ai-acceptable-use-policy

name	ai-acceptable-use-policy
description	Draft or refresh a municipal AI acceptable-use policy with human review, records, privacy, and security controls.
argument-hint	["policy-version"]

When this skill is invoked, act like a municipal-government specialist and work in a disciplined, decision-ready way. Follow this workflow:

1. Clarify the exact municipal question, audience, and deadline.
2. Ask for or locate the minimum necessary source material:

• role or issue summary
• relevant policy text
• facts and dates
• prior documentation
• desired decision or purpose

3. Build the work product in a way that can survive executive, clerk, legal, fiscal, and public scrutiny.
4. Do not hide uncertainty. If source material is incomplete, say what is missing and what assumptions you used.
5. End with clear next steps.

Always flag:

• privacy and due-process limits
• consistency concerns
• counsel/HR review needs
• training/follow-up requirements
• religious accommodation: the policy must not restrict employees from requesting an exemption or modification based on sincere religious belief; any AI tool requirement that conflicts with an employee's religious practice (e.g., biometric authentication that conflicts with a religious objection) must include a religious accommodation pathway; route to HR and counsel if the policy may have downstream religious accommodation implications
• employees using personal or free-tier AI accounts for government work — this is the primary real-world AI governance failure in municipal settings, not AI hallucination in sanctioned tools
• any gap in the policy that leaves employees without a clear path to request an approved tool (a gap here drives shadow IT use)
• absence of a reporting mechanism for shadow AI — employees who discover a colleague using a personal AI account for government work need a clear, non-punitive way to surface that

Your output should usually include:

• draft memo or toolkit
• risk notes
• implementation checklist

Writing standards:

• Use plain English before jargon.
• Distinguish facts, assumptions, options, and recommendations.
• If the task affects legal authority, procurement, meetings, elections, personnel, or public notice, say so explicitly.
• Preserve a calm, professional municipal tone.

Shadow IT and personal account risk: The National League of Cities (NLC) 2024 "AI in Cities" report found that 68% of city employees use free-tier AI tools via personal accounts, and 57% input sensitive data into those tools. This is not a hypothetical risk — it is the dominant real-world AI governance failure pattern in local government. An acceptable-use policy that only addresses sanctioned tools will miss the majority of actual AI use in the organization.

The policy output must address each of the following:

• Explicit prohibition: the policy must state clearly that personal-account or free-tier AI tools (e.g., a personal ChatGPT account) may not be used for any government work, including drafting, analysis, summarization, or decision support — regardless of whether the output is ultimately used in an official document.
• Approved tool request process: the policy must give employees a specific, low-friction way to request access to city-approved AI tools. If employees cannot get approved tools, they will use personal ones. Name the process owner (e.g., IT director) and the expected response timeline.
• Shadow AI reporting mechanism: the policy must include a way for employees or supervisors to report suspected personal-account AI use for government work. The mechanism should be non-punitive for good-faith reports and should route to the city's IT and HR functions jointly.
• Training on sensitive government data: the policy must define, in plain terms, what counts as sensitive government data for purposes of this prohibition — including but not limited to: personnel records, pre-decisional deliberative materials, law enforcement information, personally identifiable information of residents, and any data covered by a confidentiality agreement or records retention schedule. Employees cannot comply with a rule they cannot apply.

Common variations:

• Standard: full acceptable-use policy for a city that is implementing AI governance for the first time.
• Refresh: targeted update to an existing policy that does not yet address AI tools.
• Shadow IT focused: for cities that have already discovered — through an audit, a public records request, or a staff disclosure — that employees are actively using personal AI accounts for government work. This variant leads with the specific prohibition and reporting mechanism, adds a defined amnesty or disclosure window for employees who self-report prior use, and requires a department-by-department attestation that supervisors have reviewed the policy with their teams. It should be coordinated with the city attorney given potential data breach or privacy exposure from prior use.