Bexar County Approves AI Policy to Safeguard Data and Ensure Compliance

In a significant move to regulate the use of artificial intelligence (AI) within Bexar County, the Commissioners Court approved Administrative Policy Number 5.3 during a meeting on August 19, 2025. This policy aims to establish a consistent, ethical, and secure framework for AI implementation across all county departments, addressing growing concerns about data security and compliance.

Mark Gager, the Chief Information Officer (CIO), presented the policy, highlighting the rapid increase in AI usage within the county. Currently, there are approximately 134 instances of AI applications being accessed through county accounts. Gager emphasized the risks associated with using free AI tools, which often compromise sensitive data, including personally identifiable information (PII) and health records. The policy is designed to protect this data by ensuring that all AI tools used by county employees are vetted and approved by the Bexar County Information Technology (BCIT) department.

Commissioner Calvert raised concerns about the implications of AI on sensitive health data, particularly in relation to compliance with the Health Insurance Portability and Accountability Act (HIPAA). He urged the need for a unified approach across all county-connected entities to adopt and implement the AI policy effectively. Other commissioners echoed the importance of data protection and compliance, particularly regarding the potential risks of using AI tools in public sector operations.

The policy mandates that all AI tools must align with BCIT's guiding principles and undergo a thorough evaluation process. Employees are required to submit requests for AI tools through a ticketing system, ensuring that only secure, paid versions are utilized. The policy also includes provisions for training and awareness campaigns to educate county employees about the responsible use of AI and the potential risks associated with its misuse.

As the discussion progressed, concerns were raised about the enforcement of the policy, particularly regarding how to monitor and prevent the use of unapproved AI tools. Gager assured the court that the BCIT team has the capability to block access to unauthorized AI applications and will notify department heads of any violations.

The approval of this policy marks a proactive step by Bexar County to navigate the complexities of AI technology while safeguarding sensitive data and ensuring compliance with legal standards. As AI continues to evolve, the county's commitment to responsible usage and data protection will be crucial in maintaining public trust and operational integrity. The court's decision reflects a growing recognition of the need for clear guidelines in the face of rapidly advancing technology.