As our world evolves to include the assistance of Artificial Intelligence (AI), it is crucial that municipalities have a framework for the ethical, transparent, and effective use of AI. AI can help increase efficiency by automating routine tasks. It can also enhance service quality and speed using chatbots. There are also many risks – data privacy, legal compliance, cyber security, and bias to name a few – which need to be managed. This bulletin will address how your municipality can create an AI use policy that serves to build public trust, mitigate risks, ensure compliance, and guide innovation.
When creating an AI policy, the municipality should consider the following aspects:
Set Clear Principles & Values
Define the guiding values your AI policy will uphold. Be sure to include legal and ethical considerations. Common principles include:
- Transparency and Accountability
- Disclose when AI is being used (i.e. In public facing documents).
- Maintain audit logs and explainability measures.
- Privacy and Security
- Prohibit AI from using personal or sensitive municipal data.
- Require vendor reviews of data handling, retention, and compliance.
- Fairness and Bias Mitigation
- Evaluate the systems for bias detection and human-centered design.
- Include human oversight in decisions that impact employees or residents.
- Human Decision Making
- AI should support your operation, not run it. Staff need to monitor and review all AI related functions and remain responsible for the results.
- Environmental Consideration
- AI systems can have adverse effects on our environmental footprint. AI systems that are more energy efficient should be preferred.
Scope and Governance Structure
Describe what AI tools and uses will be permitted in your municipality – for example, chatbots to answer common questions from residents or data analysis tools.
- Covered Systems
- Include generative AI (chatbots, text to image, large language models etc.).
- Stakeholders
- Require department approval for all AI tool procurement and usage.
- Create an AI governance committee.
Risk Assessment and Categorization
Risk-based classification should be used to inform your decision-making process.
- Low Risk
- This includes internal tasks such as coding invoices, or for help drafting memos.
- Medium/High Risk
- This includes public-facing communication, legal decisions, hiring policies, and health/ safety related systems.
- High-risk application would require more scrutiny, oversight and human interaction.
Procurement and Vendor Management
Municipalities need to have a process for reviewing and selecting a vendor for their AI tools. Consideration of the following should be given:
- Tool Approval Process
- Conduct security, privacy and fairness assessments prior to procurement.
- Create and maintain an inventory of all AI tools being used.
- Contract Requirements
- Enforce vendor compliance ensuring local, provincial and federal standards are met.
Transparency and Public Engagement
Municipalities should clearly indicate where AI is involved, especially in public forums and meetings. Internally, it is equally important to build trust with your teams. Noting bias testing, timelines and goals will help build that trust.
Monitoring, Auditing, and Evaluating
AI needs to be consistently monitored and evaluated, as it is subject to ‘model drift,’ which is when AI gives inaccurate predictions or information due to changes in data. It is crucial that human oversight is used to ensure the AI tool is still giving accurate information.
The municipality should also anticipate errors or bias and have procedures and policies in place to identify and mitigate issues.
Training
The municipality should have consideration for training and education of employees, elected officials, and volunteers. This training should include policy changes, how and when to utilize AI tools, and the importance of human verification of the information used.
With a transparent, accountable, and well-governed AI policy, your municipality can harness the benefits of using AI while safeguarding against risks and maintaining the public’s trust.
If you have any questions, please contact your RMA Risk Advisor at risk@rmainsurance.com.