.: functionality and/or services.)

Section 3: Disclosure

H. What safeguards will be deployed with the proposed GenAI product? (Example: Vendor will ensure all GenAI output data is validated by an adequately qualified subject matter expert to be true and correct.)

I. If applicable, list features of the proposed GenAI product that will be disabled for this agreement.

J. To ensure proper use of the GenAI product/system, will tailored training and specific rules of engagement for stakeholders be required?

☐ Yes ☐ No

By signing this document, I have identified and reported any GenAI use in the performance of this contract. If any new or previously unreported GenAI use is identified in the future in the performance of this contract, we will complete and submit to the State an updated CPUC 1000A form.

Signature Date

As the CPUC CIO, I certify I have completed my review of this CPUC 1000A form, completed a SIMM 5305-F GenAI Risk Assessment (attached), and determined this purchase may proceed. My assessment has resulted in the rating below:

☐ High Risk (Requires further consultation with CDT prior to award) ☐ Moderate Risk (Requires further consultation with CDT prior to award) ☐ Low Risk

CPUC CIO Signature Date

Section 4: Vendor / Bidder/ Offeror/ Contractor Signature

CPUC USE ONLY – Do not enter any information for Section 5 Section 5: CIO Risk Assessment and Signature

CALIFORNAI PUBLIC UTILITIES COMMISSION

GenAI Reporting Form Instructions Please use the following definitions and instructions to complete the GenAI Reporting Form.

Section 1:

1. Identify yes or no to if you, or a subcontractor, will be using or proposing the use of a GenAI product for this specific agreement.

a. If yes, complete Section 1 question 2.

b. If no, sign in Section 4, and return this form to CPUC, no further action is necessary.

2. Identify yes or no if the GenAI product will be using data obtained from the State of California.

a. If yes, complete Section 2, 3 and 4 of this form.

b. If no, sign in Section 4, and return this form to CPUC, no further action is necessary.

Section 2:

1. Select the checkbox(es) that best describe(s) what the proposed GenAI product will be used for.

2. Select the checkbox(es) that identify what type of data the proposed GenAI product will use.

Section 3:

A. Provide the name of the vendor the proposed GenAI product will be obtained from.

• Definition: The name of the organization or entity responsible for creating or deploying the GenAI model or service.

• Purpose: Helps identify the source and accountability for the GenAI system.

B. Provide the name of the proposed GenAI product.

C. Provide the GenAI product model and version names/numbers.

• Definition: The unique identifier or name assigned to the specific GenAI model or service.

• Purpose: Allows users to refer to and distinguish between different GenAI models.

D. If applicable, provide the GenAI product license tier.

• Definition: The license tier assigned to the specific GenAI product.

• Purpose: Allows users to refer to and distinguish between different GenAI licenses and offerings.

E. Identify how the proposed GenAI product will be delivered to CPUC.

• IaaS – Infrastructure as a Service.

• PaaS – Platform as a Service.

• SaaS – Software as a Service.

F. FOR CPUC USE ONLY. VENDOR/BIDDER/OFFEROR/CONTRACTOR SHALL NOT ENTER ANY

INFORMATION IN SECTION 3, ITEM F.

G. Provide a brief overview of what functionality/services the proposed GenAI product will provide.

• Definition: A concise summary of the GenAI model’s purpose, functionality, and key characteristics.

• Purpose: Provides a high-level understanding for users and stakeholders.

H. Provide a brief overview of what safeguards will be deployed with the GenAI product.

• Explain below how you are ensuring the GenAI system is not adversely affecting decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice.

CALIFORNAI PUBLIC UTILITIES COMMISSION

I. Identify which, if any, of the GenAI product features will be turned off for this specific agreement.

J. Explain if the proposed GenAI product will require tailored training or adherence to specific rules for proper use.

• List what the training will cover.

• List what specific rules must be followed.

Section 4:

Signature: The signatory for the Contract shall also sign the CPUC 1000A form.

Section 5:

SECTION 5 IS FOR CPUC USE ONLY. VENDOR/BIDDER/OFFEROR/CONTRACTOR SHALL NOT ENTER ANY

INFORMATION IN SECTION 5.

Note: Section 5 is not required by CPUC if either Section 1 Question 1 or Question 2 of this form are “No”. The procurement will continue without further GenAI action.

The CPUC Chief Information Officer (CIO), or designee, will indicate the risk-assessment ranking, sign this form, and provide it to the CPUC Buyer.