ITS DP C000999 Appendix C-A1 Standard Terms for AI Purchases for ITS.pdf

APPENDIX C-AI

Standard Terms for AI Purchases for NYS Office of Information Technology Services

PLEASE RETAIN THIS DOCUMENT

FOR FUTURE REFERENCE

STANDARD CLAUSES FOR NYS CONTRACTS APPENDIX C-AI

Page 2 of 3 April 2025

1) New York State AI Policy

For further information on New York State’s AI policy, please refer to New York State Information Technology Policy No: NYS-P24-001 “Acceptable Use of Artificial Intelligence Technologies,” or any predecessor policies.

2) Notice Vendor shall provide ITS with notice of the use of artificial intelligence. Such notice shall be clear and unambiguous. AI-specific terms should be explicitly defined and presented separately from the general terms and conditions to ensure clarity and transparency. If new AI terms are included, AI will be clearly described by vendor to the ITS. Contractor or Vendor agrees to provide ITS with written notice at least 90 days prior to the implementation or use of any artificial intelligence (AI) technology in Contractor or Vendor's software, hardware, or in any dealings or communication with the State, the State’s employees, contractors or consultants, public users, members of the public, or data-subjects. Such notice shall include a detailed description of the AI technology to be used, its intended purpose, its connections with the State, when the AI will be deployed within a tool, whether that AI is open-source, and how the AI will be implemented. ITS reserves the right to request additional documentation related to AI prior to or while the AI is in use.

3) Approval for AI Usage For AI tools not integral to the system, AI tools should be disabled by default. Any AI usage must be approved, in writing, by ITS. After analysis, should ITS deem the AI unacceptable and AI functionality cannot be disabled, ITS reserves the right to terminate contract at no cost.

4) Compliance The use of AI must comply with all applicable policies and standards set forth by New York State, as well as local, state, and federal laws. This includes compliance with regulations related to AI use, security, privacy, and any other laws, regulations, and standards concerning technology that employs AI. ITS may require vendor to provide reports that are necessary for auditing purposes by third parties. Reports should include how the AI system uses personally identifiable, confidential, or sensitive information to ensure such use complies with applicable laws, rules, regulations, notices, and policies. The Vendor may be asked to provide a recent independent audit report or, artificial intelligence (AI) impact assessment as defined by the National Institute of Standards and Technology (NIST) if solution incorporates AI. Vendor may be asked to provide information detailing the explainability of the artificial intelligence solution.

5) AI Training Data Usage Prohibition Vendor shall not employ State Confidential Information or Data acquired through working with the State or providing services to the State to train AI systems without obtaining prior written approval from the information owner, which may include Authorized User. If data is identified and non-aggregate, ITS should have prior notice that their information will be used for this purpose. The intended usage of such data for AI training must align with existing data usage rights, and the vendor shall ensure that data privacy and security are maintained throughout the process. If vendor intends to use any data for training purposes, they must have explicit authorization from ITS. A vendor may obtain an exception to allow for training with the State’s data if that training is being used solely in support of the State’s use of AI.

6) Transcription Tools AI transcription capabilities should be disabled by default, unless specifically requested by ITS. Users should be made aware of any loss of capabilities and usability if those transcription tools are disabled. Transcription capabilities include the ability to transcribe, summarize, or analyze any meetings, discussions, or proceedings.

STANDARD CLAUSES FOR NYS CONTRACTS APPENDIX C-AI

Page 3 of 3 April 2025

7) Data Ownership Data derived from AI outputs is owned by the State. All Prompts, Uploaded Content, and Outputs created using the AI tool shall remain the exclusive property of the State. The Vendor shall not use Prompts, Uploaded Content, or Outputs to train, retrain, tune, or improve any AI model. The Vendor shall not store, retain, or repurpose the State's data for any purpose other than providing the contracted services. The vendor shall not share or distribute the State's data with any third parties.