WVOT-PO1035_Acceptable_Use.pdf

Generative Artificial Intelligence Acceptable Use Policy: WVOT- PO1035 Issued by the Chief Information Officer on 10/07/2026.

OPR: WVOT Operations Division

COMPLIANCE WITH THIS POLICY IS MANDATORY

Publications are available online at https://sites.google.com/wv.gov/othub/policy-governance/ot-policies

Questions and change recommendations related to this publication shall be directed to this publication's Office of Primary Responsibility (OPR). This policy shall be reviewed every year to ensure continued alignment with current legal, operational, and strategic requirements. Revisions will be undertaken as necessary.

1. PURPOSE

This policy establishes and defines the acceptable use of generative Large Language Model (LLM) and Artificial Intelligence (AI) systems, based on preliminary findings from the WV Task Force on AI, examples of such systems include ChatGPT, Copilot, Google Gemini, and Grammarly. This policy applies exclusively to generative AI systems.

2. SCOPE

2.1. This policy applies to all departments, including agencies, boards, authorities, and commissions, within the Executive Branch of West Virginia that utilize or have access to state-provided resources.

2.2. An agency may impose additional restrictions on employees' use of AI in the workplace.

2.3. An agency cannot allow exceptions to this policy unless it receives approval from WVOT.

2.4. This policy does not replace or override more restrictive federal, state, and local policies, rules, statutes, or ordinances that apply to state agencies and employees.

3. CAPABILITIES OF GENERATIVE ARTIFICIAL INTELLIGENCE (AI)

3.1. Generative AI and LLMs offer a diverse array of business capabilities, empowering employees to concentrate on larger objectives and creative strategies while utilizing these tools for writing and research support. Examples of such capabilities include:

3.1.1. Research: Investigating various topics and referencing both web-based and physical sources for reliable information.

3.1.2. Text Generation: Producing well-structured, meaningful content, such as articles, stories, or responses tailored to specific contexts.

3.1.3. Image Creation: Designing artistic or realistic visuals based on descriptive text inputs.

https://sites.google.com/wv.gov/othub/policy-governance/ot-policies

Artificial Intelligence Acceptable Use Policy

WVOT-PO1035 Issue Date:06/01/2026 Revised: New Policy

3.1.4. Video and Audio Production: Generating customized videos, music compositions, or sound effects to meet specific needs.

3.1.5. Code Generation: Assisting with software development tasks by creating or refining code.

3.1.6. Data Analysis: Interpreting, summarizing, and visualizing complex data sets effectively.

3.1.7. Personalization: Adapting recommendations, content, or user experiences to align with individual preferences.

3.1.8. Creative Assistance: Supporting creative projects like writing, designing, or composing music.

3.2. These capabilities represent a transformative approach to productivity, enabling seamless collaboration between human ingenuity and AI support.

4. POLICY - GUIDELINES FOR GENERATIVE AI

4.1. To ensure security and privacy of state information, WVOT must approve any Generative

AI software used on the state network or state device.

4.2. Employees are only allowed to use West Virginia Office of Technology (WVOT)’s Approved Generative AI Software.

4.2.1. Link to WVOT’s List of Approved Software

4.2.2. A removal from the list takes effect upon written notice to agencies, followed by a transition period of thirty (30) days.

4.3. The state retains all rights, ownership, and intellectual property to data used through Approved Generative AI Software.

4.4. When accessing Approved Generative AI Software, employees must use a state device and log in with the state email address and user account associated with their employee identification number. Subject to the exceptions in Section 2.4 of this Policy, no restrictions apply to the types of data used.

Aside from the exceptions cited in Section 2.4 of this Policy, there are no restrictions on the type of data an employee may use in Approved Generative AI Software as long as the employee logged into a state device with a state user account associated with their employee identification number.

4.5. Employees are strictly prohibited from entering non-public or sensitive information into unapproved AI tools, search engines, and LLMs. For purposes of this section, non-public https://sites.google.com/wv.gov/othub/policy-governance/artificial-intelligence#h.l4f51yak9isj

WVOT-PO1035 Issue Date:06/01/2026 Revised: New Policy or sensitive information means data classified above Level 1 – Public under the WVOT Data Classification Policy.

4.6. IMPORTANT: The State only controls and protects information used on Approved Generative AI Software, when the employee uses their state login. Therefore, any data used or obtained through an alternative unapproved Generative AI Software or by an employee who has not logged on with their state login is in violation of this policy.

4.7. Generative AI is a valuable resource which, when used correctly, can increase efficiency and accuracy within state government. Employees are not discouraged from using Approved Generative AI Software or LLMs. Employees are, however, responsible for how they use the results of Generative AI or LLMs, and must balance such use with careful, thoughtful human review.

4.8. Employees are prohibited from using Generative AI or LLMs for the following purposes:

4.8.1. Allowing AI to make consequential decisions without human review.

4.8.2. Providing legal or policy advice without proper data validation or consultation. All governmental attorneys must comply with the Legal Ethics Opinion 24-01 on artificial intelligence, as issued by the West Virginia Office of Disciplinary Counsel.

4.8.3. Creating malicious or intentionally misleading content (including but not limited to deepfakes).

4.8.4. Impersonating a government official.

4.8.5. Adopting AI-generated meeting notes or minutes without thorough human review and manual editing. However, an employee can request AI-generated meeting notes for their own use without adopting or reviewing if the meeting notes are not shared with others.

4.8.6. Finalizing any work product of the agency without human review.

5. RESPONSIBILITIES

5.1. Employees must follow all existing policies, including but not limited to, Information

Security Policy (WVOT-PO1001).

5.2. Employees must follow all state Privacy Policies, located here WV State Privacy Office Privacy Policies and report all privacy incidents immediately by following the procedures found on the State Privacy Office website at WV State Privacy Office Incident Response Page and submitting an incident report using the WVOT’s Online Reporting System form.

5.3. Agency-level AI restrictions can be more, but not less restrictive than this policy.

https://storage.googleapis.com/msgsndr/Rgd68xOkcVdteTsBkf6O/media/667ac9c219bb7a1f7a4df4c2.pdf https://storage.googleapis.com/msgsndr/Rgd68xOkcVdteTsBkf6O/media/667ac9c219bb7a1f7a4df4c2.pdf https://drive.google.com/file/d/1wkFvstqVtM3mvBfX2By-m_bdhv0GRJ60/view https://drive.google.com/file/d/1wkFvstqVtM3mvBfX2By-m_bdhv0GRJ60/view https://brim.wv.gov/privacy/privacypolicies/Pages/default.aspx https://brim.wv.gov/privacy/privacypolicies/Pages/default.aspx https://brim.wv.gov/privacy/incident-response https://brim.wv.gov/privacy/incident-response

WVOT-PO1035 Issue Date:06/01/2026 Revised: New Policy

5.4. All agency AI initiatives, projects, deployments, and acquisitions of new generative AI or LLM tools require approval through CIO Review. An individual employee’s use of an already-approved tool does not require separate review.

https://technology.wv.gov/nonav/policies/cio-19-001

5.5. Employees are responsible for the accuracy of the final product. They must check responses and final products for errors and bias to ensure there are no hallucinations or inaccurate statements

5.6. Employees are permitted to use AI only in accordance with the WVOT Artificial Intelligence Code of Ethics Policy.

5.7. Agencies must ensure all employees complete standard training on this policy and related WVOT Acceptable Use and Information Security policies, provided centrally through WVOT-administered KnowBe4 and LMS modules. It is the agency's responsibility to communicate the information in this policy to all personnel by current employee training and its incorporation into the orientation process for all new employees.

5.8. Agencies must enforce this policy and other applicable laws, rules, and policies.

5.9. Appropriate action will be taken against individuals who violate these terms, up to and including termination of employment and notifying law enforcement of potential criminal behavior.

6. COMPLIANCE MONITORING AND AUDIT OVERSIGHT

6.1. Verification of Compliance: Use of generative AI tools on state resources is subject to monitoring and audit by WVOT and individual agencies to ensure adherence to security protocols and this policy.

6.2. AI prompts, inputs, and chat histories generated through state networks or on state devices remain state property and may be accessed by the state for administrative review, internal audit, or legal oversight, subject to the retention and exemption provisions in Section 7.

6.3. Employees are prohibited from using AI Generative Software owned by the state for personal gain.

6.4. Agency Oversight: Agencies must conduct periodic reviews of AI-assisted work products to verify that human oversight and data protection standards are being met.

7. PUBLIC RECORDS, DELIBERATIVE PROCESS, AND RECORD RETENTION

7.1. AI chat histories, search prompts, notes, working session logs, and session outputs are designated as Transitory Records with minimal administrative value, regardless of whether the employee saves the results for later use.

https://technology.wv.gov/nonav/policies/cio-19-001

WVOT-PO1035 Issue Date:06/01/2026 Revised: New Policy

7.2. Because they are transitory records, AI chat histories, search prompts, notes, working session logs and session outputs do not constitute state records or public records under the Records Management and Preservation of Essential Records Act (W. Va. Code § 5A-8-1 et seq.) or the West Virginia Freedom of Information Act (W. Va. Code § 29B-1-1 et seq.), and do not have to be managed, retained, or produced in accordance with state records retention schedules, policies, or procedures.

7.3. Until an AI output has been reviewed, adopted, and incorporated into a final document by a State employee, AI chat histories, prompts, notes and session outputs are pre-decisional internal memoranda within the meaning of West Virginia Code 29B-1-4(a)(8) and are exempt from disclosure on that basis.

7.4. However, if the outcome of a generative AI search is used in another document which would normally be considered a public record, then the resulting document may be a public record, subject to any exemptions set forth in West Virginia Code § 29B-1-4.

7.5. The following examples are illustrative, not exhaustive, of when generative AI becomes a public record:

7.5.1. An employee uses generative AI to conduct research, compile data, or extract information, which the employee later uses to draft an agency report. The research conducted using generative AI is not a public record, but the resulting report is, even if it incorporates portions of the generative AI research.

7.5.2. An employee uses generative AI to take notes of a virtual meeting. The employee reviews the results, makes edits and clarifications, and then sends the updated notes to all the participants of the meeting. The original generative AI notes, as retained solely by the employee, are not public records. The resulting document, as shared with others, may be.

7.5.3. An employee uses generative AI to create an illustrative graphic. The illustrative graphic is not significantly altered and is shared with the public. The graphic is a public document, even though it was not significantly edited or modified.

8. PUBLIC DISCLOSURE AND CONTENT INTEGRITY REQUIREMENTS

8.1. Public Disclosure, Media Labeling, and Accessibility: Agencies must clearly disclose to the public when public-facing content, including images, audio, and video, is created using generative AI. Visual and audio media must include a visible watermark or prominent label identifying it as AI-generated to prevent misinformation. For these purposes, an “image” does not include an illustrative chart, graphic, cartoon, or other item which is clearly not a photograph.

8.2. Public AI Text & Documents: Written public materials (e.g., press releases, public notices, web copy) should be identified as AI-generated–whether by visible watermark or text–when the final public document was created by generative AI, and the material constitutes a final product that was not subjected to meaningful human input or review.

WVOT-PO1035 Issue Date:06/01/2026 Revised: New Policy

Informal documents or communications, such as internal reports, interdepartmental memorandums, and emails, do not constitute “public materials” for the purposes of this subsection.

8.3. ADA Compliance: All AI-generated content shared with the public must fully comply with the Americans with Disabilities Act (ADA) and the Web Content Accessibility Guidelines (WCAG). Depending on the type of content, this may require the inclusion of a machine-readable watermark, which does not have to be publicly visible.

9. RELEVANT MATERIALS AND DOCUMENTS

9.1. This policy is consistent with the following federal and state authorities:

9.1.1. Artificial Intelligence Code of Ethics Policy WVOT-PO1034

9.1.2. W. Va. Code §5A-6-9. WV Task Force on Artificial Intelligence

9.2. WVOT List of Approved and Prohibited Generative AI Software

10. PROCUREMENT AND VENDOR RISK MANAGEMENT

10.1. Vendor Risk Assessment: Prior to the acquisition of any generative AI tool or service, a mandatory Algorithmic Impact Assessment (AIA) must be completed. This assessment shall determine the system's Risk Tier (1, 2, or 3) as defined in WVOT-PO1034 and ensure the vendor complies with state data classification standards and security protocols.

10.2. Data Hosting and Privacy: Contracts with AI vendors must explicitly prohibit the use of state-provided data for training the vendor’s public models and must ensure data is hosted in accordance with state security requirements.

10.3. Licensing Compliance: Agencies must ensure that AI software licenses explicitly grant the state the right to use generated output for government purposes without additional royalty or copyright restrictions.

10.4. Intellectual Property and Data Ownership: All outputs, including but not limited to text, code, images, and data visualizations, generated by the System during the performance of state business are "works made for hire" and shall remain the exclusive property of the State of West Virginia. Vendors grant the state a perpetual, irrevocable, royalty-free, and non-exclusive license to use, modify, and distribute any AI-generated content. Vendors are strictly prohibited from using state-provided data, prompts, or outputs to train, refine, or improve their public or proprietary models without the express written consent of the

WVOT.

https://code.wvlegislature.gov/5A-6-9/ https://sites.google.com/wv.gov/othub/policy-governance/artificial-intelligence#h.l4f51yak9isj

WVOT-PO1035 Issue Date:06/01/2026 Revised: New Policy

11. DEFINITIONS

11.1. Approved Generative AI Software: Generative AI tools and LLM applications listed on WVOT’s Approved Software Registry that meet state security standards and have been formally evaluated, risk-assessed, and authorized by the West Virginia Office of Technology (WVOT) for official state use.

11.2. AI prompt: The initial text, document, or data payload submitted by a user to an Artificial Intelligence interface to generate a response. Prompts entered by state personnel must comply with all state data classification, privacy, and ethics guidelines.

11.3. Algorithmic Impact Assessment or AIA: A formal evaluation process used to identify and mitigate the potential risks of an automated system.

11.4. Artificial Intelligence or AI: The simulation of human intelligence processes by machines, especially computer systems. These processes include learning, reasoning, and self-correction.

11.5. AI Council: A formal, cross-functional committee within the state government that is delegated the authority to establish, enforce, and oversee the AI governance framework.

11.6. Application Programming Interface or API: A set of defined rules that enable different applications to communicate with each other.

11.7. Consequential Decision: A decision or recommendation made with the assistance of AI that significantly impacts a citizen’s access to, or the cost of, state-managed benefits, civil liberties, or employment opportunities.

11.8. Deepfakes: Synthetic media in which a person in an existing image or video is replaced with someone else's likeness. Deepfakes are often created using artificial intelligence techniques, particularly deep learning.

11.9. Generative AI: An umbrella term for artificial intelligence models—including all related software, tools, and solutions—designed to create new content such as text, images, audio, video, or code. This encompasses standalone computer programs and specific applications that assist users in performing creative tasks, as well as comprehensive platforms and frameworks utilized to address specific business needs and manage enterprise deployments.

11.10. Hallucinations: False information or inaccurate data generated and confidently presented by generative AI.

11.11. Health Insurance Portability and Accountability Act or HIPAA: A federal law that establishes national standards for the protection of sensitive patient health information (a type of PII that includes health status, provision of health care, or payment for health care information) by all Covered Entities and their Business Associates. HIPAA mandates the

WVOT-PO1035 Issue Date:06/01/2026 Revised: New Policy proper use and disclosure of PHI and requires technical, administrative, and physical safeguards to ensure the confidentiality and integrity of electronic PHI (ePHI).

11.12. Large Language Model or LLM: A type of generative AI that is an artificial intelligence tool which can recognize and generate text, among other tasks. LLMs are trained on vast amounts of text data.

11.13. Model Training: The process of feeding data to a machine learning model to enable it to learn patterns and make predictions or classifications.

11.14. Office of Primary Responsibility or OPR: The department or individual accountable for a specific process or area.

11.15. Personally Identifiable Information or PII: Any information that can be used to distinguish or trace an individual’s identity, such as name, social security number, or biometric records.

11.16. Privileged Information: Information that is legally protected from disclosure, such as attorney-client privilege or doctor-patient confidentiality.

11.17. Public LLMs: Large Language Models that are accessible to the general public, often through web interfaces or APIs, for various text-based tasks.

11.18. Risk Tiers: A classification framework used to align the risk level of an application with the required level of oversight and the necessity of an AIA. Risk tiers range from Tier 1 to Tier 3 where Tier 1 is the lowest risk and Tier 3 the highest.

11.19. System: A combination of hardware, software, and procedures necessary to support data. A server may have multiple systems, and a system may require multiple servers.

ArtificialIntelligenceAcceptableUsePolicy