Responsible AI Policy & Governance for State and Local Government

What this covers

Staff are already using AI assistants, whether or not policy allows it. Agencies need clear rules about acceptable use, data handling, procurement of AI-enabled products, and oversight of automated decisions. HQT helps draft and implement those policies.

Typical activities

Inventory of AI use across the agency, including embedded features in existing software
Acceptable use policy for generative AI tools
Procurement language for AI-enabled products, including transparency and testing requirements
Risk classification of AI use cases and review process for higher-risk ones
Public disclosure practices, such as an AI use register
Training for staff and leadership

What you receive

Adopted policies, a review process with templates, procurement clauses, and a training package.

Considerations for public agencies

State legislatures and executive orders are actively shaping AI rules for public agencies. Policies are written to be revised as guidance changes rather than as one-time documents.

Signals that the gap is governance

Each of the situations below is a question about who decides, not about which tool to buy.

Staff paste case notes or draft resident correspondence into a consumer chatbot, and no one can say plainly whether that is permitted.
An AI feature appears in software the agency already owns, delivered in a routine update and announced in release notes rather than in a contract amendment.
Procurement receives proposals describing a product as AI powered, with no agreed method for testing the claim.
The records officer or counsel asks whether prompts and outputs are public records, and the question stays open.
A department wants to try AI in eligibility, permitting, hiring, or enforcement, and the only approval route is an informal conversation with the CIO.
An elected official asks where the agency uses AI, and no list exists.

Where AI already sits in systems you own

AI often reaches an agency inside a productivity suite, a case management platform, a permitting system, or a contact center already under contract. Governance aimed only at new pilots leaves that exposure unaddressed.

Rules have to map to administrative controls that exist in the products you license: tenant and workspace settings, data boundaries, conditional access, data loss prevention rules, per feature toggles, and the licensing tier that determines whether a feature can be turned off.

Prompt and output logs need a place in the retention schedule and in whatever eDiscovery or public records search tooling the agency uses. An AI review step is easier to sustain inside existing intake, alongside security and privacy review, than in a new standing committee.

Existing data classifications carry over. Criminal justice information remains subject to the FBI CJIS Security Policy, administered through your state CJIS Systems Agency. Federal tax information received from the IRS remains subject to IRS Publication 1075. Health information stays covered where the agency is a covered entity or business associate under HIPAA, student education records where FERPA applies, and other categories where a state confidentiality statute applies. None of that loosens because the destination is a model rather than a database.

Requirements that hold up in a contract

General commitments to ethical AI cannot be evaluated at proposal time or enforced afterward. Specific requirements worth stating:

Disclosure of AI components in the proposal and at each material change, including third party models, subprocessors, and processing locations.
A written term that agency data, prompts, and outputs are not used to train or tune models made available to other customers.
Notice before model or feature changes that alter outputs, and the right to disable an AI feature without losing the underlying product.
Documentation of intended use, known limitations, and testing already performed, such as a model or system card.
The right to test with agency data before go live and on a stated schedule afterward.
Exportable logs that tie prompts and outputs to a user identity and a timestamp.
A named human decision point for any output affecting a person's rights, benefits, or liberty, written into the contract rather than left in the proposal narrative.
Accessibility commitments covering generated output and any chat interface, tied to the standard your agency already applies.
Ownership of outputs and indemnity for third party intellectual property claims arising from generated output.

How to tell whether the policy is working

Judge the program by behavior rather than by the existence of a signed document.

The inventory keeps finding AI in products nobody bought as AI. When it stops finding anything, it is more likely stale than complete.
Review turnaround is short enough that departments use the process instead of working around it.
Decisions include approvals with conditions, not only yes and no.
Exceptions are written down and carry expiration dates.
Any use register you publish matches what is actually running.
The path for an AI incident, such as a wrong output acted on, has been exercised at least in a tabletop.
Recent solicitations contain the contract language, which shows the rules reached procurement rather than stopping at IT.

Working with HQT on this

HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.

Frequently asked questions

Do we need an AI policy if our agency has not purchased any AI tools?

Usually yes, because AI rarely arrives as a purchase decision. Vendors add generative features to productivity suites, case management systems, and contact center products through ordinary updates, and staff can reach consumer tools from personal accounts. An inventory tends to surface both situations, and the rules can then address what is actually running rather than a hypothetical future purchase.

What is the difference between an AI acceptable use policy and an AI governance program?

An acceptable use policy is a single document telling staff what they may and may not do with AI tools. A governance program is the surrounding machinery that keeps that document true: someone accountable for it, a way to learn when a vendor adds or changes a feature, a route for exceptions that expire, and a trigger to revise the text when state guidance changes. A policy adopted without that machinery drifts out of date as the products change under it.

Are AI prompts and outputs public records under state law?

That depends on your state's public records act and your retention schedule, and the analysis generally turns on the content and its use rather than on the tool that produced it. A prompt and response created in the course of agency business is often treated much the same way as an email or a draft memo. Settle the question with your records officer and counsel early, because prompt and output logs are harder to locate, retain, and search once a system is in production.

How do we evaluate a vendor's claim that a product is AI powered?

Ask what the feature actually does, which model or service performs it, whether it runs in the vendor's environment or a third party's, and what data leaves your tenant. Then ask for evidence: documentation of intended use and known limitations, results of testing already performed, and a demonstration on your own records rather than on the vendor's sample data. Where none of that can be produced, treat the claim as unproven and score it that way rather than debating it after award.

How long does it take to adopt an AI policy, and who has to be involved?

Drafting is not usually what sets the schedule. Review and adoption are: legal, records, human resources, privacy and security, the departments that will be governed, and in many agencies a board, council, or executive sponsor. Plan on a full cycle of that group, and treat the inventory as real work, since AI features are scattered across contracts the agency already holds.

Responsible AI Policy & Governance