Generative AI Use Policy

Generative AI Use Policy

PREPARED BY INFORMATION TECHNOLOGY DEPARTMENT

CITY OF GREENSBORO | INFORMATION TECHNOLOGY

Generative AI Use Policy City of Greensboro, NC Information Technology Department

Table of Contents

DOCUMENT INFORMATION............................................................................................................................................ 2

PURPOSE .............................................................................................................................................................................. 2

SCOPE ................................................................................................................................................................................... 3

ROLES AND RESPONSIBILITIES ..................................................................................................................................... 3

CORE POLICY: MANAGED AND APPROVED TOOLS ONLY .....................................................................................3

APPROVED AI TOOLS ....................................................................................................................................................... 4

Choosing the Right Tool ................................................................................................................................................... 4

Tool Details ....................................................................................................................................................................... 4

Copilot Chat .................................................................................................................................................................. 5

Copilot 365.................................................................................................................................................................... 5

ChatGPT ....................................................................................................................................................................... 5

Claude ........................................................................................................................................................................... 5

AI GENERATED IMAGES AND MATERIALS ................................................................................................................6

REQUESTING TOOLS FOR NICHE OR UNMET USE CASES.......................................................................................6

RULES FOR ALL AI TOOL USE........................................................................................................................................ 6

CONFIDENTIAL INFORMATION CATEGORIES ...........................................................................................................7

REPORTING, FEEDBACK, AND POLICY QUESTIONS ................................................................................................7

ENFORCEMENT & COMPLIANCE...................................................................................................................................7

EXCEPTIONS ....................................................................................................................................................................... 8

ACKNOWLEDGMENT ....................................................................................................................................................... 8

APPENDIX: GLOSSARY .................................................................................................................................................... 9

Generative AI Use Policy

2

DOCUMENT INFORMATION

Policy Name: Generative AI Use Policy Document Reference Number: GSO-AIUP-001 Version: 1.0 Effective from: 10/26/26

Document Change History and Revision Control

Sections Revised

Version

Description of Revision

Changed By

Date

Initial document creation, combining the Enterprise AI Guidance and Best Practices and Guidelines for ChatGPT and Similar AI Models documents into a single policy.

1.0

All

IT Department

10/26/26

PURPOSE

The purpose of this policy is to define the principles by which City of Greensboro employees, including full time staff, part-time staff, contractors, consultants, vendors, and temporary staff, will adhere to when using generative artificial intelligence (AI) tools for City business. This policy works alongside the City's Information Technology Acceptable Use Policy (GSO-ITAUP-007) to protect the confidentiality, integrity, and availability of City systems and information. This policy combines and replaces the prior Enterprise AI Guidance document and the Best Practices and Guidelines for ChatGPT and Similar AI Models document into a single, authoritative policy governing the use of generative AI chat tools by City staff.

SCOPE

This policy applies to all users of generative AI tools used for City business. Specifically, it includes:

• All employees, whether employed on a full-time or part-time basis, by the City of Greensboro

• All contractors, consultants, and third parties that work on behalf of the City of Greensboro

• Any individual who uses a generative AI tool, managed or otherwise, to conduct City business or process City information

ROLES AND RESPONSIBILITIES

Generative AI Use Policy

3

Function

Responsibility

Define and maintain the rules and guidelines outlined in this policy; evaluate and approve requests for AI tools; report non-compliance issues to the employee's manager and/or People & Culture.

IT Department / Cyber Security Team

Department Directors

Ensure staff in their department are aware of and follow this policy.

Employees, Contractors, and Consultants

Adhere to the rules and principles defined in this policy, including using only approved AI tools for City business and following the usage rules for all AI tools.

CORE POLICY: MANAGED AND APPROVED TOOLS ONLY

Any Generative AI tool used for City work must be a managed, IT-provisioned solution that has been approved by IT. Free or personal AI accounts, even for well-known products such as ChatGPT, Claude, or Gemini, do not carry the data protections required for City business and must not be used to perform City work or process City information.

Unmanaged and personal AI tools should never be used for City business. These consumer platforms:

• May use chat data to train their underlying models

• May share data with third parties

• May retain data even after deletion

Only accounts issued through IT and signed in with City credentials are considered managed and safe for City information. If you are currently using a free or personal AI tool for work purposes, transition to one of the approved tools below.

APPROVED AI TOOLS

The City currently supports four generative AI tools. Each is suited to different use cases, with its own feature set, cost, and approval process.

Tool

Cost

Approval

Best For

Copilot Chat

$0 - included

Jotform survey

General AI chat, Q&A, and document analysis

Added cost; quote provided

Director or designee approval

Office app integration (Outlook, Excel, Word, PowerPoint, Teams) and AI agents

Copilot 365

Added cost; quote provided

Director or designee approval

General-purpose AI tasks outside Copilot's scope

ChatGPT

Added cost; quote provided

Director or designee approval

Coding, workflow automation, agentic tasks, and large documents/codebases

Claude

Generative AI Use Policy

4

Choosing the Right Tool 1. Need AI for general writing, Q&A, or productivity tasks? -> Copilot Chat. Complete the Jotform survey to request access.

2. Need deep integration with Outlook, Excel, Word, PowerPoint, or Teams? -> Request Copilot 365.

3. Need a general AI tool that can do things Copilot cannot currently do? -> Request ChatGPT.

4. Have advanced coding or workflow automation needs? -> Request Claude.

5. Need something none of these four tools can do? -> Submit a Service Desk request . IT will review the request and guide you to the right tool, including evaluating new tools through the procurement process described under Requesting Tools for Niche or Unmet Use Cases.

Tool Details

Copilot Chat Microsoft Copilot Chat is the recommended starting point for all general users and is available at no additional cost.

• Cost: Included in the existing Office license

• How to access: Complete the Jotform survey

• Key features: General AI chat and Q&A; drafting, summarizing, and editing text; querying uploaded documents; image generation; generating meeting notes from transcribed or recorded meetings • Once approved, users must also complete the first of three Copilot training courses on the Brainstorm platform within 30 days to retain access Copilot 365 Microsoft Copilot 365 provides deep integration with Microsoft Office applications and suits users with more advanced Office needs.

• Cost: Provided as a quote upon request

• Approval required: Director or designee approval for software order

• How to access: Submit a software order Service Desk request

• Key features: Integrated AI assistance within Outlook, Excel, Word, and PowerPoint; automatic meeting notes when Teams meetings are recorded or transcribed; AI agents trained on organizational documents; AI notebooks for specialized, recurring tasks ChatGPT ChatGPT is a general-purpose AI chat application powered by OpenAI's GPT models. It may be appropriate when a use case requires broader AI capabilities than Copilot provides, or depends on specific OpenAI features not available through the City's Copilot tools.

Generative AI Use Policy

5

• Cost: Provided as a quote upon request

• Approval required: Director or designee approval for software order

• How to access: Submit a software order Service Desk request

Claude Claude is a general-purpose AI assistant with advanced capabilities for coding, workflow automation, and agentic tasks. It may be appropriate for writing, debugging, or refactoring code; automating multi-step workflows; or working with large documents and codebases that exceed what Copilot can handle. Claude also supports command-line access through Claude Code, making it a strong fit for developers and technical teams.

• Cost: Provided as a quote upon request

• Approval required: Director or designee approval for software order

• How to access: Submit a software order Service Desk request

AI GENERATED IMAGES AND MATERIALS

Using AI to create images for City social media, public posts, or other external communications is generally not recommended. Any AI-generated image or communications material intended for public use or internal distribution must be reviewed and approved by the Communications and Marketing Department before it is published or distributed. The City of Greensboro logo must remain in its original proportions and may only appear in green, white, or black. The logo may not be recreated, modified, or altered using AI. During normal business hours, allow up to four hours for review. If revisions are needed to meet City style or brand standards, additional time may be required. For review or guidance on AI-generated materials, contact your Communications Liaison or the Graphic Services Division.

REQUESTING TOOLS FOR NICHE OR UNMET USE CASES

The four tools above cover the large majority of City use cases. For any AI tool not listed in this policy, submit a Service Desk request. IT will:

• Assess the request against the City's data security and compliance requirements

• Determine whether an existing approved tool can already meet the need

• Pursue procurement of a new tool only when a genuine, niche gap remains

New tools approved through this process become part of the City's managed AI tool set and are subject to the same rules in this policy. Employees must not bypass this process by using an unapproved tool while a request is pending.

Generative AI Use Policy

6

RULES FOR ALL AI TOOL USE

The following rules apply regardless of which approved tool is being used.

• Never upload confidential information - see Confidential Information Categories for examples.

• Never upload City operational or process documents, such as SOPs, SCADA documents, architectural diagrams, configuration documents, or operational documents related to Police, Fire, or GM911.

• Do not use AI tools to search for private information about employees or residents.

• Never use AI tools for illegal or fraudulent activity. The City is held liable for activities performed using its IT resources.

• Do not use AI tools to obtain personal, legal, or medical advice.

• Verify AI-generated output before relying on it. Responses may be inaccurate, or content may be protected by copyright and unusable without authorization. • Do not click links provided in AI responses. Some may lead to malicious websites intended to compromise credentials. Confirm with the Cyber Security team before clicking any AI-provided link. • Include a disclaimer on AI-generated content used in official work so recipients know it was AI assisted and may require verification. • All interactions with approved AI tools are archived and may be subject to public records requests. Be mindful of what is entered into any AI system.

CONFIDENTIAL INFORMATION CATEGORIES

The categories below give concrete examples of the confidential information referenced in Rules for All AI Tool Use and must never be entered into any AI system.

Category

Examples

Social Security numbers

•

• Driver’s license, state ID, and passport numbers • Taxpayer and immigration ID numbers • Date of birth, when paired with a name • Login credentials (passwords, PINs, security answers — SSO sign-in to approved tools excluded)

PII (Personally Identifiable Information)

• Medical records, diagnoses, and treatment history • Health insurance policy and member numbers • Prescription information • Mental health and substance-use records • Workers’ comp and disability claim details

PHI (Protected Health Information)

Generative AI Use Policy

7

Credit and debit card numbers

• • •

Card expiration dates CVV and security codes

PCI (Payment Card Information)

• Cardholder name, when stored with the card number • Magnetic stripe or chip data and card PINs

REPORTING, FEEDBACK, AND POLICY QUESTIONS

Employees are encouraged to provide feedback on AI systems and to report issues, questions, or concerns through the IT ticketing system. The IT department serves as the primary point of contact for AI-related questions.

ENFORCEMENT & COMPLIANCE

Any violation of this policy may lead to disciplinary action, up to and including dismissal from employment. The disciplinary action will depend upon the violation and be subject to the discretion of the employee's supervisor/manager in accordance with Personnel Policy H-1 Discipline Without Punishment (DWP) Policy. The Fire and Police Departments have their own corrective action processes. It is the responsibility of City of Greensboro employees, contractors, and consultants to ensure that the policy described in this document is followed. To support compliance, the IT Department will use the following process to identify use of unapproved AI tools and respond to potential violations: 1. Review of network logs - The IT Department will review Domain Name System (DNS) and related network logs to identify traffic from City devices and networks to AI tools that are not approved under this policy. 2. Finance audits - The IT Department will work with the Finance Department to review purchasing records, including purchasing card (P-Card) transactions and reimbursement requests, to identify purchases of AI tools or subscriptions that have not been approved under this policy. 3. Monthly reporting - The IT Department will compile the results of these reviews into a monthly report provided to Senior IT leadership. 4. Notification of department heads - When potential violations are identified, the IT Department will inform the head of the affected department so that the matter can be addressed with the employee, contractor, or consultant in accordance with this policy and applicable personnel policies. 5. Escalation to Cyber Security - Where appropriate, the matter will be escalated to the Cyber Security Team, which is authorized to block access to unapproved AI tools and to limit or revoke an employee's, contractor's, or consultant's access to AI tools for non-compliance with this policy. Use of a personal or individually paid AI account for city business, or as a means of accessing tools not approved under this policy, is prohibited. Employees are expected to comply with this policy regardless of the specific monitoring or detection methods in place at any given time. Compliance with this policy relies both on technical monitoring and on each employee's, contractor's, and consultant's individual responsibility to follow the policy as written.

Generative AI Use Policy

8

EXCEPTIONS

Requests for exceptions to this policy may be granted where adequate compensating controls are in place. Requests must be submitted in writing to the Cyber Security Team for review and approval and must include the following details:

1. Purpose for requesting the exception

2. The risk to the City if the exception is granted

3. Mitigation controls that have been implemented to address that risk

4. End date for the exception

ACKNOWLEDGMENT

Employees remain subject to monitoring when using City systems, including AI tools accessed through City accounts. Communication and content entered into AI tools should not be considered private. Everything entered into an approved AI system may be subject to release pursuant to a public records request or a court order, and I have no expectation of privacy in that content. Acknowledgment of the City's Acceptable Use Policy constitutes acknowledgment of this Generative AI Use Policy.

Generative AI Use Policy

9

APPENDIX: GLOSSARY

Term

Definition

Computer systems capable of performing tasks typically associated with human intelligence, such as learning, reasoning, and problem solving. Most commonly used as shorthand for generative AI systems.

AI (Artificial Intelligence)

ChatGPT

A generative AI chat program owned by OpenAI.

A generative AI assistant developed by Anthropic, with capabilities for coding, workflow automation, and agentic tasks.

Claude

Microsoft's security-focused AI assistant. Data sent to Copilot stays within the City's secure Microsoft tenant and is not used to train the underlying model.

Copilot

A subset of artificial intelligence that produces text, images, video, or other content based on patterns learned from training data.

Generative AI

An AI response that contains inaccurate, incomplete, or non-factual information, sometimes delivered in a confident or authoritative tone.

Hallucination

The underlying technology behind generative AI systems such as ChatGPT and Claude, trained on large volumes of data to predict statistically relevant responses. An AI application provisioned and administered by IT under a City account, subject to the data protections and contractual terms negotiated by the City. Information such as names, Social Security numbers, financial information, bank account numbers, and credit card information belonging to individuals or organizations.

LLM (Large Language Model)

Managed / Approved Tool

PII (Personally Identifiable Information)

A free or personal-account AI tool not provisioned by IT. These tools do not carry the City's data protections and should not be used for City business.

Unmanaged / Personal AI Tool

Generative AI Use Policy

10