Pinellas_County_Artificial_Intelligence_Policy.pdf

Pinellas County

Artificial Intelligence Policy

Pinellas County Business Technology Services Artificial Intelligence (AI) Policy

Artificial Intelligence (AI) Policy

Pinellas County Artificial Intelligence (AI) Policy

Pinellas County Business Technology Services Technical Steering Committee

Revision History

Date Change Author Revision

12/3/2023 First Draft for Technical Services Committee AI Subcommittee Review

Bryan Zumwalt 1.0

1/15/2024 Final Draft for Full Technical Services Committee Review

Bryan Zumwalt 1.1

2/22/2024 Final AI Policy Adopted by BTS Board – February 22nd, 2024.

Bryan Zumwalt 1.2

Contributors:

Bryan Zumwalt, Chief Technology Officer, BTS Christopher Short, Chief Technology Officer, Clerk Jennifer Bryant, IT Director, Tax Collector David Palek, Enterprise Architect, Sheriff Rob Sullivan, Enterprise Architect, BTS

Owner:

Business Technology Services Board Jeff Rohrs, Chief Information Officer, BTS

Introduction

Pinellas County recognizes the transformative potential of artificial intelligence (AI) and its applications across various domains. This policy document outlines the principles and guidelines for the responsible use of AI within Pinellas County government. It is designed to ensure that AI technologies are used in a manner that promotes transparency, fairness, accountability, and the protection of individual rights. This policy outlines the following principles that shall be maintained as Pinellas County government introduces AI capabilities to its workforce:

a. Transparency: Pinellas County will strive to ensure transparency of AI technologies used for decision-making and significant communications or content creation. This includes providing clear information to individuals about the use of AI systems, their purpose, and the potential impact on their rights and freedoms.

b. Fairness: The use of AI technologies within Pinellas County will be guided by principles of fairness. Reasonable measures will be taken to prevent bias and discrimination in AI systems and to ensure that any future insights developed through the use of AI are free from unfair or unjust biases.

c. Accountability: Pinellas County will establish clear lines of accountability for the use of AI technologies. Responsible parties will be identified and held accountable for the development, deployment, and outcomes of AI systems.

d. Privacy and Data Protection: Pinellas County will prioritize the protection of individual privacy and personal data in the use of AI technologies. All applicable data protection laws and regulations will be adhered to, and appropriate safeguards will be implemented to protect sensitive information.

e. Security: AI systems implemented within Pinellas County will be designed and deployed with robust security measures to protect against unauthorized access, data breaches, and other security risks.

f. Ethical Considerations: Pinellas County will consider the ethical implications of AI technologies and ensure that they align with the values and goals of the community. The County will actively engage in ethical discussions when applicable and seek public input on the use of AI in sensitive areas.

1. Purpose The purpose of this artificial intelligence (AI) policy is to ensure responsible, legal, and ethical use of artificial intelligence technology across Pinellas County government. The guidance below defines acceptable and prohibited uses and outlines employee obligations related to the use, integration with or development of artificial intelligence models and applications.

2. Scope

This policy applies to all Pinellas County Government exempt and classified employees, contractors, consultants, temporary employees, and other workers in the following constitutional offices and appointing authorities:

• Business Technology Services

• Board of County Commissioners

• Clerk of the Circuit Court

• Tax Collector

• Sheriff

• Supervisor of Elections

• Property Appraiser

• Sixth Judicial Circuit

• Public Defender

• State Attorney

• Human Resources

• Human Rights

3. Definitions

3.1 Generative AI (GenAI) refers to an artificial intelligence technology that derives new versions of text, audio, or visual imagery from large bodies of data in response to user prompts. GenAI can be used in stand-alone applications, such as OpenAI ChatGPT or Google Bard, or incorporated into other applications, such as Microsoft CoPilot or Microsoft Office Suite.

3.2 Large Language Model (LLM) is a specific subset of GenAI that uses deep learning to understand and generate human-like text. LLMs use large neural networks that have been trained on extensive language datasets and can perform tasks like generating coherent text, translation, and summarization. LLMs can autonomously create text, resembling human writing, with significant implications for applications like natural language understanding and content generation. Due to their societal impact, LLMs require careful policies and regulations to ensure responsible deployment.

3.2 Hallucinations has become the term adopted by the AI community to describe how models will, from time to time, provide fictitious answers. The issue is not simply that the answers are wrong, it is that they are confident and convincing. Society has developed an endemic automation bias, humans favor suggestions from automated decision-making systems, often ignoring their own better judgment. Using output from AI tools without reviewing it for accuracy places the County at risk and may harm the reputation of Pinellas County government with citizens, employees and external entities.

3.3 Cybersecurity: The use of AI tools may introduce new opportunities for cyber-attacks.

Hackers can manipulate language models and other AI tools to give away information they shouldn’t, including personal or sensitive information. Implementing AI tools without the proper cybersecurity safeguards and best practices places County systems and data at a higher risk of attack.

3.4 Confidentiality and privacy: Confidential and sensitive information, including customer, employee, or others’ personal data entered into publicly available AI applications may leave residue inside the model that can become part of an output elsewhere afterwards, or used to (re)train new models. Thus, any customer or employee personal information, proprietary information or intellectual property, or otherwise confidential information submitted to AI tools could appear in other users’ output.

3.5 Model bias: AI tools incorporate any biases of the data sets that were used to train them.

Model output that is influenced by this modeling bias may make systematic errors or favor certain groups, leading to unfair or discriminatory outcomes that do not align with our organizations’ core values.

3.6 Intellectual property: AI models are often trained on large, publicly available datasets. The outputs may therefore contain copyrighted information, or others’ intellectual property. While ownership in many of these cases is unclear, the use of any materials that are not verified to be free of copyright protection may open the door to legal challenges for the County down the line.

3.7 Transparency risk: There is risk in not being transparent when AI plays a significant role in the creation process of content, especially when it has a high potential for influencing public trust or perception. Under these circumstances, not disclosing the presence of AI, or clarifying the AI’s role in the creation of the content may lead to loss of public trust or misinterpretation of the content which can damage trust in the information or the overall message it conveys.

3.8 Third-party risk: Data sent by Pinellas County government agencies to third parties could be used in the third party’s use of AI tools. For example, sensitive customer information is a potential risk if the organization uses an external software vendor that employs AI tools.

4. Acceptable and Prohibited Use Cases

The use of AI while performing work for Pinellas County Government shall be subject to approval by each individual constitutional officer or appointing authority in consultation with Business Technology Services and within the boundaries of this policy and applicable law.

Any violation of this policy or undisclosed use cases may result in disciplinary action.

5. Policy

For any use of AI applications, employees must adhere to the following:

5.1 To maintain the security of our data and IT systems, employees are prohibited from attempting to gain access to unapproved AI applications when using County systems or networks, conducting business on behalf of the organization, or when using public/private data.

To avoid potential data leaks or security incidents:

• Do not use company credentials, email addresses, or telephone numbers as a login to unapproved publicly available AI applications.

• Do not install non-approved Application Programming Interfaces (APIs), plug-ins, connectors, or software related to AI systems.

• Do not implement or use in any way code generated by AI on County systems without human review and oversight.

5.2 To maintain the confidentiality of the County’s sensitive information, including but not limited to employee and citizen personal information, County intellectual property, and copyrighted material, employees and contractors must only share information with approved personnel and only input sensitive information into AI systems approved to be used with protected and/or sensitive data. To maintain confidentiality:

• Do not input County data into non-approved generative AI applications.

• Do not input personal information (PII) of employees, citizens, or other third parties into any non-approved AI application.

• Do not input any County or personal data into any generative AI system without prior approval.

• Do not store sensitive data in any repository that may be used to train an AI system without approval for the express purpose of training the system.

• Do collect and input only the minimum amount of data necessary for the AI application to function effectively.

• Do anonymize data whenever possible before inputting it into AI systems.

5.3 To maintain transparency with citizens and employees and protect the County from claims against copyright infringement and/or theft of intellectual property, all AI generated content must be cited and reviewed if used for work purposes. To protect the County:

• Do clearly label any content where AI played a significant role in the creation process, such as writing most of the text or generating key visuals. Include the AI application, and its role in the creation in a way that is recognizable to the consumer.

• Do maintain an updated record of instances of AI use for work purposes and be able to share those records with your manager or other authorized company personnel upon request.

• Do Not use any AI generated output that contains material suspected to be under copyright protection in internally or externally facing content.

5.4 To protect our employees and citizens from harm, and to protect the County from reputational damage, employees must use AI pursuant to each constitutional office or appointing authorities’ code of conduct and non-discrimination policies. AI-created content that is inappropriate, discriminatory, or otherwise harmful to our employees or citizens must not be used for work purposes. Such use could result in disciplinary action.

• Do review output of AI applications to make sure it meets standards for principles of equity, ethics, and appropriateness.

• Do not use any output that discriminates against individuals on the basis of race, color, religion, sex, national origin, age, disability, marital status, political affiliation or sexual orientation.

• Do not use AI applications to create text, audio, or visual content for purposes of committing fraud or to misrepresent an individual’s identity.

• Do perform due diligence to confirm the validity and appropriateness of the data before presentation or incorporation in other materials.

5.5 All employees and contractors are expected to comply with all current or future applicable laws and regulations regarding the use or development of AI content or tools.

5.6 All employees are expected to report instances of non-compliance with this policy following their constitutional reporting process, to their constitutional officer or appointing authority if not otherwise guided by a reporting process, and designated security contacts. Employees are encouraged to speak up if they witness misconduct.

6. Failure to Comply Users who fail to comply with any provision of this Policy may be subject to disciplinary action.

Violations by contractors may be considered breach of contract and result in removal from assignment. Any AI-related activities which appear to violate applicable laws will be reported to external law enforcement.

If monitoring systems and processes detect a possible policy violation or if a user reports a possible policy violation that put the cybersecurity of the County at risk, the suspect event should be processed using appropriate security incident response processes (see the BTS Cybersecurity Incident Response Policy).