Generative AI Use Policy

Credit and debit card numbers

• • •

Card expiration dates CVV and security codes

PCI (Payment Card Information)

• Cardholder name, when stored with the card number • Magnetic stripe or chip data and card PINs

REPORTING, FEEDBACK, AND POLICY QUESTIONS

Employees are encouraged to provide feedback on AI systems and to report issues, questions, or concerns through the IT ticketing system. The IT department serves as the primary point of contact for AI-related questions.

ENFORCEMENT & COMPLIANCE

Any violation of this policy may lead to disciplinary action, up to and including dismissal from employment. The disciplinary action will depend upon the violation and be subject to the discretion of the employee's supervisor/manager in accordance with Personnel Policy H-1 Discipline Without Punishment (DWP) Policy. The Fire and Police Departments have their own corrective action processes. It is the responsibility of City of Greensboro employees, contractors, and consultants to ensure that the policy described in this document is followed. To support compliance, the IT Department will use the following process to identify use of unapproved AI tools and respond to potential violations: 1. Review of network logs - The IT Department will review Domain Name System (DNS) and related network logs to identify traffic from City devices and networks to AI tools that are not approved under this policy. 2. Finance audits - The IT Department will work with the Finance Department to review purchasing records, including purchasing card (P-Card) transactions and reimbursement requests, to identify purchases of AI tools or subscriptions that have not been approved under this policy. 3. Monthly reporting - The IT Department will compile the results of these reviews into a monthly report provided to Senior IT leadership. 4. Notification of department heads - When potential violations are identified, the IT Department will inform the head of the affected department so that the matter can be addressed with the employee, contractor, or consultant in accordance with this policy and applicable personnel policies. 5. Escalation to Cyber Security - Where appropriate, the matter will be escalated to the Cyber Security Team, which is authorized to block access to unapproved AI tools and to limit or revoke an employee's, contractor's, or consultant's access to AI tools for non-compliance with this policy. Use of a personal or individually paid AI account for city business, or as a means of accessing tools not approved under this policy, is prohibited. Employees are expected to comply with this policy regardless of the specific monitoring or detection methods in place at any given time. Compliance with this policy relies both on technical monitoring and on each employee's, contractor's, and consultant's individual responsibility to follow the policy as written.

Generative AI Use Policy

8