Winneshiek County Approves Policy Outlining Employee Use of Artificial Intelligence

Good local journalism takes time. Your support helps make it possible. DECORAH — Winneshiek County supervisors unanimously approved a policy establishing how county employees may use artificial intelligence (AI), allowing certain applications while restricting what information workers can enter into AI systems and requiring human review of the results. The policy establishes three levels of risk based on the sensitivity of the information being used. It identifies Microsoft Copilot as an approved tool for certain internal county work, prohibits several uses of AI and makes employees responsible for verifying information generated by the technology. It also makes clear that AI cannot independently make important decisions on the county's behalf, including decisions involving employment, benefits, legal matters, law enforcement or access to county services. IT-GIS Director Jon Lubke and System Administrator Sherman Watts discussed the policy during a Board of Supervisors meeting Monday morning. They said it had been in development for several months with input from County Attorney Andy Van Der Maaten. The discussion centered on how the county could use AI to improve productivity while protecting information handled by departments that work with personal or confidential records. The policy applies to all county employees using AI for county work, including stand-alone applications and AI features built into other software. It also calls for contracts with third-party vendors to include requirements for protecting county information. Three levels of information risk The policy's central feature is a three-tier system that determines which AI tools employees may use based on the information they intend to submit. High risk: Sensitive or protected information Employees may not enter sensitive, confidential or protected information into an AI tool unless the county has specifically approved the tool for that type of information and appropriate security and privacy safeguards are in place. Examples include Social Security numbers, medical and health records, confidential personnel information, sensitive financial information, law enforcement records and other information protected by law or confidentiality requirements. The policy specifically references information protected by the Health Insurance Portability and Accountability Act, commonly known as HIPAA, and Criminal Justice Information Services, or CJIS, requirements. Approval for one type of information does not automatically authorize a tool's use with another. Employees are instructed not to enter information if they are unsure whether a tool is approved. Moderate risk: Internal county information This category includes nonpublic county business information, such as routine emails, internal documents, meeting notes and reports. Employees may use county-approved AI tools for tasks such as drafting documents, creating presentations, summarizing communications, analyzing data and automating routine work. The policy identifies county-managed Microsoft Copilot within the county's Microsoft 365 Government Community Cloud environment as the approved tool for specifically authorized moderate-risk uses. Employees must use their county-managed accounts and contact the Information Technology Department for access. Additional tools may be approved in the future, but the policy does not give employees unrestricted permission to use Copilot for every internal document. Low risk: Public and general information Employees have the most flexibility when working with public information that does not contain sensitive county records. Permitted uses include summarizing publicly available information, brainstorming, conducting research and drafting general communications, provided the work relates to county responsibilities and complies with applicable laws and policies. The policy also prohibits employees from using AI tools restricted by the state of Iowa, including DeepSeek AI under the governor's Feb. 19, 2025, directive concerning Chinese AI and social media. Prohibited uses and decision-making Beyond restrictions on information, the policy outlines activities for which AI tools may not be used. Employees may not use AI to create or distribute false or misleading information intentionally, impersonate another person without authorization, bypass county security controls or disclose passwords and other security credentials. The policy also prohibits improperly disclosing confidential information, violating copyright or licensing requirements, breaking applicable laws or using AI in ways that could reasonably harm county systems, employees, operations or the public. Another key provision establishes that AI may assist employees but cannot independently make important decisions on the county's behalf. Those restrictions include decisions involving employment, employee discipline, benefits, legal matters, law enforcement and access to county services. Employees or county officials must review the relevant information and make the final decisions. Employees remain responsible for AI-generated work The policy warns that AI-generated information may be inaccurate, incomplete, outdated, biased or fabricated. Employees must review and verify AI-generated material before relying on it for county business, including checking facts, calculations, legal information and citations. The employee who uses AI remains responsible for the final work product. An AI-generated report or legal reference cannot be treated as reliable simply because a computer system produced it. The county will provide guidance and training to help employees understand the three information-risk levels, identify approved tools and use AI safely. Employees will be required to complete any AI-related training required by the county or their department. During Monday's discussion, county staff also referred to an approximately eight-minute instructional video prepared by an IT representative using AI tools. The video was described as a basic introduction to help employees understand the technology and its risks. The county may periodically review AI use to determine whether tools are secure, appropriate and consistent with the policy. It may restrict or discontinue a tool if it presents unacceptable security, privacy, legal or operational risks. Violations could result in employees losing access to AI tools or facing disciplinary action, up to and including termination, as permitted by county policies, employment agreements and law. The policy takes effect upon adoption and requires an annual review. Requests for changes or exceptions must be submitted in writing to the Board of Supervisors or its designee. Exceptions cannot authorize activities prohibited by law. Cybersecurity uses also discussed The board's discussion included a separate potential use of AI by county IT staff: testing the county's computer systems for security weaknesses. Watts described access to advanced AI models for cybersecurity work, including vulnerability testing and evaluating the county's security. He said the tools could save time and money and discussed an opportunity available to state and local governments. Watts said Winneshiek County had been approved for access and that other counties had been applying. The county had also presented information about the opportunity at an Iowa County IT conference in October. The discussion did not identify the cybersecurity models. The employee policy does not name those models as approved tools for processing high-risk county information. Instead, it establishes a separate approval process for any AI tool used with protected information. Watts said the technology is developing quickly and could affect existing security boundaries, making it important for the county to understand its capabilities and use it in a controlled way. The Board of Supervisors approved the AI usage policy unanimously, with a motion from Supervisor Mark Faldet and a second from Supervisor Mark Vick. Busy day? We've got you covered. Get local news delivered to your inbox.