158
City of Anaheim Administrative Regulation
CHAPTER 1 -ADMINISTRATIVE
Subject:Artificial Intelligence A.R. 158
Appropriate Use PolicyIssue Date: June 10, 2026
Revised:
Page (1) of (6)
Purpose:
The purpose of this administrative regulation is to:
Establish clear guidelines for the responsible and ethical use (otherwise referred to as
appropriate use) of artificial intelligence (AI) tools by city users. As new technologies
such as AI become integrated into our public sector work, it is essential to ensure that
their use aligns with appropriate legal standards, protects privacy, maintains public trust,
and promotes the city’s operational efficiency. This administrative regulation provides
the framework for city users to use AI responsibly while ensuring compliance with these
standards. AI shall only be used as a resource to support decision-making processes and
tasks, not to replace human judgment or accountability, particularly for tasks, projects
and assignments that involve critical decision making or outcomes.
Scope:
This administrative regulation applies to:
All city users of AI tools while conducting official city business, including employees
and officials. It covers the use of AI tools, including those that generate text, images,
videos, or other content based on data that is inputted, as well as AI models that are
trained on or process public or private information.
Definitions:
Artificial Intelligence (AI): Any tool, software, platform, system, or application,
whether provided by an external source, or created by the city, that can provide a
response, produce content (e.g., text, images, code, etc.) or provide a service, based on
information, instructions, or prompts provided by a human user.
City Data: Any data created, managed, or used by the city, including but not limited to
documents, emails, reports, and databases containing personal, public, or confidential
information.
City of Anaheim Administrative Regulation 158
Page (2) of (6)
Authorized Use of AI:
AI tools may be used for city-related tasks in the following circumstances, with users
independently verifying factual statements, citations, legal authorities, calculations, and
recommendations generated by AI systems before relying upon or distributing such
information:
1. Task Automation: Streamlining repetitive tasks such as report generation,
summarization, and customer service interactions.
2. Research and Analysis: Assisting in data processing, generating initial drafts
of documents, research, and performing analysis.
3. Creative Design: Generating content for marketing, public relations, and
digital communication, including social media posts and informational
materials.
4. Non-sensitive Data: Use of public, non-sensitive data inputted into approved
city AI tools to generate analysis or content is acceptable if it adheres to city
policies herein and any relevant laws. Any sensitive data entered into an AI tool
must be secure and not open to public viewing.
5. City Approved Tool Use Only: Only city approved AI tools may be used by
city users. All non-approved tools must receive approval from the department,
IT Manager, and from the city manager. Any new or experimental AI tools
must be approved by the city before city users are authorized to use them. This
includes review and approval from IT. The city is cognizant that public-facing
browser-based AI tools, such as ChatGPT exist, and while permissible to
utilize, users are not-permitted to enter sensitive, personal or confidential
information.
6. Examples: Some examples of authorized uses include drafting city council
agenda summaries, analyzing data, responding to service requests or creating
memos summarizing research.
Prohibited Use of AI:
In addition to not using AI for any purposes that may violate any laws, the following uses
of AI are prohibited:
1. Generating Misinformation: Using AI to produce or disseminate false,
misleading, or biased information.
2. Personal Use: Using AI for personal use not related to city business.
3. Infringing on Intellectual Property: Using AI to produce work that
plagiarizes or violates copyrights, trademarks, or other intellectual property
rights.
City of Anaheim Administrative Regulation 158
Page (3) of (6)
4.Processing Sensitive or Confidential Personal Information: AI should not be
used to process sensitive or confidential personal data unless explicit approval
is obtained from the department head, and safeguards are in place. This
includes only entering sensitive or confidential information into secure AI tools
created for the city and not open to public viewing.
5. Privileged or Confidential Information: No user shall input privileged
communications, attorney work product, litigation strategy, or confidential
legal advice into an AI system unless expressly approved or directed by the
City Attorney.
6.Bias and Discrimination: AI tools must not be used in ways that perpetuate
bias, discrimination, or inequity. City users are expected to monitor these risks
and take corrective action when needed.
7. Examples: Some examples of prohibited use include using AI as a sole basis
for hiring, termination or performance evaluations, by law enforcement as a
sole basis for making enforcement decisions, or by city users to benefit them
personally.
Data Privacy and Security:
The following specific data privacy and security protocols apply to the use of AI:
1. Data Handling: City users must ensure that no city data containing personally
identifiable information (PII), protected health information (PHI), or
programming code is uploaded into any AI tool unless such tools are data
masked or expressly approved and configured for such use by the department
head and information technology department.
2. Third-Party AI Tools: Use of third-party AI tools should be assessed for data
privacy risks. Tools should not be used without verifying that they meet city
data security standards (as established by information technology (IT)). The
City and its vendors shall comply with applicable privacy and security laws and
contractual requirements.
3. Security Compliance: All AI tools must comply with the city’s IT security
standards, and all generated content should be stored and shared securely.
4. Sensitive or Protected Data: All city users of AI must remember that any
sensitive, confidential or protected data (health, financial, legal) that is entered
into an AI tool may become public and should refrain from entering any such
data that could jeopardize the confidentiality of such information. As such,
users of city AI tools shall not enter any sensitive or protected data into public
facing or consumer available AI tools that are not proprietary to the city (no
data ownership by the city) and/or open to public viewing. Furthermore, for AI
tools that are proprietary to the city, the city must ensure that the vendor will
not share any personal or confidential information entered into the AI tool, and
City of Anaheim Administrative Regulation 158
Page (4) of (6)
that there are safeguards provided to the city to ensure that there shall be no
unauthorized use or viewing of such data entered by the city into the AI tool.
Ethical Considerations:
The following additional ethics related standards must be kept in mind when using AI:
1. Transparency: To ensure transparency, IT shall disclose through its website or
other general communications, that it utilizes AI as a tool in accordance with
applicable ethical standards for accountability, bias prevention, scrutiny,
verification and review of any AI generated work-product. Any specific AI
transparency requirements under federal or state laws shall also be adhered to.
2. Accountability: City users are responsible for reviewing and validating the
output generated by AI systems. Any AI-generated content must be aligned
with city values and standards. AI cannot replace human oversight or decision-
making in all areas of work, including public safety or city regulation.
3. Bias Prevention: City users must ensure that AI is used in ways that do not
start, perpetuate or support systemic biases.
4. Scrutiny of Work: When using any city approved AI tool for tasks that affect
public communication, or decisions or services offered to the public, use
additional steps to ensure that any final decisions that may affect any such
individuals of the public are reviewed for output accuracy and avoidance of
bias. Examples of such tasks include, but are not limited to, creating interview
questions for job vacancies, screening materials for hiring, documents relating
to regulation or safety, and any data related to policy.
Oversight and Accountability:
When using AI, the following oversight and accountability will ensure AI use is being
strictly monitored:
1. Supervisory Review: Department supervisors shall monitor the use of
approved AI tools, and any potential unauthorized use to ensure compliance
with this administrative regulation. City users shall report any concerns
regarding inappropriate or harmful use of AI to their supervisor or to IT.
2. Acknowledgment of Regulation: All AI users shall acknowledge that they
have reviewed and accepted the terms and conditions of AI appropriate use as
presented in this administrative regulation. A department supervisor shall
ensure that this administrative regulation is distributed to all users within their
department for appropriate acknowledgment and certification of review by all
users.
3. Responsibility of Information Systems: IT is responsible for all information
systems and services, including AI tools and related software. See
Administrative Regulation 150. Introduction of new AI tools or pilot programs
City of Anaheim Administrative Regulation 158
Page (5) of (6)
is only permitted under a written plan approved by IT and appropriate
department heads.
4. Reporting Violations: Any suspected misuse of AI should be reported through
the City’s established reporting channels, which include notification to the
department involved, IT and HR.
Compliance with Laws:
In addition to this administrative regulation, all users must comply with applicable
federal or state laws related to data, security, intellectual property, such as copyright and
trademark laws, accessibility laws, and department required specific laws for AI use,
such as California State BAR rules and regulations, human resources related laws and
those related to law enforcement. Additionally, all vendor contracts with AI tool
providers that involve sensitive information that may be subject to the California
Consumer Privacy Act (CCPA), or the Health Insurance Portability and Accountability
Act (HIPAA) should require that those vendors adhere to these laws.
California Public Record Act (CPRA):
The use of AI tools may generate content that constitutes a public record pursuant to the
California Public Records Act (CPRA). A public record is any writing containing
information relating to the conduct of the public's business that is prepared, owned, used,
or retained by a local agency, regardless of its physical form or characteristics. Questions
regarding whether an AI prompt, output, or related record must be retained, disclosed, or
preserved shall be referred to the City Attorney's Office.
Violations:
Violations of this administrative regulation may result in disciplinary action, up to and
including termination. Serious breaches, such as intentional misuse of AI tools to
manipulate public opinion, cause harm, or breach confidentiality, will be referred to the
city’s human resources department, as well as to the respective department head.
Administrative Regulation Review:
This administrative regulation will be reviewed annually by the city’s IT department and
city attorney’s office to ensure its relevance and effectiveness considering evolving
technology, laws, and City needs. AI is continually changing and as such, this regulation
may be amended or updated to reflect any such changes in technology as required. While
this regulation covers most relevant rules pertinent to AI, it is not all inclusive, and
departments may wish to create their own additional policies that supplement this
administrative regulation. Reviews of this AR may also be triggered outside the regular
schedule by major technology incidents or deployment of significant new AI platforms or
services by the city.
Applicability of Administrative Regulation 155:
This regulation incorporates by reference Administrative Regulation 155, the Information
Services Technology Use Policy, for its general provisions pertaining to technology use
City of Anaheim Administrative Regulation 158
Page (6) of (6)
by city users, including, but not limited to, ownership, retention and destruction of
electronic data.
Department Specific Policies:
Each City department may also develop further internal policies and rules pertaining to
appropriate AI use that are specific to their respective roles and functions and specialized
uses of AI and required under federal or state laws. Any internal rules and regulations
shall be reviewed by IT to ensure adherence to technical and data specifications and by
the city attorney’s office for adherence to the appropriate use of AI.